Computer auditing and the use of the computer - summary (стр. 4 )

Analysis of objectives Procedures of auditor

Completeness : All transactions were recorded at the time when they took place All transactions have been reported in the accounting records	- check date on the supporting documentation - check sequential numbering of transactions
Occurrence : Transactions reordered in records did actually take place Transactions recorded in the accounting records pertain to the entity	- investigate existence of valid documents - compare entries in accounting records with supporting documents - check that transactions have been authorised - check supporting document to ensure that entity was party in the transaction
Existence : Assets and liabilities did actually exist on given date	- perform physical inspection of assets and compare it with the accounting record - examine supporting documentation - obtain supporting evidence from 3rd parties
Accuracy / cut-off / classification : All transactions have been recorded at the proper amount All transactions have been correctly allocated All transactions have been recorded in the correct financial period	- compare the amount from supporting documents with the amount in the accounting records - compare the allocation with the particulars in the supporting documents - compare the date of the transaction with the date on the supporting documentation
Valuation : Assets and liabilities have been recorded at an appropriate carrying value Assess value by physical inspection Assess the reasonableness of the amounts claimed for reduction / increase or write-off of assets	- obtain external valuation or confirmation from 3rd parties - compare value by referring to supporting documentation
Rights and obligations : Assets and liabilities pertain to the entity at a given date	- examine supporting documentation - obtain evidence from 3rd parties in support of rights or obligations - obtain sufficient information to make sure that the state of affairs was applicable at given date
Presentation and disclosure : Items in financials have been correctly disclosed, classified and described	- examine financials and obtain satisfaction that there has been proper disclosure, classification and description in terms of the Companies Act and generally accepted accounting practice

GAS substantive procedures fixed assets (BS) – use audit software to :

v  select sample of additions and disposals to confirm with source documents

v  print an exception report of any missing / duplicated asset codes

v  select a sample for physical inspection

v  recalc depreciation for each asset and compare to client register and print exception report

v  print exception report of any asset with negative book value

v  print exception report of any asset where the depreciation rate or method of calculating depreciation is different from the company’s accounting policy

v  recalculate all additions, totals and cross casting

and follow up differences with management

GAS substantive procedures share capital (BS) – use audit software to :

v  summarise shareholders resister per main category of share capital and compare it to the GL

v  recalc share split and shares issued

v  identify all new shares that were issued with cash actually received

v  identity all negative shareholdings

v  identify all shares that were redeemed during the year and compare it to the amount of cash paid

v  print report indicating main shareholders to obtain positive confirmations that they hold the shares

and follow up differences with management

GAS substantive procedures on entity’s investments (BS) – use audit software to :

v  add up the investments per type and compare to accounts in the GL

v  extract list of all new and redeemed investments and compare the cash paid or received to confirm the amounts

v  recalc investment income and compare to accounts in GL

v  recalc amortisation of discounts and premiums and compare to accounts in GL

v  identify investments in associate companies and compare to accounts in GL

v  draw test sample of investment transactions to verify

v  draw test sample of investments for external confirmation

and follow up differences with management

GAS substantive procedures on verification of inventory (BS) – use audit software to :

v  recalc value of inventory at year-end (quantity on hand x cost of last purchase)

v  compare total inventory value to GL

v  draw sample of representative number of items to verify during physical count

v  list items on hand at year end where there is a zero YTD sales quantity and investigate

v  list items with negative unit costs or negative quantity

v  extract items where average unit cost exceeds the unit selling price

v  extract list of duplicate / missing inventory numbers

v  extract sample of item by date of last receipt, supplier code, unit cost and quantity on hand to obtain the latest cost price per item

and follow up differences with management

Risks associated with internet connection :

·  masquerade – imitating someone

·  disclosure – someone could “wire-tap” access

·  unauthorised access

·  loss of data integrity – data is adjusted or changed while in transit

·  refusal of service – cos internet is flooded with requests

·  theft of services or resources – if offer specific service to client on the net

Detection risk

Risk that auditor will not detect a misstatement that exists in an assertion that could be material, either individually or in total with misstatements in other assertions. Detection risk is controlled by the auditor

Inherent risk (“built in” risk) - controlled by entity

Control risk (relates to internal controls) – inherent and control risks controlled by client

Database is collection of data that is shared and used by different users and application programs for different purposes. Consists of database and DBMS

Controls in database system :

General controls

·  standard approach for development and maintenance of application programs

·  data ownership

·  access to database

·  division of duties

·  data resource management

·  database recovery – controls for data security and database recovery are critical

Online processing - general controls :

·  access controls

·  password controls

·  systems development and maintenance control measures

·  programming control measures

·  transaction logs

Online processing - application controls :

·  pre-processing authorisation

·  terminal device edit

·  cut-off procedures

·  file controls

·  masterfile controls

·  balancing / reconciling

Advantages for service bureau : ·  division of duties when processing done though 3rd party ·  cost saving on : Ш  capital outlay for hardware and software Ш  IT staff ·  hardware, resources and expertise provided by service bureau ·  reliability of processing ·  service bureau probably has secure control environment

Disadvantages for service bureau : ·  dependency on bureau for processing ·  loss of control over info processing ·  costs / levies to service bureau ·  reliability of bureau for processing and safeguarding integrity of data ·  risk of being locked into obsolete technology

Other issues to be considered before using service bureau :

·  fee structure

·  speed of info turnaround

·  is bureau financially sound?

·  quality of backup and support available

·  service bureau’s contingency plans

·  bureau’s ability to keep pace with technology

·  quality of info made available

·  implications for :

Ш  management control

Ш  accounting control

·  will system cater for future needs?

·  effect on companies image (staff and 3rd parties)

Advantages of EDI (Electronic Data Exchange) :

·  cost savings for transactions i. e. human preparation, time, paper costs, postage etc

·  increased speed in processing transactions and communication with trading partners

·  more accurate processing – reduction in risk of errors

·  improved inventory and cash management

·  improved trade relations with suppliers

Programmed (logical application controls)

Controls must be implemented to ensure that messages have been properly received :

·  echo checking – messages transmitted back to transmitting device to ensure individual messages are complete

·  use of verification of headers, trailers and record counts

·  use of hash values and hash value comparison.

·  messages should be automatically re-transmitted if any errors are detected

·  use and verification of proper message structures will ensure that input is received from valid source

·  before processing data in each message must be subjected to normal input validation / edit checks

·  recipient should wait before reacting to messages in case an error is detected and corrected

·  atomicity – feature of a transaction is considered to be indivisible so if the transaction is interrupted or fails then a mechanism is provided to ensure that the system is returned to its state prior to the initiation of the transaction

· 

Dynamic Auditing pg 9/28

terminals :

Ш  shutdown after period of inactivity

Ш  shutdown after 3 unsuccessful logins. Reconnection only by supervisor and investigation after every disconnection.

Ш  Unable to login simultaneously on different machines (restricted to one login at a time)

·  identification of users – passwords, computer’s serial number, magnetic cards

·  authorisation of use – levels of access, two or more passwords needed for release, onetime passwords

·  use of access system software – firewalls, console logs and software to monitor and report unauthorised attempts to gain access

·  monitor access and processing – print auditor trail of daily activities and processing showing all sign-ons and sign offs, sensitive transactions processed and use of utilities

·  communication lines and networks – controlled by passwords and sensitive data transmitted via different route

·  password controls – minimum length, not obvious, cancelled on resignation, changed monthly, confidentiality emphasied to staff

·  restricted access to password and login files, menu files and authorisation level files

·  data to be encrypted

·  separate systems for vulnerable and sensitive applications (away from main file servers or main system)

·  program libraries – controlled by manager and librarian who can monitor program updates and use, make backups, control access to data

·  utilities control – general user programs that read, organise, change or gain access to files

EFT transactions

Advantages of EFT’s :

·  improved cash flow cos of stricter control of funds

·  cost savings in service fees and for staff cos no user preparation of cheques

·  improved security and control cos no cash handling

·  sensitive info like salaries better controlled then with pay packets

EFT edit checks / tests :

·  format testing – computer tests that names are alphabetic and amounts are numeric etc

·  screen testing – operator tests accuracy of EFT transfer instructions

·  dependency testing – system tests if payments are for valid transactions on the system

·  limit / reasonability testing – computer tests the reasonableness of payments against predetermined limits

·  digits check – computer tests accuracy of codes / accounts entered

·  control totals – computer calc total payments for EFT transactions in comparison to the bank totals

·  occurrence & authorisation / existence testing – computer tests the validity of payments against masterfile details

·  field size – computer tests of different fields size of payment instructions (e. g. bank account mustn’t exceed 6 digits etc)

Firewalls – combination of computer hardware and software that strengthens access controls over the internet by :

·  separating the internet from the internal computer network

·  controlling traffic to and from the internet by forcing data to follow a controlled route

·  controlling the acceptability of incoming and outgoing data

·  logging internet activity

·  using encryption / decryption facilities

Different types of word processing software :

·  word processing – engagement letters that are saved on computer and can be reviewed and updated instead of retyped annually

·  spreadsheets – time and money budgeting / time sheets updated so audit manager can effectively monitor the cost of the audit

·  presentation software – complex recommendations easily understood if presented in graphic format

·  flow charting software – in each audit have to compile and update system descriptions of the flow of documents / transactions. Use software to analyse procedures and identify the controls (or lack of them). Flow charts can be reviewed and updated annually.