INTRODUCTION
- Now-a-days, the corporate world is getting more and more inclined towards the use of Information technology (IT) and computer information system (CIS) in their daily operations.
- This has changed the manner in which the organisations’ carry out their operations and various business processes.
- This has further led to change in the nature of audit evidences generated by each financial transaction.
- The method of collection and evaluation of audit evidences has also changed.
- This requires auditors to possess reasonable knowledge about EDI, SDLC, CASE tools and various hardware & software used in the organisation.
SCOPE OF AUDIT IN CIS ENVIRONMENT / IMPACT OF CIS ON AUDITING
The use of CIS in various organisations has caused drastic impact on audit approaches, techniques, risk involved and internal control methods. Following factors (risks) must be given due consideration while framing an audit plan for an organisation:
- High speed and Automatic initiation/execution of transactions: In CIS environment, transactions are processed instantly. Once the transaction is fed into the system, it might get executed automatically without requiring for authorisation of the same. Similarly, reports (even complex one’s also) can be generated at a very high speed and can be viewed by multiple users at a time. Thus giving rise to many security issues.
- Uniform processing of transaction, hence low clerical error: While feeding input, processing transactions and generating outputs, computer system performs multiple checks on data at each at each point of time. Moreover, the processing of transaction is in a uniform manner. Hence the clerical errors generated are minimised. However, there is a shift of errors from human generated errors towards system generated errors.
- Unintentional or system generated errors: As discussed earlier, there is a shift in nature of errors from human generated to system generated. Errors occur due to lack of experienced personnel. And errors are mainly related to development, maintenance and execution of CIS.
- Inexperienced personnel: Now-a-days, the technological advancement is occurring at a very fast pace. It has created a deficit of expertized staff to understand the current technology, both at client end as well as auditor end.
- Concentration of duties: Under CIS environment, more than one kind of task/function can be performed by an individual. This leads to difficulty in segregation of duties among individual. Consequently, it gives rise to a number of security issues also.
- Lack of audit trail: In computerised system, the processing of a transaction takes place instantly. This leads to loss of audit trail. Thus, auditor needs to apply some alternate procedure to compensate the loss of audit trial.
|
Audit Trail: It can be defined as a step-by-step record by which a transaction can be traced. The auditor may apply one of the following methods to compensate the loss of audit trail: 1. Special/Exceptional Reports: The auditor may ask the client to arrange special reports and print-outs. E.g.: sales orders for the month of December & March; purchase orders that have been short-closed by the purchase department. 2. Tagging and Tracing:
3. Alternative Review Procedures (ARP): It means to include a number of methods to compensate audit trial, such as:
4. Use of CAAT: The auditor may take the help of white-box audit approach or CAATs. |
- 7. Auditor’s participation in SDLC and dependence on other (manual) controls: We know that there is a constraint of audit trail in CIS environment. Thus, a computerised information system lacks manual reasonableness. An information system of an organisation can only be effective if it has reasonable level of audit facilities integrated into it. Hence participation of auditor is highly important in SDLC. Moreover, auditor may use certain manual methods also while performing the audit.
- 8. Internal Control Environment & management supervision: The success of CIS highly depends upon the involvement of management in development and maintenance of CIS. Under CIS environment, the risk of fraud & error is relatively high. Thus higher management supervision and better internal control environment is required.
- 9. Use of CAAT: The audit under CIS environment cannot be carried by traditional (manual) approaches, effectively. Since the processing of transaction in CIS environment is fast and complicated, the audit must be carried out using computer assisted audit techniques (CAAT). This requires a reasonably good amount of IT skills on part of the auditors.
IMPACT OF CHANGES ON BUSINESS PROCESS
1. EDI: Electronic Data Inter-change, as the name suggests means exchange of data/information/documents from one user to another, electronically (with the help of computers). In other words, EDI is the computer-to-computer exchange of documents/information in public standard format. Under EDI framework, once transaction (data) is fed into a computer many records are automatically updated. There is no need to re-enter the data into accounting system. This saves a lot of time & effort and enables an error free transaction processing system (TPS).
2. Process of recording transactions: Unlike, manual system where a transaction goes through a sequence of steps in order to get recorded in the principal books [Entry Ledger Final Accounts (Balance Sheet and Profit & Loss Account)]. Under CIS environment, the above mentioned three processes are carried out simultaneously.
3. Accounting / Transaction Processing System: As mentioned above the CIS mechanism leads to abandonment of maintenance primary records.
| Batch Processing (Old Concept) |
OLRT / RTOL System (New Concept) |
Time Sharing & Service Bureau (Distinct & New Concept) |
| 1. It is a simple system and somewhat like traditional manual system. | 1. OLRT – On-Line / Real-Time. | 1. Time sharing is a situation where a single computer serves more than one user. |
| 2. In this process transactions are accumulated and processed in groups. | 2. Under this system transaction are processed as soon as they occur. | 2. A service bureau is an organisation which processes transaction on behalf of its client organisation. |
| 3. In this files are not updated quickly. | 3. All the records are updated simultaneously on occurrence of a transaction. | 3. E.g.: a service bureau handling payroll (including ESI/PF) for a small company. |
| 4. E.g.: Accountant accumulates all the cash receipts vouchers for the day and updates his accounting record by the end of a working day. | 4. E.g.: On issue of a Sales invoice, Sales ledger and debtor’s ledger are updated, automatically. | 4. If an organisation uses services of a service bureau then the auditor must obtain reasonable evidences in support of the controls exercised by the client organisation over the activities performed by service bureau. |
| 5. Software packages like Tally, SAP, etc. works like this. | 5. Nowadays, many of accounting firms are doing this kind of activities. |
4. Data Storage / file system: The data storage facilities and filing system of the organisation has gone through drastic changes as result of changes in the style of carrying out business processes.
|
Flat File System (Old Concept) |
Integrated Database System (New Concept) |
|
1. In few words, in a flat file system, users own their own data and they are responsible of their respective data files. 2. It leads to data redundancy and repetition of tasks. 3. E.g.: Try and visualise admission system of a government college, where you are asked to fill-up a hand-written form.
4. It is evident from above example that how one simple transaction need to be recorded in 4 separate set of books kept with separate users. |
1. In this the transaction is entered only once and the data corresponding to such transaction is shared by multiple users. 2. It works on client-server technology / topology. 3. It contains a set of interrelated files. When input is fed from one end, the master file (server) itself gets updated. This master file can be retrieved by more than one user (clients). Hence reduces data redundancy. 4. E.g.: A person sitting at sales office issue Sales Invoice to its customer. Under this system master files related to Sales and Debtors are automatically updated. The person sitting in back-office can anytime check the Sales data or outstanding debtors. 5. This kind of system is mainly used with On-Line / Real-Time Systems. |
5. Organisational structure: Since there is very high dependence of the organisation of CIS, no-a-days. Thus, there is a need for separate department (group of people) to take care of IT needs of the organisation. Some of the personnel are listed below:
- EDP Manager: is responsible for overall management and administration of the IT department.
- Data Administrator: ascertains the data requirements of various users of information system in the organisation.
- Database Administrator: is responsible for operational efficiency and security of the organisational database.
- System Analyst: takes care of the information requirement of the users for new as well as existing applications; designs information system architecture to meet these requirements; facilitates implementation of information systems and maintains documentation.
- System Programmers: is responsible for the maintenance of operating system (OS) software, network and hardware requirements.
- Application Programmer: designs new programs and modifies existing to meet the data processing needs; remove errors and improves efficiency of the existing application software.
- Operation Specialist: plans and controls the day-to-day issues, which emerge during normal course of work, of the users of information.
- Librarian: maintains library of magnetic media and documentation.
6. Modified internal control base: In CIS environment since most of the processes are automated, the probability of occurrence of error substantially increases. Moreover, the risk of fraud is higher in CIS environment, as it is less-easily identifiable. Thus, there is a shift in internal control base in CIS environment as compared to traditional manual system. Following are two main categories of internal control required in CIS environment:
|
A. General EDP Controls: |
B. EDP Application Controls: |
|
i. Organisational & Management Controls: These controls are designed to establish an organisation wide frame-work for CIS activities. It includes:
ii. System Software Controls: These controls are meant to provide assurance that system software is acquired or developed in an authorised manner. It includes:
iii. Application System Development & Maintenance Controls: These control are designed to provide assurance that systems are developed and maintained in an authorised and efficient manner and also to establish control over:
iv. Computer Operation Controls: These help in controlling the operations of the computer system. They assure that:
v. Data Entry & Program Controls: These assures that:
|
i. Control Over Inputs: These controls are drawn to assure that:
ii. Control Over Processing & data files: These controls ensure that:
iii. Control Over Output: They assure that:
|
PREREQUISITES WHILE AUDITING IN CIS ENVIRONMENT
AUDIT APPROACH IN CIS ENVIRONMENT
There have been drastic changes in audit approaches and methodologies as a result of emergence of CIS environment. The selection of one of the approaches depends upon the knowledge base expertise of Auditors. There are mainly two approaches for auditing in CIS environment that are explained as follows:
A. Black-box Approach (Auditing around the computer): In this approach, the auditor is mainly concerned about the Inputs fed-in by the client and the output generated by the system. The auditor completely ignores the internal processing of the Information System.
For example, while testing payroll of a company, under black-box approach, the auditor may first find out the total monthly hours worked by selected employees from their respective time cards and then he may check the salary/wage rate from the rate card to find out the salary/wage payable to each employee. On the basis of above, the auditor ascertains his own output by comparing hours, rates, extensions, over-time & leaves. Finally, the auditor compares his own results with the system generated results.
This approach may be enumerated with the help of the following flowchart:
|
CIS |
|
Client’s Output |
|
Compare with Client’s Output |
|
CLIENT’s Input |
|
AUDITOR’s Predetermined Output |
The biggest advantage of auditing around the computer is the ease and simplicity, since the auditor does not require in-depth knowledge of system application program in order to perform his duties.
On the contrary, a major disadvantage is that, under this approach, the auditor is completely ignorant about the internal processes of the system. Moreover, in order to generate certain complex reports, print-outs cannot be arranged to apply the audit procedures.
B.
|
Auditor’s Output |
|
Compare with Client’s Output |
|
AUDITOR’s Input |
|
Client’s CIS & use of CAAT |
White-Box Approach (Auditing through the computer): Under this approach, the auditor is not only concerned with the subject matter of the audit (i.e. inputs and outputs), but also with the internal processing of the computer system. This means to include various auditing with the help of Audit software and computer aided audit techniques (CAAT). This can be explained with the help of following flowchart:
|
Pre-prepared Output of Client using his own inputs & CIS |
CAAT: COMPUTER AIDED/ASSISTED AUDIT TECHNIQUE
Under CIS environment, the auditing cannot be carried effectively using traditional / conventional and manual techniques of auditing. The auditing through the computer requires the use of various audit software packages and some computer assisted audit techniques.
AUDIT SOFTWARE
The use of CAAT allows the auditor to test the reliability and credibility of the clients’ information system, without being much dependent upon the clients’ software. Now-a-days, there are a plenty of audit software options available with the auditor, with the help of which he can perform his audit independently and effectively. This audit software may include package programs, purpose-written programs, utility programs or system management program. These programs are explained as follows:
I. Package Programs:
- These are generalised computer software packages.
- These packages come with a lot of generalised features and utilities, which can be used at many clients’ site.
- Since these software packages are highly generalised and are available across the globe, so one does not face any compatibility issues. Almost all the organisation maintains certain level of compatibility with these programs.
- E.g. MS-Excel can be the most common example for such programs.
II. Purpose-written Programs:
- These programs are created to perform specific natured audit task.
- These packages are not available for sale in the open market. The auditor is required to get these programs developed.
- The auditor may appoint some outside agency to develop the program on his behalf (outsourcing) or he may himself hire the programmers and get it built in-house.
- While choosing the purpose-written program option, the auditor must take into consideration, the cost related issues.
III. Utility Programs:
- These programs are used to perform common data processing functions such as sorting; sampling; documenting; creating, emailing & printing files/reports, etc.
- Although, these are not specifically designed for the audit purposes but can be extremely useful while performing the audit.
- E.g. Acrobat’s Adobe Reader; Microsoft’s Office also consist of certain utility programs such as MS-Access, MS-Word, MS-PowerPoint, etc.
IV. System Management Software:
- These software/programs are also not specifically meant for audit purpose.
- These are productive tools, meant to enhance the performance of the Operating System.
- E.g.: Disk Defragment, Task Manager, Task Scheduler, Disk Clean-up, etc. are some of the examples of system management software.
USES OF CAAT
CAAT may be used to perform following audit procedures:
- Detailed and in-depth test of transactions and balances: The auditor can check the transaction in-depth and in detail, since he can select a larger sample size. There is a lot of time saving, while applying CAAT, thus he may apply more time to analyse a transaction.
- Application of complex analytical review procedures: The can perform complex procedure and calculations with the help of CIS. He may extract detailed and complex reports also to support his procedure.
- Application of statistical sampling techniques to extract the relevant data: While extract data from the client’s information system, the auditor can take help of complex statistical and scientific techniques in order to improve the quality and prudence of sample selected. Application of statistical and scientific methods is almost impossible, without the help of computer systems. E.g.: MS Excel is an application program that contains a number of statistical and mathematical formulae and techniques.
- Test of general EDP controls: The auditor may check various input controls; processing controls; output controls; data storage, transmission and security controls. The auditor can check the access rules and procedure.
- Test of Application controls: The auditor can check the functioning of various applications installed and running in the system. The auditor may check the authenticity of various application programs.
- Re-Performing calculations and processing: The auditor can also re-perform calculations performed by the client’s accounting system.
- Better reporting Methods: Under CIS environment there are a number of reporting techniques are available with the auditor. The auditor can use of various graphical designs and multimedia techniques in order to make his report effective, concrete and more catchy. E.g.: MS PowerPoint is one of the software used to prepare presentations.
CONSIDERATIONS IN USE OF CAAT
While planning an audit with the help of CAAT, the auditor must take care of the following factors:
- IT knowledge and experience of the Audit Team: Both the auditor and the audit team should have sufficient skills and experience to handle the audit under CAAT.
- Availability of relevant Audit Software and suitable computer facilities: The auditor can use the CAAT and maintain the independence only if he has sufficient infrastructure, in the form of computer hardware and audit software, available with him. Otherwise the cooperation and assistance of the client entity’s personnel will be required.
- Impracticability of manual test: Now-a-days, many organisations are adopting eco-friendly approaches while performing the business operations. Moreover, many computer information system perform tasks where there is no hard copy evidence is generated. Hence making it impractical for the auditor to perform the tests manually.
- Effective and Efficiency: With the help of CAAT, it is possible to test large number of transactions together with a better level of precision. This brings efficiency and effectiveness in performing the audit assignment.
- Time Constraint: The auditor is required to perform the assignment in the limited time span. Whereas, a large amount of data is required to be stored (such as transaction details and reports) for such short audit period. Thus the auditor is required to make arrangement for retention and retrieval of data.
- Detection of fraud and error: The CAAT allows the auditor to plan and execute the audit work more effectively with the help of sophisticated audit software. But, under CIS environment, frauds are intentional and generally deep-laid. Moreover, there are chances that some frauds are highlighted, but there is no concrete evidence to prove the same. Thus it cannot be said that the auditing through the computer will increase the probability of detection of fraud.
- Use of CAAT in small organisations: In small business organisation, use of CAAT might not be a cost-effective and viable alternative. This is because of two reasons, first the revenue per assignment is not very huge, and second the client entity might not have the appropriate technical infrastructure to run CAAT.
STEPS INVOLVED IN APPLICATION OF CAAT
Following steps are required to be undertaken by the auditor in effective application of CAAT:
- Set the objective of CAAT application;
- Determine the content and accessibility of the entity’s files;
- Determine the scope: identify the specific files or databases to be examined;
- Understand the relationship between the data tables where a database is to be examined;
- Define the specific tests or procedures and related transactions and balances affected;
- Define the output requirements;
- Arrange files & databases: arrange with the user and IT departments, if appropriate, for copies of the relevant files or database tables to be made at the appropriate cut-off date and time;
- Audit team: identify the personnel who may participate in the design and application of CAAT;
- Cost effectiveness: refine the estimates of costs and benefits;
- Follow-up: ensure that the use of CAAT is properly controlled;
- Arrange the administrative activities, including the necessary skills and computer facilities;
- Reconcile data to be used for CAAT with the accounting and other records;
- Execute CAAT application;
- Evaluate the results;
- Document CAATs to be used including objectives, high level flowcharts and run instructions; and
- Assess the effect of changes to the programs/system on the use of CAAT.
TESTING CAAT
Before applying or completely relying CAAT, the auditor must first obtain reasonable assurance of the integrity, reliability, usefulness, and security of CAAT through appropriate planning, design, testing, processing and review of documentation. There are many testing methods; some of them are listed below:
- Test Data: The auditor enters the test data into the entity’s computer system and compares the result with predetermined results.
- Test Packs: It involves testing a set of data, chosen by the auditor from the entity’s system and testing it separately from the normal processing procedure.
- Integrated Test Facility: In this approach, auditor establishes a dummy unit, into which test transactions are posted during the normal processing cycle of the entity. However, these dummy entries are eliminated later on.
MEASURES TO EXERCISE CONTROL OVER CAAT APPLICATIONS
Since, most of the audit procedures performed using CAAT are highly automated and machine driven. Moreover, many-a-times, a situation may occur, where the auditor also requires the cooperation of client entity’s IT staff for extensive knowledge of computer installation. In such circumstances, the chances of inappropriately influencing the CAAT results by the client’s staff. Thus, while applying CAAT in audit procedure, due care and control must be exercised. Following points are important to consider:
- The kind of audit procedure that needs to be performed by CAAT;
- Review the entity’s general controls that may affect the integrity of CAAT, for example, controls over program changes and access to computer files. When such controls cannot be relied on to ensure the integrity of CAAT, the auditor may consider processing CAAT application at another suitable computer facility; and
- Ensure appropriate integration of the output by the auditor into the audit process, and later on in drawing audit conclusions and reporting.
The success or failure of auditing with CAAT highly depends upon the degree of control exercised on the overall application of CAAT. The control over the CAAT applications can be:
I. Control Over Software Application:
- Participation in design and testing of CAAT: The success of CAAT significantly depends upon the participation of the principal auditor in the designing and testing of CAAT.
- Checking the coding: Wherever applicable, detailed checking the coding of the program to ensure that it is in-line with the program specification.
- Compatibility with client’s system: Asking the client entity’s IT staff to check the compatibility of the audit software with the operating system used in the client’s information system.
- Testing the software: Before running the audit software on the main system’s data files, the software must be run on small test files in a different system.
- Testing the test results: The results of the above test.
- Addressing the security issues: The must establish appropriate security measures to safeguard the integrity and confidentiality of client’s data.
- Regular follow-up: Sufficient evidence must be obtained so as to ensure that the audit software is functioning, as planned. And also ensure that there is proper vendor support.
II. Control Over Test Data:
- Controlling the sequence in which the test data needs to be sent.
- Initially, performing the test runs with small chunks of test data, before submitting the main audit test data.
- Predicting the results of the test data and comparing it with the actual test data output.
- Confirming that the current version of the programs was used to process the test data.
- Ensure that the client entity used the same version of software throughout the audit period, on which the audit is being conducted.
- Make sure that dummy entries are deleted, which were fed in the system, while performing the audit.
- The auditor should one thing in mind while performing the audit that, “CAAT is one of the ‘solutions’ for Audit and no the ‘substitute’ to Audit.”
CAclubindia
