Auditing in a Computerized Environment - Audit report, Auditing and Secretarial Practice Video Lecture | Auditing and Secretarial Practice - B Com

auditing in a computerized environment
with the rapid development in technology
in recent years computer information
systems have become feasible
perhaps essential for use even in small
scale business operations almost all
entities now use the computers to some
extent in their accounting systems this
widespread use of computers has offered
new opportunities for professional
accountants and has also created some
challenging problems to the auditors
regardless of the extent of
computerization are the methods of data
processing being used the responsibility
for the establishment and implementation
of appropriate internal control systems
rests with the management and those
charged with governance the others
responsibility is to obtain an
understanding of the entity's internal
control system to be able to assess the
control risk and determine the nature
timing and extended the tests to be
performed characteristics of computer
information systems computer information
systems have essential characteristics
that distinguish them from manual
processing systems first is lack of
visible transaction trails in the manual
system it is normally possible to follow
a transaction to the system by examining
source documents entities records and
financial reports in a CAS environment
data can be entered directly into the
computer system without supporting
documents furthermore records and files
may not be printed and cannot be read
without using the computer the absence
of these visible documents supporting
the processing of transactions makes the
examination of evidence more difficult
consistency of performance CAS performs
functions exactly as programmed if the
computer is programmed to perform
specific data processing tasks it will
never get tired of performing the
assigned tasks in exactly the same
manner he's of access to data in
computer programs in a CAS environment
data in computer programs may be
accessed in altered by an authorized
persons leaving no visible evidence
concentration of duties
proper segregation of duties is an
essential characteristics of a sound
internal control system however because
of the ability of the computer to
process data efficiently there are
functions that are normally segregated
in manual processing that are combined
in the CIS environment systems generated
transactions certain transactions may be
initiated by the CAS itself without the
need for an input document for example
interest may be calculated and charged
automatically to customers accounts
balances on the basis of pre-authorized
terms contained in a computer program
vulnerability of data and program
storage media in a manual system the
records are written in ink on
substantial paper the situation is
completely different in CIS environment
the information and the computer can be
easily changed leaving no trace of the
original content
internal control in the CIS environment
many of the control procedures used in
manual processing also apply in CIS
environment examples of such control
procedures include authorization of
transactions proper segregation of
duties and independent checking where
the computer processing is used in
significant accounting applications
internal control procedures can be
classified into two types general and
application controls
organizational controls organizational
controls are a plan of an organization
with a clear assignment of authority and
responsibility in a CIS environment the
plan of an organization for an entity's
computer system should include number
one segregation between the user and CI
as department CI as department must be
independent of all departments within
the entity that provide input data or
the Jews output generated by the CAS the
function of CI as department is to
process transaction functions within the
CIS department should be properly
segregated for good organizational
controls the entity's organizational
structure should provide for definite
lines of authority and responsibility
within the CIS department systems
development and documentation controls
software development as well as changes
must be approved by the appropriate
level of Management and the user it
Department access control is a security
technique that can be used to regulate
who or what can view or use resources in
a computing environment access to the
computer should delimited only to
operators and other authorized employees
the last general control is monitoring
controls these are actions performed to
provide assurance that CIS controls are
working effectively as planned
application control are designed to
ensure the integrity of the accounting
records which means this are designed to
provide a reasonable assurance the
application control related to the
procedures used to initiate records
process and reports transaction or other
financial data
there are three common concept in the
application control the first one is to
control other inputs control other
inputs activities are designed to ensure
that input is ultra is complete accurate
and timely I refer to as input control
the second one is control over
processing processing control exists to
ensure that all data input is processed
correctly and that data files are
appropriately updated accurately in a
timely matters then the last one is the
output control output control it exists
to ensure that all data is processes and
that output is distributed only to
prescribe authorized users test of
control in the CIS environment involves
evaluating the clients internal control
policies and procedures to determine if
they are functioning as intended so you
have controls the CIS environment I
Kappa Holloman oh that's a good that's a
controls of manual processing
environment where it's still evaluate
the clients internal control to
determine the effectiveness and
efficiency of entities operation in
testing application control my dalla
Wong approach owner auditing along the
computer in the panel of a computer
assisted all the techniques social
auditing around the computer it involved
examination of documents and reports to
determine the reliability of the system
so in this approach is also known as
black box approach where it be seeing a
lot of testing control in
control structure suits Zappos Couture
internal auditorium clients data
processing procedure at number
focusmaster
input documents and CAS output where
kappahd nigricans Lu input document and
CIS output image a million now
processing computer iam transaction ask
you quickly however Merrill shall
witness auditing around the computer can
be used only if there are visible input
documents and media output so malaga
McClung you approach natal is pc volume
input and output where in other words
meditation auditorium transaction back
and forth another testing application
controls that the auditor will use is
the computer assisted are the techniques
when computerized accounting systems
perform tasks for which no visible
evidence is available it may be
impracticable for the auditory to test
manually such is usually the case when
the entity uses advanced EAS such is
usually the case when the entity uses
advanced EAS consequently the auditor
will have to audit directly the clients
computer program using CA 80s this is
also called the white box approach see
these are computer problems in data
which the auditor uses as part of the
audit procedures to process data up
audit significance contained in an
entity's information systems some of the
commonly used CA ATS include test data
integrated test facility in parallel
simulation the test data technique is
primarily designed to test the
effectiveness of the internal control
procedures which are incorporated in the
clients computer program the objective
of the test data technique is to
determine whether the clients computer
programs can correctly handle valid and
invalid conditions as they arise when
using integrated test facility the
auditor creates Tommy are fictitious
employee or other appropriate unit for
testing within the entity's computer
system when using integrated test
facility the auditor must be alert to
the danger of contaminating the clients
master files parallel simulation
requires the auditor write a program
that simulates key features are
processes of the program under review
the simulated program is then used to
reprocess transactions that were
previously processed by the finals for
others it is highly complicated computer
systems sometimes do not retain
pertinent audit trails and would require
capturing of audit data assets actions
are processed under this scenario the
see it is available to the auditor may
include number 1
snapshots snapshots these techniques
involves taking a picture of a
transactions as it flows to the computer
systems such a technique
permits an auditor to track data and
evaluate the computer processes applied
to the data system control audit review
files this involves embedding audit
software modules within an application
system to provide continuous monitoring
of the system transactions the
information is collected into the
special computer file that the auditor
can examine