Auditing 81.3550 Auditing & Automated Systems Chapter 22 Auditing & Automated Systems Chapter 22

  • View
    222

  • Download
    0

Embed Size (px)

Text of Auditing 81.3550 Auditing & Automated Systems Chapter 22 Auditing & Automated Systems...

  • Slide 1
  • Auditing 81.3550 Auditing & Automated Systems Chapter 22 Auditing & Automated Systems Chapter 22
  • Slide 2
  • Highlights
  • Slide 3
  • Auditing and Computer Systems As client computing facilities become more sophisticated, paperless accounting systems evolve wherein little hard copy documentation is produced Evidence forms may differ slightly but the basic procedures and objects are often similar. As client computing facilities become more sophisticated, paperless accounting systems evolve wherein little hard copy documentation is produced Evidence forms may differ slightly but the basic procedures and objects are often similar.
  • Slide 4
  • Challenges of Sophisticated Computer Systems - audit trails, documentation may only exist on disk (no printed copies) - program errors may exist that cause uniform transaction errors - in some circumstances, controls may have to make up for a lack of adequate segregation of duties - detecting unauthorized access may be difficult - audit trails, documentation may only exist on disk (no printed copies) - program errors may exist that cause uniform transaction errors - in some circumstances, controls may have to make up for a lack of adequate segregation of duties - detecting unauthorized access may be difficult
  • Slide 5
  • electronic method of sending documents between companies no paper trail for the auditor to follow increased emphasis on front-end controls security becomes key element in controlling system electronic method of sending documents between companies no paper trail for the auditor to follow increased emphasis on front-end controls security becomes key element in controlling system Challenges of Sophisticated Computer Systems
  • Slide 6
  • Electronic Fund Transfers (EFT) also referred to as electronic commerce, or e-commerce greatly increased through internet shopping direct payment systems, e.g. payroll, remove the paper trail once relied upon by auditors also referred to as electronic commerce, or e-commerce greatly increased through internet shopping direct payment systems, e.g. payroll, remove the paper trail once relied upon by auditors
  • Slide 7
  • Data Communications Risks and Control Procedures As part of the audit equation need to assess computer control systems in place Starting point obtaining clients computer system documentation, diagrams, policies and procedures
  • Slide 8
  • loss of confidential information, through corporate espionage or hackers -create multiple levels of passwords; change regularly data intercepted during data communication -encrypt (scramble) information during transmission loss of confidential information, through corporate espionage or hackers -create multiple levels of passwords; change regularly data intercepted during data communication -encrypt (scramble) information during transmission Data Communications Risks and Control Procedures
  • Slide 9
  • inappropriate access to information via the Internet - use of firewalls - physically separate homepage equipment and software from other systems viruses invading systems - same as above - use current anti-virus software inappropriate access to information via the Internet - use of firewalls - physically separate homepage equipment and software from other systems viruses invading systems - same as above - use current anti-virus software Data Communications Risks and Control Procedures
  • Slide 10
  • Organization should have a well planned disaster recovery plan Should include regular offsite storage of prior data Organization should have a well planned disaster recovery plan Should include regular offsite storage of prior data Data Communications Risks and Control Procedures
  • Slide 11
  • Disaster Recovery Process Basics 1.Management commitment to disaster recovery planning. 2.Ranking of business processes: What will happen if process x fails? 3.Identifying minimum resources required to restore vital operations. 1.Management commitment to disaster recovery planning. 2.Ranking of business processes: What will happen if process x fails? 3.Identifying minimum resources required to restore vital operations.
  • Slide 12
  • Disaster Recovery Process Basics 4.Prepare a data centre plan and a user plan. 5.Test the plan, to discover any shortcomings in the plan before disaster strikes. 4.Prepare a data centre plan and a user plan. 5.Test the plan, to discover any shortcomings in the plan before disaster strikes.
  • Slide 13
  • Categories of Controls in an EDP Environment GENERAL CONTROLS relate to all parts of the EDP system. APPLICATION CONTROLS relate to one specific use of the system payroll system expenditure system revenue system revenue system
  • Slide 14
  • Categories of General Controls 1. plan of organization Separate duties in EDP systems as discussed in chapter 9.
  • Slide 15
  • 2. systems development and documentation controls each system should have documented, authorized specifications any system changes should be author- ized and documented 2. systems development and documentation controls each system should have documented, authorized specifications any system changes should be author- ized and documented Categories of General Controls
  • Slide 16
  • 3. hardware controls Categories of General Controls -diagnostic routines - hardware or software that checks the systems internal operations and devices -boundary protection - ensures that simultaneous jobs do not interfere with one another -periodic maintenance - hardware should be examined periodically by qualified technicians
  • Slide 17
  • 4. controls over access to equipment, programs, and data files limited on need basis Categories of General Controls ACCESS TO: program documentation data files & programs computer hardware
  • Slide 18
  • 1. Responsibility for control 2. Information system meets needs of entity 3. Efficient implementation of information systems 4.Efficient and effective maintenance of information systems 5.Effective and efficient development and acquisition of information systems 6.Present and future requirements of users can be met 7.Efficient and effective use of resources within information systems processing 1. Responsibility for control 2. Information system meets needs of entity 3. Efficient implementation of information systems 4.Efficient and effective maintenance of information systems 5.Effective and efficient development and acquisition of information systems 6.Present and future requirements of users can be met 7.Efficient and effective use of resources within information systems processing Objectives of General Controls
  • Slide 19
  • 8.Complete, accurate and timely processing of authorized information systems 9.Appropriate segregation of incompatible functions 10.All access to information and information systems is authorized 11.Hardware facilities are physically protected from unauthorized access, loss or damage 12. Recovery and resumption of information systems processing 13.Maintenance and recovery of critical user activities 8.Complete, accurate and timely processing of authorized information systems 9.Appropriate segregation of incompatible functions 10.All access to information and information systems is authorized 11.Hardware facilities are physically protected from unauthorized access, loss or damage 12. Recovery and resumption of information systems processing 13.Maintenance and recovery of critical user activities Objectives of General Controls
  • Slide 20
  • Physical Access Controls Visitor identification Security guards Security systems Locked areas
  • Slide 21
  • 3 Basic categories: Application Controls input processing output
  • Slide 22
  • Input Controls input data should be authorized & approved the system should edit the input data & prevent errors Examples include: validity checks, field checks, reasonableness check, record counts etc. input data should be authorized & approved the system should edit the input data & prevent errors Examples include: validity checks, field checks, reasonableness check, record counts etc.
  • Slide 23
  • Processing Controls assure that data entered into the system are processed, processed only once, and processed accurately
  • Slide 24
  • Examples control, batch, or proof total - a total of a numerical field for all the records of a batch that normally would be added (example: wages expense) logic test - ensures against illogical combina tions of information (example: a salaried em- ployee does not report hours worked) Examples control, batch, or proof total - a total of a numerical field for all the records of a batch that normally would be added (example: wages expense) logic test - ensures against illogical combina tions of information (example: a salaried em- ployee does not report hours worked) Processing Controls
  • Slide 25
  • Output Controls assure that data generated by the system are valid, accurate, complete, and distributed to authorized persons in appropriate quantities
  • Slide 26
  • 1. Design application controls with regard to: - segregation of incompatible functions - security - development - processing of information systems 2. Information provided by the systems is: - complete - accurate - authorized 3. Existence of adequate management tr