SlideShare a Scribd company logo
Download the full version and explore a variety of test banks
or solution manuals at https://testbankdeal.com
Accounting Information Systems Controls Processes
3rd Edition Turner Solutions Manual
_____ Tap the link below to start your download _____
https://testbankdeal.com/product/accounting-information-
systems-controls-processes-3rd-edition-turner-solutions-
manual/
Find test banks or solution manuals at testbankdeal.com today!
We believe these products will be a great fit for you. Click
the link to download now, or visit testbankdeal.com
to discover even more!
Accounting Information Systems Controls Processes 3rd
Edition Turner Test Bank
https://testbankdeal.com/product/accounting-information-systems-
controls-processes-3rd-edition-turner-test-bank/
Accounting Information Systems The Processes Controls 2nd
Edition Turner Solutions Manual
https://testbankdeal.com/product/accounting-information-systems-the-
processes-controls-2nd-edition-turner-solutions-manual/
Accounting Information Systems The Processes and Controls
2nd Edition Turner Test Bank
https://testbankdeal.com/product/accounting-information-systems-the-
processes-and-controls-2nd-edition-turner-test-bank/
Fundamentals of Corporate Finance 9th Edition Brealey Test
Bank
https://testbankdeal.com/product/fundamentals-of-corporate-
finance-9th-edition-brealey-test-bank/
International Trade 3rd Edition Feenstra Solutions Manual
https://testbankdeal.com/product/international-trade-3rd-edition-
feenstra-solutions-manual/
Management 12th Edition Robbins Solutions Manual
https://testbankdeal.com/product/management-12th-edition-robbins-
solutions-manual/
Foundations of Strategy 2nd Edition Grant Solutions Manual
https://testbankdeal.com/product/foundations-of-strategy-2nd-edition-
grant-solutions-manual/
New Perspectives on Computer Concepts 2014 Comprehensive
17th Edition Parsons Test Bank
https://testbankdeal.com/product/new-perspectives-on-computer-
concepts-2014-comprehensive-17th-edition-parsons-test-bank/
Economic Analysis of Social Issues 1st Edition Alan Grant
Test Bank
https://testbankdeal.com/product/economic-analysis-of-social-
issues-1st-edition-alan-grant-test-bank/
Intermediate Algebra 8th Edition Tobey Test Bank
https://testbankdeal.com/product/intermediate-algebra-8th-edition-
tobey-test-bank/
Chapter 7- Auditing Information
Technology-Based Processes
Instructor’s Manual
2 | P a g e
CHATPER 7: AUDITING INFORMATION TECHNOLOGY-BASED PROCESS
LEARNING OBJECTIVES:..........................................................................................................................................3
REAL WORLD: AURAFIN BRAND .............................................................................................................................3
INTRODUCTION TO AUDITING IT PROCESSES (STUDY OBJECTIVE 1) ........................................................4
TYPES OF AUDITS AND AUDITORS (STUDY OBJECTIVE 2) .......................................................................4
INFORMATION RISK AND IT-ENHANCED INTERNAL CONTROL(STUDY OBJECTIVE 3) ..........................6
AUTHORITATIVE LITERATURE USED IN AUDITING (STUDY OBJECTIVE 4) ...............................................6
MANAGEMENT ASSERTIONS AND AUDIT OBJECTIVES(STUDY OBJECTIVE 5)..............................................8
PHASES OF AN IT AUDIT (STUDY OBJECTIVE 6)...................................................................................................9
USE OF COMPUTERS IN AUDITS (STUDY OBJECTIVE 7) .........................................................................11
TESTS OF CONTROLS (STUDY OBJECTIVE 8) ..............................................................................................11
GENERAL CONTROLS ........................................................................................................................................11
APPLICATION CONTROLS..................................................................................................................................13
TESTS OF TRANSACTIONS AND TESTS OF BALANCES (STUDY OBJECTIVE 9) ...................................14
AUDIT COMPLETION/REPORTING (STUDY OBJECTIVE 10)..........................................................................15
OTHER AUDIT CONSIDERATIONS (STUDY OBJECTIVE 11 ) ......................................................................15
DIFFERENT ITENVIRONMENTS..........................................................................................................................15
CHANGES IN A CLIENT’S IT ENVIRONMENT ..................................................................................................17
SAMPLING VERSUS POPULATION TESTING......................................................................................................17
ETHICAL ISSUES RELATED TO AUDITING (STUDY OBJECTIVE 12) ..........................................................18
CHAPTER SUMMARY ............................................................................................................................................19
3 | P a g e
CHAPTER 7: AUDITING INFORMATION TECHNOLOGY-BASED PROCESS
LEARNING OBJECTIVES:
1. An introduction to auditing IT processes
2. The various types of audits and auditors
3. Information risk and IT-enhanced internal control
4. Authoritative literature used in auditing
5. Management assertions used in the auditing process and the related audit objectives
6. The phases of an IT audit
7. The use of computers in audits
8. Tests of controls
9. Tests of transactions and tests of balances
10. Audit completion/reporting
11. Other audit considerations
12. Ethical issues related to auditing
REAL WORLD: AURAFIN BRAND
• The Aurafin brand is renowned in the jewelry industry as the fashion leader in fine gold.
• Owned by Richline Group, Inc., a subsidiary of Berkshire Hathaway, Inc., the brand is sold by retail
giants like JCPenney, Macy’s, and many online outlets.
• Aurafin has overcome significant challenges in maintaining its customer relationships. Several years
ago, Aurafin began experiencing such severe problems with transaction fulfillment and delivery that
its customers were taking notice.
• JCPenney had implemented a supplier scorecard system, a type of vendor audit whereby companies,
which do business with JCPenney were evaluated on the basis of the quality of service provided. This
system brought to light some significant violations in Aurafin’s business processes, including
weaknesses in controls and inadequate computer systems.
Aurafin took quick action, undergoing a thorough IT audit which identified the specific causes of its process
failures. Aurafin acted swiftly upon the recommendations made by its auditors and implemented a more
reliable technology platform that empowered it to apply a variety of new audit and control techniques and to
get its systems in sync with its business goals. Aurafin credits the audit processes to its newfound success,
including its subsequent recognition as JCPenney’s “Vendor of the Year.” This chapter focuses on various
aspects of an IT audit, as well as the accountant’s techniques for evaluating information-technology processes,
and their importance in business processes.
4 | P a g e
INTRODUCTION TO AUDITING IT PROCESSES (STUDY OBJECTIVE 1)
Nearly all business organizations rely on computerized systems to assist in the accounting function.
Technological advances have transformed the business world by providing new ways for companies to do
business and maintain records. This boom in technological developments has increased the amount of
information that is readily available. Business managers, investors, creditors, and government agencies often
have a tremendous amount of data to use when making important business decisions. However, it is often a
challenge to verify the accuracy and completeness of the information.
Accountants have an important role in the business world because they are called upon to improve the quality
of information provided to decision makers. Accounting services that improve the quality of information are
called assurance services. Many types of services performed by accountants are considered assurance
services because they lend credibility to the underlying financial information. An audit is the most common
type of assurance service
TYPES OF AUDITS AND AUDITORS (STUDY OBJECTIVE 2)
The main purpose of the audit is to assure users of financial information about the accuracy and completeness
of the information. To carry out an audit, accountants collect and evaluate proof of procedures, transactions,
and/or account balances and compare the information with established criteria. The three primary types of
audits include:
• compliance audits,
• operational audits, and
• financial statement audits
Compliance audits determine whether the company has complied with regulations and policies established by
contractual agreements, governmental agencies, company management, or other high authority.
Operational audits assess operating policies and procedures for efficiency and effectiveness
Financial statement audits determine whether the company has prepared and presented its financial
statements fairly, and in accordance with established financial accounting criteria.
• financial statement audits are performed by certified public accountants who have extensive
knowledge of generally accepted accounting principles (GAAP) in the United States and/or
International Financial Reporting Standards (IFRS)
5 | P a g e
There are different types of audit specialization that exist in business practice today, including:
• An internal auditor is an employee of the company that he or she audits. Most large companies have
a staff of internal auditors who perform compliance, operational, and financial audit functions at the
request of management. Some internal auditors achieve special certification as certified internal
auditors (CIAs).
• IT auditors specialize in information systems assurance, control, and security, and they may work for
CPA firms, government agencies, or with the internal audit group for any type of business
organization. Some IT auditors achieve special certification as certified information systems auditors
(CISAs).
• Government auditors conduct audits of government agencies or income tax returns.
• CPA firms represent the interests of the public by performing independent audits of many types of
business organizations.
Only CPA firms can conduct financial statement audits of companies whose stock is sold in public markets
such as the New York Stock Exchange. An important requirement for CPA firms is that they must be neutral
with regard to the company being audited. The neutrality requirement allows CPA firms to provide an
unbiased opinion on the information it audits, and it is the foundation of an external audit performed by CPAs.
An external audit is performed by independent auditors who are objective and neutral with respect to the
company and information being audited. To keep their neutrality, CPA firms and their individual CPAs are
generally prohibited from having financial and managerial connections with client companies and from having
personal ties to those working for client companies. A CPA’s objectivity could be impaired by having these
types of relationships with a client company or with anyone having the ability to influence the client’s
decisions and financial reporting activities.
• Performing financial statement audits is a main service of CPA firms.
• Because many audited companies use sophisticated IT systems to prepare financial statements, it is
important for auditors to enhance the quality of their services in auditing those systems.
• IT auditing is a part of the financial statement audit that evaluates a company’s computerized
accounting information systems.
• An auditor must gain a sufficient understanding of the characteristics of a company’s IT system.
• Use of computers may significantly change the way a company processes and communicates
information, and it may affect the underlying internal controls. Therefore, the IT environment plays a
key role in how auditors conduct their work in the following areas:
o Consideration of risk
o Audit procedures used to obtain knowledge of the accounting and internal control systems
o Design and performance of audit tests
6 | P a g e
INFORMATION RISK AND IT-ENHANCED INTERNAL CONTROL
(STUDY OBJECTIVE 3)
Information risk is the chance that information used by decision makers may be inaccurate. Following are
some causes of information risk:
• the remoteness of information
• the volume and complexity of the underlying data
• the motive of the preparer
The most common way for decision makers to reduce information risk is to rely upon information that has
been audited by an independent party. Various risks are created by the existence of IT-based business
processes. For example, because the details of transactions are often entered directly into the computer
system, there may be no paper documentation maintained to support the transactions. This is often referred
to as the loss of audit trail visibility because there is a lack of physical evidence to visibly view.
Advantages of using IT-based systems:
• Internal controls can actually be enhanced if care is exercised in implementing these systems
• Computer controls can compensate for the lack of manual controls
• If programs are tested properly the risk of human error is virtually eliminated
• Provide higher quality information to management
AUTHORITATIVE LITERATURE USED IN AUDITING
(STUDY OBJECTIVE 4)
Generally accepted auditing standards (GAAS) are broad guidelines for an auditor’s professional
responsibilities. These ten standards are divided into three categories that include general qualifications and
conduct of an auditor (general standards), guidelines for performing the audit (standards of fieldwork), and
requirements for the written report communicating the results of the audit (standards of reporting).
7 | P a g e
General Standards StandardsofFieldwork Standards ofReporting
1. The audit is to be performed by
a person or persons having
adequate technicaltraining
and proficiency as anauditor.
2. Independence in mental attitude
is to be maintained in all matters
related to the audit engagement.
3. Due professional care is to be
exercised in all phases of the
audit process.
1. The audit is to be adequately planned
and supervised.
2. An understanding of internalcontrol
is to be obtained as part of the
planning process for the purpose of
determining the nature, timing, and
extent of tests to beperformed.
3. Evidence is to be obtained through
inspection, inquiries, observation, and
confirmations in order to provide a
reasonable basis for forming an
overall opinion on the audit.
1. The written report must state whether
the financial statements are presented in
accordance with the establishedcriteria.
2. The written report identifies any
circumstances in which established
principles have not been consistently
applied in the current period in relation
to the priorperiod.
3. The financial statements are assumed
to contain adequate informative disclo-
sures unless otherwise indicated in the
written report.
4. The written report expresses an opinion
on the fairness of the financial
statements as a whole, or an assertion
to the effect that an opinion cannot be
expressed (and the reasons therefor).
The report also describes the character
of the auditor’s work and the degree of
responsibilityassumedbytheauditor.
8 | P a g e
The Public Company Accounting Oversight Board (PCAOB) was organized in 2003 for the purpose of establishing
auditing standards for public companies in the United States
• The PCAOB was established by the Sarbanes–Oxley Act, which was created in response to several major
corporate accounting scandals, including those affecting Enron, WorldCom, and others
• Prior to the PCAOB, standard-setting was the responsibility of the Auditing Standards Board (ASB) of the
American Institute of CPAs (AICPA)
• The International Auditing and Assurance Standards Board (IAASB) was established by the International
Federation of Accountants (IFAC) to set International Standards on Auditing (ISAs) that contribute to the uniform
application of auditing practices on a worldwide basis.
ISAs are similar to SASs; however, ISAs tend to extend SASs because of their usefulness in audits of multinational
companies. Although auditors have a primary responsibility to comply with standards issued within their own countries,
ISAs are useful in expanding those requirements in order to meet different needs in other countries where the audited
information may also be used. The Institute of Internal Auditors (IIA) established the Internal Auditing Standards Board
(IASB) to issue standards that pertain to attributes of internal audit activities, performance criteria, and implementation
guidance. The Information Systems Audit and Control Association (ISACA) issues Information Systems Auditing
Standards (ISASs) that provide guidelines for conducting the IT audit. These standards address audit issues unique to a
company’s information systems environment, including control and security issues.
MANAGEMENT ASSERTIONS AND AUDIT OBJECTIVES (STUDY OBJECTIVE 5)
Management assertions are claims regarding the condition of the business organization in terms of its operations,
financial results, and compliance with laws and regulations.
The role of the auditors is to analyze the underlying facts to decide whether information provided by management is
fairly presented. Auditors design audit tests to analyze information in order to determine whether management’s
assertions are valid. To accomplish this, audit tests are created to address general audit objectives. Each audit objective
relates to one of management’s assertions.
The following diagram illustrates management assertions and the corresponding audit objective:
9 | P a g e
Auditors must think about how the features of a company’s IT systems influence management’s assertions and the
general audit objectives. These matters have a big impact on the choice of audit methodologies used.
PHASES OF AN IT AUDIT (STUDY OBJECTIVE 6)
There are four primary phases of the audit:
• planning,
• tests of controls,
• substantive tests, and
• audit completion/reporting
Through each phase of an audit, evidence is accumulated as a basis for supporting the conclusions reached by the
auditors. Audit evidence is proof of the fairness of financial information. The techniques used for gathering evidence
include the following:
• Physically examining or inspecting assets or supporting documentation
• Obtaining written confirmation from an independent source
• Reperforming tasks or recalculating information
• Observing the underlying activities
• Making inquiries of company personnel
• Analyzing financial relationships and making comparisons to determine reasonableness
10 | P a g e
During the planning phase of an audit, the auditor must gain a thorough under- standing of the company’s business and
financial reporting systems. In doing so, auditors review and assess the risks and controls related to the business,
establish materiality guidelines, and develop relevant tests addressing the assertions and objectives
• tasks of assessing materiality and audit risk are very subjective and are therefore typically performed by
experienced auditors
• Determining materiality, auditors estimate the monetary amounts that are large enough to make a difference in
decision making
• Materiality estimates are then assigned to account balances so that auditors can decide how much evidence is
needed
• Below materiality limits are often considered insignificant
• Some accounts with immaterial balances may still be audited, though, especially if they are considered areas of
high risk
• Risk- refers to the likelihood that errors or fraud may occur
• Risk can be inherit or it may be caused by weak internal controls
A big part of the audit planning process is the gathering of evidence about the company’s internal controls
• Auditors typically gain an understanding of internal controls by interviewing key members of management and
the IT staff
• They observe policies and procedures and review IT user manuals and system flowcharts
• They often prepare narratives or memos to summarize the results of their findings
• Company personnel generally complete a questionnaire about the company’s accounting systems, including its
IT implementation and operations, the types of hardware and software used, and control of computer resources
• The understanding of internal controls provides the basis for designing appropriate audit tests to be used in the
remaining phases of the audit
In recognition of the fact that accounting records and files often exist in both paper and electronic form, auditing
standards address the importance of understanding both the automated and manual procedures that make up an
organization’s internal controls. In addition, many large and medium-size businesses are capturing an abundance of
data. The availability of Big Data sets in auditing may complicate an auditor’s judgment. Yet auditors must always
consider how misstatements may occur, including the following:
• How data is captured and used
• How standard journal entries are initiated, recorded, and processed
• How nonstandard journal entries and adjusting entries are initiated, recorded, and processed
IT auditors may be called upon to consider the effects of computer processing on the audit or to assist in testing those
automated procedures.
11 | P a g e
USE OF COMPUTERS IN AUDITS (STUDY OBJECTIVE 7)
If the use of IT systems does not have a great impact on the conduct of the audit, since the auditor can perform audit
testing in the same manner as would be done for a manual system the practice is referred to as auditing around the
computer because it does not require evaluation of computer controls.
• Auditing around the computer merely uses and tests output of the computer system in the same manner as the
audit would be conducted if the information had been generated manually
• Because this approach does not consider the effectiveness of computer controls, auditing around the computer
has limited usefulness.
Auditing through the computer involves directly testing the internal controls within the IT system, whereas auditing
around the computer does not
• sometimes referred to as “the white box approach,” because it requires auditors to understand the computer
system logic
• This approach requires auditors to evaluate IT controls and processing so that they can determine whether the
information generated from the system is reliable
• Auditing through the computer is necessary under the following conditions:
o The auditor wants to test computer controls as a basis for evaluating risk and reducing the amount of
substantive audit testing required.
o The author is required to report on internal controls in connection with a financial statement audit of a
public company.
o Supporting documents are available only in electronic form.
Auditors can use their own computer systems and audit software to help conduct the audit. This approach is known as
auditing with the computer.
• A variety of computer-assisted audit techniques (CAATs) are available for auditing with the computer
• CAATs are useful audit tools because they make it possible for auditors to use computers to test more evidence
in less time.
TESTS OF CONTROLS (STUDY OBJECTIVE 8)
The tests of controls involve audit procedures designed to evaluate both general controls and application controls.
During audit planning, auditors must learn about the types of controls that exist within their client’s IT environment.
Then they may test those controls to determine whether they are reliable as a means of reducing risk. Tests of controls
are sometimes referred to as “compliance tests,” because they are designed to determine whether the controls are
functioning in compliance with management’s intentions.
GENERAL CONTROLS
General controls MUST be tested before application controls. General controls are the automated controls that affect all
computer applications. The reliability of application controls is considered only after general controls are deemed
reliable.
12 | P a g e
The effectiveness of general controls is the foundation for the IT control environment. If general controls are not
functioning as designed, auditors will not devote attention to the testing of application controls; rather, they will
reevaluate the audit approach with reduced reliance on controls.
There are two broad categories of general controls that relate to IT systems:
• IT administration and the related operating systems development and maintenance processes
• Security controls and related access issues
IT Administration
Related audit tests include review for the existence and communication of company policies regarding the following
important aspects of administrative control:
• Personal accountability and segregation of incompatible responsibilities
• Job descriptions and clear lines of authority
• Computer security and virus protection
• IT systems documentation
Security Controls
Auditors are concerned about whether a company’s computer system has controls in place to prevent unauthorized
access to or destruction of information within the accounting information systems. Unauthorized access may occur
internally when employees retrieve information that they should not have, or externally when unauthorized users (or
hackers) outside the company retrieve information that they should not have. Access risks tend to escalate as companies
embrace newer technologies and allow sensitive data to be shared via smart devices, Web and mobile applications, and
social networks. Destruction of information may occur as a result of natural disasters, accidents, and other environ-
mental conditions. Controls that protect the company from these risks include:
• various access controls,
• physical controls,
• environmental controls, and
• business continuity policies
In order to test internal access controls, auditors should determine that the company has properly segregated IT duties
or compensated for a lack of segregation by improving supervisory reviews. The company’s authority table should be
tested to find out whether access to programs and data files is limited to authorized employees. Auditors should
perform authenticity tests for valid use of the company’s computer system, according to the authority tables.
In order to test external access controls, auditors may perform the following procedures:
• Authenticity tests
• Penetration tests
13 | P a g e
• Vulnerability assessments
• Review access logs to identify unauthorized users or failed access attempts
Physical controls include:
• locks,
• security guards,
• alarms,
• cameras, and
• card keys.
Physical controls not only limit access to the company’s computers, but also are important for preventing damage to
computer resources. In addition to assessing physical controls, auditors should evaluate the IT environment to
determine that proper temperature control is maintained, fireproofing systems are installed, and an emergency power
supply is in place.
APPLICATION CONTROLS
Application controls are computerized controls over application programs. Since any company may use many different
computer programs in its day-to- day business, there may be many different types of application controls to con- sider in
an audit.
Input Controls
Auditors perform tests to verify the correctness of information input to soft- ware programs. Auditors are concerned
about whether errors are being pre- vented and detected during the input stage of data processing. Auditors observe
controls that the company has in place and perform the comparisons on a limited basis to determine their effectiveness.
These tests can be performed manually or by electronic methods.
Processing Controls
IT audit procedures typically include a combination of data accuracy tests, whereby the data processed by computer
applications are reviewed for correct dollar amounts or other numerical values. For example, limit tests, described
previously as an input control, can also be an effective processing control. Run-to-run totals involve the recalculation of
amounts from one process to the next to determine whether data have been lost or altered during the process.
Balancing tests involve a comparison of different items that are expected to have the same values, such as comparing
two batches or comparing actual data against a predetermined control total. Mathematical accuracy tests verify
whether system calculations are correct. Completeness tests and redundancy tests, introduced earlier, check for
inclusion of the correct data.
Benford’s Law, also known as the first-digit law, was named for a physicist, Frank Benford, who discovered a specific,
but nonuniform pattern in the frequency of digits occur- ring as the first number in a list of numbers
14 | P a g e
The test data method is an audit and control technique often used to test the processing accuracy of software
applications. Test data are fictitious information developed by auditors and entered in the company’s application
system. Test data are processed under the company’s normal operating conditions. The results of the test are compared
with predicted results to deter- mine whether the application is functioning properly
A slight variation of the test data method involves the auditor testing fictitious data, using a copy of the company’s
application. The test data may be processed through the application on a different (nonclient) computer. Under these
conditions, an auditor can also use another test data method, program tracing, whereby bits of actual data are followed
through the application in order to verify the accuracy of its processing. Program mapping, on the other hand, counts
the number of times each program statement is executed, so it can identify whether program code has been bypassed.
An integrated test facility (ITF) may be used to test application controls without disrupting the client’s operations.
Parallel simulation- is an audit technique that processes company data through a controlled program designed to
resemble the company’s application
Embedded audit module- involves placing special audit testing programs within the company’s operating system
Output Controls
Regardless of whether the results are printed or retained electronically, auditors may perform the following procedures
to test application outputs:
• Reasonableness tests compare the reports and other results with test data or other criteria.
• Audit trail tests trace transactions through the application to ensure that the reporting is a correct reflection of
the processing and inputs.
• Rounding errors tests determine whether significant errors exist due to the way amounts are rounded and
summarized.
Reconciliation- a detailed report assessing the correctness of an account balance or transaction record that is consistent
with supporting documentation and the company’s policies and procedures.
At the conclusion of the controls testing phase of the audit, an auditor must determine the overall reliability of the
client’s internal controls. Auditors strive to rely on internal controls as a way to reduce the amount of evidence needed
in the remaining phases of the audit. They can be reasonably sure that information is accurate when it comes from a
system that is proven to have strong controls. Therefore, once the general and application controls are tested and found
to be effective, the amount of additional evidence needed in the next phase of the audit can be minimized
TESTS OF TRANSACTIONS AND TESTS OF BALANCES (STUDY OBJECTIVE 9)
Audit tests of the accuracy of monetary amounts of transactions and account balances are known as substantive testing
• Substantive tests verify whether information is correct, whereas control tests determine whether the
information is managed under a system that promotes correctness
• Some level of substantive testing is required regardless of the results of control testing.
15 | P a g e
• If weak internal controls exist or if important controls are missing, extensive substantive testing will be required.
• If controls are found to be effective, the amount of substantive testing required is significantly lower, because
there is less chance of error in the underlying records
Most auditors use generalized audit software (GAS) or data analysis soft- ware (DAS) to perform audit tests on
electronic data files taken from commonly used database systems. These computerized auditing tools make it possible
for auditors to be much more efficient in performing routine audit tests such as the following:
• Mathematical and statistical calculations
• Data queries
• Identification of missing items in a sequence
• Stratification and comparison of data items
• Selection of items of interest from the data files
• Summarization of testing results into a useful format for decision making
GAS and DAS are evolving to handle larger and more diverse data sets, which allow auditors to use more types of
unstructured data evidence and to perform more creative analytical procedures and predictive analyses.
AUDIT COMPLETION/REPORTING (STUDY OBJECTIVE 10)
After the tests of controls and substantive audit tests have been completed, auditors evaluate all the evidence that has
been accumulated and draw conclusions based on this evidence. This phase is the audit completion/reporting phase.
The completion phase includes many tasks that are needed to wrap up the audit. For many types of audits, the most
important task is obtaining a letter of representations from company management. The letter of representations is
often considered the most significant single piece of audit evidence, because it is a signed acknowledgment of
management’s responsibility for the reported information. In this letter, management must declare that it has provided
complete and accurate information to its auditors during all phases of the audit.
Four types of reports that are issued:
1. Unqualified opinion, which states that the auditors believe the financial statements are fairly and consistently
presented in accordance with GAAP or IFRS
2. Qualified opinion, which identifies certain exceptions to an unqualified opinion
3. Adverse opinion, which notes that there are material misstatements presented
4. Disclaimer of opinion, which states that the auditors are unable to reach a conclusion.
OTHER AUDIT CONSIDERATIONS (STUDY OBJECTIVE 11 )
DIFFERENT ITENVIRONMENTS
Most companies use microcomputers or personal computers (PCs) in their accounting processes. General controls
covering PCs are often less advanced than those covering the mainframe and client–server systems. Following are some
audit techniques used to test controls specifically in the use of PCs:
16 | P a g e
• Make sure that PCs and removable hard drives are locked in place to ensure physical security. In addition,
programs and data files should be pass- word protected to prevent online misuse by unauthorized persons.
• Make sure that computer programmers do not have access to systems operations, so that there is no
opportunity to alter source code and the related operational data. Software programs loaded on PCs should not
permit the users to make program changes. Also ascertain that computer-generated reports are regularly
reviewed by management.
• Compare dates and data included on backup files with live operating pro- grams in order to determine the
frequency of backup procedures.
• Verify the use of antivirus software and the frequency of virus scans
In addition to, or as an alternative to using PCs, companies’ IT environments may involve networks, database
management systems, e-commerce systems, cloud computing, and/or other forms of IT outsourcing. All of the risks and
audit procedures that apply to a PC environment may also exist in networks, but the potential for loss is much greater.
Since network operations typically involve a large number of computers, many users, and a high volume of data
transfers, any lack of network controls could cause widespread damage. Auditors must apply tests over the entire
network. It is especially important to test the software that manages the network and controls access to the servers.
Security risks always exist in companies that use e-commerce, because their computer systems are linked online with
the systems of their business partners.
As a result, the reliability of a company’s IT system depends upon the reliability of its customers’ and/or suppliers’
systems. The audit procedures used to assess controls in e-commerce environments were addressed earlier in this
chapter in the discussion on external access controls. In addition, auditors often
• Inspect message logs to identify the points of remote access, verify proper sequencing of transactions, and
review for timely follow up on unsuccessful transmissions between business partners
• Verify that the company has evaluated the computer systems of its business partners prior to doing business
over the Internet
• Reprocess transactions to see whether they are controlled properly
Some companies may rely on external, independent computer service providers to handle all or part of their IT needs.
This is known as IT outsourcing. IT outsourcing creates a challenge for auditors, who must gain an adequate under-
standing of risks and controls that are located at an independent service center.
It is important for a company and its auditors to carefully consider whether all relevant risks have been identified and
controlled. Below are some sample questions for auditors to consider when evaluating a cloud computing environment:
Security Risks:
• What damage could result if an unauthorized user accessed the company’s data?
• How and when are data encrypted?
• How does the cloud service provider handle internal security?
17 | P a g e
Availability Risks:
• What damage could result if the company’s data were unavailable during peak times or for an extended period?
• How does the cloud service provider segregate information between clients?
• What disaster recovery and business continuity plans are in place?
Processing Risks:
• How are response times and other aspects of operating performance monitored?
• How does the service provider monitor its capacity for data storage and usage?
• Is the service provider’s system flexible enough to accommodate the company’s anticipated growth?
Compliance Risks:
• What compliance standards does the cloud service provider meet?
• What third-party assurance documentation is in place?
• What additional documentation is available to help the company maintain compliance with applicable laws and
regulations?
CHANGES IN A CLIENT’S IT ENVIRONMENT
When a company changes the type of hardware or software used or otherwise modifies its IT environment, its auditors
must consider whether additional audit testing is needed. During its period of change, data may be taken from different
systems at different times. As a result, auditors should consider applying tests of controls at multiple times throughout
the period in order to determine the effectiveness of controls under each of the systems. Specific audit tests include
verification of the following items:
• An assessment of user needs
• Proper authorization for new projects and program changes
• An adequate feasibility study and cost–benefit analysis
• Proper design documentation, including revisions for changes made via updates, replacements, or maintenance
• Proper user instructions, including revisions for changes made via updated versions, replacements, or
maintenance
• Adequate testing before the system is put into use
SAMPLING VERSUS POPULATION TESTING
Auditors often rely on sampling, whereby they choose and test a limited number of items or transactions and then draw
conclusions about the information as a whole on the basis of the results. Since many audit tests do not cover all items in
the population, there is some risk that a sample, or subset, of the population may not represent the balance as a whole.
Auditors try to use sampling so that a fair representation of the population is evaluated.
As businesses evolve, they are more likely to possess Big Data sets, and auditors may transition from using sampling
strategies toward population testing, where continuous auditing techniques are used to evaluate 100% of the
population, often in real time.
18 | P a g e
ETHICAL ISSUES RELATED TO AUDITING (STUDY OBJECTIVE 12)
All types of auditors must follow guidelines promoting ethical conduct. For financial statement auditors, the
PCAOB/AICPA has established a Code of Professional Conduct, commonly called its code of ethics. This code of ethics is
made up of two sections, the principles and the rules.
Six Principles of the code:
1. Responsibilities
2. The Public Interest
3. Integrity
4. Objectivity and Independence
5. Due Care
6. Scope and Nature of Services
The Sarbanes–Oxley Act:
• placed restrictions on auditors by prohibiting certain types of services historically performed by auditors for
their clients
• increased management’s responsibilities regarding the fair presentation of the financial statements
• requires public companies to have an audit committee as a subcommittee of the board of directors
• requires top management to verify in writing that the financial statements are fairly stated and that the
company has adequate internal controls over financial reporting
In fulfilling their ethical responsibilities, auditors must practice professional skepticism during the audit. Professional
skepticism means that the auditors should not automatically assume that their clients are honest, but must have a
questioning mind and a persistent approach to evaluating evidence for possible misstatements.
It is important for auditors to consider the conditions under which fraud could be committed, including the possible
pressures, opportunities, and rationalization for committing dishonest acts. In the context of a client’s IT systems, audi-
tors should also think about the possibility that computer programs could be altered to report information in a manner
that is favorable for the company.
Accountants are sometimes called upon to perform a specialized type of assurance service called forensic auditing.
Forensic auditing is designed specifically for finding and preventing fraud and is used for companies where fraud is
known or believed to exist. Some accountants who work on forensic audits become certified fraud examiners (CFEs) and
are considered experts in the detection of fraud. Some CFEs specialize in computer forensics, which involves the
detection of abuses within computer systems. IT auditors may play an instrumental role in gathering and analyzing data
needed to perform or assist in a forensic audit.
19 | P a g e
CHAPTER SUMMARY
➢ Introduction to Auditing IT Processes. Most businesses rely upon computerized systems to assist in the accounting
function. Advancements in technology have brought huge increases in the amount of information that is readily
available for decision-makers. Accountants play an important role in the business world because they are called
upon to improve the quality of information. Accountants provide assurance services, which help to verify the
accuracy and completeness of financial information, thereby improving the quality and lending credibility to this
information. An audit is the most common type of assurance service.
➢ Types of Audits and Auditors. The main purpose of an audit is to assure users of financial information about the
accuracy and completeness of the information by evaluating evidence supporting the underlying procedures,
transactions, and/or account balances. This evidence is compared to established criteria. There are three primary
types of audits, including (1) compliance audits, (2) operational audits, and (3) financial statement audits. Although
each type of audit involves an investigation of supporting evidence, each type has a different objective.
○ Compliance audits determine whether the client has complied with regulations and policies established by
contractual agreements, governmental agencies, company management, or other high authority.
○ Operational audits assess operating policies and procedures for efficiency and effectiveness.
○ Financial statement audits determine whether the company has prepared and presented its financial statements
fairly, and in accordance with generally-accepted accounting principles (GAAP) or some other financial
accounting criteria.
Internal auditors, IT auditors, and governmental auditors typically conduct compliance audits and operational audits.
Certified public accountants (CPAs) may conduct any type of audit, but CPA firms tend to concentrate on financial
statement audits and other financial assurance services. It is important that CPAs be independent, or objective and
neutral, with respect to their audit clients and the financial information being audited. Because many companies
use sophisticated IT accounting systems to support their financial statements, it is increasingly important for
auditors to understand the impact of information technology on their clients’ accounting systems and internal
controls. The IT environment plays a key role in how auditors conduct their work related to the consideration of risk
in the audit, understanding the underlying systems, and the related design and performance of audit tests.
➢ Information Risk and IT-Enhanced Internal Control. Information risk is the chance that information used by
decision-makers may be inaccurate. Information risk may be caused by:
• The remoteness of information, or the extent to which the source of the information is removed from the
decision-maker.
• The volume and complexity of the underlying data.
• The motive, goals, or viewpoint of the preparer of the information.
The most common way to reduce information risk is to rely upon information that has been audited by an
independent party. This is why a chapter on information-based processing and the related audit function is included
in the study of accounting information systems.
IT-based processes generally provide high quality information to management, which aids in effective decision-
making. Information is high quality when it is provided in a timely manner and administered effectively. IT systems
are also advantageous because they often include computerized controls to enhance the company’s internal
controls, and they eliminate the risk of human errors such as mathematical or classification mistakes. On the other
20 | P a g e
hand, IT systems present various risks, including loss of audit trail visibility, lost/destroyed data, system failures, and
unauthorized access.
➢ Authoritative Literature Used in Auditing. The work of an auditor must be conducted in accordance with several
sources of authoritative literature, including:
○ Generally accepted auditing standards (GAAS), which are broad guidelines for an auditor’s professional
responsibilities in the areas of general qualifications and conduct (general standards), performance of the audit
(standards of fieldwork), and written communication of results (standards of reporting). Exhibit 7-1 presents the
ten generally accepted auditing standards.
○ The Public Company Accounting Oversight Board (PCAOB) establishes auditing standards (AS) for public
companies. Prior to the PCAOB, accounting standards were established by the Auditing Standards Board (ASB) of
the American Institute of CPAs (AICPA) through the issuance of Statements on Auditing Standards (SASs). The
ASB is still serves as the standard-setting body for non-public companies.
○ The International Auditing and Assurance Standards Board (IAASB) issues international standards on auditing
(ISAs) and contributes to the uniform application of auditing practices on a worldwide basis.
○ The International Internal Auditing Standards Board (IASB) to issue standards that pertain to attributes of
internal audit activities, performance criteria, and implementation guidance.
○ The Information Systems Audit and Control Association (ISACA) issues information systems auditing standards
(ISASs) that address control and security issues and provide relevant guidelines for conducting and IT audit.
Although SASs, ISAs, and ISASs each provide detailed guidance that supports GAAS, they still do not furnish auditors
with detailed directions regarding the types of audit tests to use and the manner in which conclusions should be
drawn. Industry guidelines and other resources such as CPA firm’s own policies and procedures are needed for such
specific guidelines.
➢ Management Assertions and Audit Objectives. Management assertions are claims regarding the financial condition
of the business organization and its results of in terms of its operations, financial results, and compliance with
applicable laws and regulations. Management assertions relate to existence/occurrence, valuation and allocation,
accuracy, classification, cutoff, completeness, rights and obligations, and presentation and disclosure. These
assertions and related audit objectives are presented in Exhibit 7-2. Auditors recognize that management of the
company is primarily responsible for the preparation and presentation of the financial statements. Accordingly,
auditors analyze information supporting the financial statements in order to determine whether management’s
assertions are valid. Audit tests should be documented in an audit program and should be uniquely developed for
each audit client to address management’s assertions.
➢ Phases of an IT Audit. Exhibit 7-4 provides an overview of the four primary phases of the audit: planning, tests of
controls, substantive tests, and audit completion/reporting. Through each phase of the audit, evidence is
accumulated as a basis for supporting the conclusions reached by the auditors. Auditors use combinations of various
techniques to collect evidence, including physically examining and inspecting assets or supporting documentation,
obtaining written confirmation from an independent source, rechecking or recalculating information, observing
activities, making inquiries of client personnel, and analyzing financial relationships and trends.
o Audit Planning. Auditors must gain a thorough understanding of the company’s business and financial reporting
systems during the planning phase of the audit. In doing so, auditors review and assess the risks and controls
related to the business, establish materiality guidelines, and develop relevant tests addressing the objectives.
Risk assessment involves careful consideration of the likelihood that errors or fraud may occur. Risk may be
21 | P a g e
inherent in the business or it may be caused by weak internal controls. Accordingly, a big part of the audit
planning process involves gaining an understanding of internal controls. In determining materiality, auditors
estimate the monetary amounts that are large enough to make a difference in decision making. Materiality
estimates are then assigned to account balances so that auditors can decide how much evidence in needed in
the testing phases of the audit. If the company has adopted IFRS or is in the process of convergence, changes in
the audit approach should be anticipated.
➢ Use of Computers in Audits. The audit planning tasks of evaluating internal controls and designing meaningful audit
tests is more complex for automated accounting systems than for manual systems. In recognition of the fact that
accounting records and files often exists in both paper and electronic form, auditing standards address the
importance of understanding both the automated and manual procedures that make up an organization’s internal
control. Misstatements may occur through the data entry and processing functions of the system. Auditors must
consider the effects of such computer processing on the audit. Three options may exist for the auditor in deciding
upon a testing approach for a client’s automated process, including auditing around the computer, auditing through
the computer, and auditing with the computer.
• Auditing around the computer is commonly known as the “black box” approach because auditors are not
required to gain detailed knowledge about the company’s computer system; rather, documents used to
input data into the system can be compared with reports generated from the system. Computer controls are
not considered.
• Auditing through the computer is commonly known as the “white box” approach because it involves directly
testing the internal controls within the IT system. It requires the auditors to understand the computer
system logic and related IT controls. Auditing through the computer is necessary when the auditor wants to
test computer controls as a basis for reducing the amount of substantive testing required, when the auditor
is required to report on internal controls of a public company, and when supporting documents are available
only in electronic form.
• Auditing with the computer involves the auditors’ use of their own computer systems and audit software to
perform audit testing. A variety of computer assisted audit techniques (CAATs) are available for auditing
with the computer.
➢ Tests of Controls. After auditors have learned about the types of controls that exist within their client’s IT
environment, they may then test those controls to determine whether they are reliable as a means of reducing risk.
Test of controls are sometimes referred to as “compliance tests”, because they are designed to determine whether
the controls are functioning in compliance with management’s intentions. Both general controls and application
controls must be considered.
General Controls. The effectiveness of general controls is the foundation of the IT control environment because
general controls affect all computer applications. If general controls are not functioning as designed, auditors will
not devote attention to the testing of application controls; rather, they will reevaluate the audit approach with
reduced reliance on controls. There are two broad categories of general controls that relate to IT systems: IT
administration and the related operating systems development and maintenance processes, and security controls
and related access issues.
• IT administration. IT departments should be organized so that an effective and efficient workplace is
created and supported. The important aspects of administrative control include personal accountability and
segregation of incompatible responsibilities, job descriptions and clear lines of authority, computer security
22 | P a g e
and virus protection, and thorough documentation about the internal logic of computer systems and
surrounding controls.
• Security controls. Auditors must be concerned about whether a company’s computer system has controls
in place to prevent unauthorized access that may result in the destruction or alteration of information
within the accounting information systems. Unauthorized access may be from an internal or external source,
and can be controlled internally through the use of various access controls, including authenticity tests,
passwords and security tokens, and other techniques that were described in Chapter 4. External access
controls may include authenticity tests, penetration tests, vulnerability assessments, and monitoring of
access logs and other security reports. Physical controls such as locks, security alarms, etc. are also used to
protect and limit access to a company’s computer resources. In addition, a disaster recovery plan, backup
procedures, virus protection, and adequate insurance coverage should all be in place in order to protect the
company’s computer systems and data.
Application Controls. Since companies tend to use many different computer programs in their day-to-day
business, there may be different types of application controls to consider in an audit. However, application
controls are considered only if general controls have already been tested and found to be operating effectively.
It would not be worthwhile to test application controls if the auditor already knew that the underlying general
controls were weak.
The three main functions of computer applications include input, processing, and output. Each of these
functions should be tested by the auditor.
• Auditors are concerned about whether errors are being prevented or detected during the input of data into
a computerized system. The most widely used tests of input controls include financial totals, hash totals,
completeness or redundancy tests, limit tests, validation checks, and field checks. Companies may
implement these tests as internal control measures, and auditors may perform the same type of test to
determine their effectiveness.
• Data accuracy tests are typically performed to evaluate the processing integrity of a company’s computer
systems. Limit tests, balancing tests, run-to-run totals, mathematical accuracy tests, and completeness or
redundancy tests can each be performed to test for the possibility of lost, altered, or unprocessed data.
When evaluating financial information, auditors can often use Benford’s Law to help discover whether
errors or fraud may exist in a data set. Benford’s Law applies to large data sets of naturally-occurring
numbers, and is therefore useful to auditors in evaluating possible errors or fraud in sales and accounts
receivable balances, accounts payable and disbursements balances, income tax data, and more. Audit
procedures that apply Benford’s Law can be carried out using spreadsheet programs or special applications
of audit software. Exhibit 7-8 presents a comparison of several CAATs for testing applications controls,
including the test data method, program tracing, an integrated test facility, parallel simulation, and
embedded audit modules.
• Audit tests that evaluate general controls over access and backup procedures may also be used in the
testing of specific computer application outputs. Regardless of whether the outputs are printed or retained
electronically, auditors may perform reasonableness tests, audit trail tests, and/or rounding errors tests to
verify the accuracy of system outputs.
At the conclusion of the controls testing phase of the audit, auditors must determine the overall reliability of the
company’s internal controls. Auditors may rely on internal controls as a way to reduce the amount of evidence
needed in the remaining phases of the audit. They can be reasonably sure that financial information is accurate
when it comes from a system that is proven to have strong controls.
23 | P a g e
➢ Tests of Transactions and Tests of Balances. When auditors test the accuracy of monetary amounts of transactions
and account balances, this is known as substantive testing. Substantive testing therefore determines whether
financial information is accurate, whereas control tests determine whether the financial information is managed
under a system that promotes accuracy. Some level of substantive testing is required on all financial statement
audits, however, the results of the tests of controls will determine the extent of substantive testing. There is an
inverse relationship between the two: the stronger the internal controls, the less substantive testing is required,
and vice versa.
Some testing strategies used to test controls can also be used to perform substantive testing. For instance, parallel
simulations, the test data method, the embedded audit module, and the integrated test facility can be used for both
controls and substantive testing. Recent trends such as advances in automated controls, new compliance
requirements, integration of governance, risk management, and compliance (GRC) activities, and real-time financial
reporting have created the need for continuous auditing. Continuous auditing, or continuous monitoring, is a
process of constant evidence gathering and analysis to provide assurance on the information as soon as it occurs or
shortly thereafter. Continuous monitoring of internal controls is important so that control deficiencies can be
detected before they become significant. The SEC, PCAOB, and AICPA also approve of the use of continuous
auditing. Continuous auditing helps auditors stay involved in their client’s business and perform audit testing in a
more thorough manner. This requires that the auditors have online access to the company’s systems so that data
can be obtained on an ongoing basis. Then the data are downloaded and tested by auditors within a very short
timeframe. Most CPA firms used generalized audit software (GAS) or data analysis software (DAS) to perform audit
tests on electronic files taken from commonly used database systems. These computerized audit tools assist
auditors in the performance of mathematical and statistical computations, data queries, identification of missing
information in a sequence, stratification and comparison of data items, selection of items of interest from the data
files, and summarization of testing results into a useful format for decision-making.
➢ Audit Completion/Reporting. The final phase of the audit involves overall evidence accumulation and drawing final
conclusions. The auditors must determine whether the financial statements are presented fairly and whether all of
the evidence supports the financial information presented. The auditors must also consider whether the extent of
testing has been adequate in light of the risks and controls identified during the planning phase versus the results of
procedures performed in the testing phases.
A letter of representation must be obtained during the final phase of the audit. This is often considered the single
most important piece of audit evidence because it includes management’s acknowledgment of responsibility for the
fair presentation of the financial statements.
Auditors have four choices from which to select a report that communicates the final conclusions of the audit. The
four types of reports include an unqualified opinion, which states that the financial statements are fairly stated; a
qualified opinion, which sets forth limited exceptions; an adverse opinion, which warns that the financial statements
are not fairly stated; or a disclaimer, which explains that an opinion cannot be formed. When reporting on the
effectiveness of internal controls, auditors must choose between an unqualified, adverse, or disclaimer opinion.
➢ Other Audit Considerations.
o Different IT Environments. Auditors are responsible for understanding how information is managed so that it is
reliable. A company’s computer systems may include mainframe and client-server systems, microcomputers and
24 | P a g e
personal computers (PCs), networks, database management systems, and/or e-commerce systems. PCs may
face a greater risk of loss and therefore require strong controls such as locked hard drives, password protection,
separation of operating and programming functions, backup procedures, and virus protection. All of the risks
and audit procedures that apply to PCs are also likely to exist in networks, but the potential for loss is much
greater because of the larger number of computers, users, and information involved in network operations. For
database operations, it is especially important that a database administrator monitors access to the company’s
data on a regular basis. In addition, since many users and many applications will share information in the
database, the data must be organized and controlled consistently. Finally, companies that use e-commerce
depend upon the reliability of other companies’ systems; external access controls are critical in such systems.
An increasing number of companies use IT outsourcing, which places reliance upon an external, independent
computer service center to handle all or part of the IT needs. Auditors must still gain an understanding of the
internal controls surrounding such computer applications, which can be accomplished by testing controls at the
service center or by testing around the computer.
When companies use cloud computing, their auditors need to thoroughly understand the underlying
technologies and related risks and controls. In addition to merely identifying the threats inherent in a cloud
computing environment, it is particularly difficult to estimate their potential costs and overall impact. Exhibit 7-
11 presents the general areas of risk assessment that should be addressed by auditors, and some sample
questions for each area. Useful guidance in conducting audit procedures for cloud computing is available from
ISACA’s IT Assurance Framework, the International Organization for Standardization (ISO) user guides, and the
AICPA’s Service Organization Controls (SOC) Framework.
Auditors can perform their own testing, or they can rely upon SOC reports from a service provider’s auditors.
The SOC 1 report addresses internal controls over financial reporting. A SOC 1 Type I report contains
management’s assessment and the auditor’s opinion on the operating design of internal controls over financial
reporting. A SOC 1 Type II report is an extension of the Type I report in that it also evaluates the operating
effectiveness of those internal controls. A SOC 2 report considers controls over compliance and operations,
including the Trust Services Principles of security, availability, processing integrity, confidentiality, and privacy of
a service provider’s systems. Similar to the SOC 1 reports, the SOC 2 reporting options also allow for a Type I or
Type II conclusion depending upon whether the auditor considers suitability of design or operating effectiveness
of those controls, respectively. Finally, a SOC 3 report is an unaudited report that is available to the general
public containing a CPA firm’s conclusion on the elements of the Trust Services Principles.
o Changes in a Client’s IT Environment. When a company changes the type of hardware or software used or
otherwise modifies its IT environment, auditors should consider applying tests of controls at multiple times
throughout the period in order to determine the effectiveness of controls under each of the systems. Auditors
must evaluate a client’s procedures for developing, implementing, and maintaining new systems or changes in
existing systems.
o Sampling versus Population Testing. Auditors must rely on sampling to test a limited number of items and then
use these limited tests to draw conclusions about the overall control effectiveness and accuracy of transactions
and account balances. There is always some risk that a sample may not represent the population as a whole. The
rise in Big Data and increased use of continuous auditing techniques has led to auditors increasingly testing
100% of a population.
25 | P a g e
➢ Ethical Issues Related To Auditing.
The AICPA has established a Code of Professional Conduct to provide the foundation for ethical behavior
expected of CPAs. The six principles of the Code include:
• Responsibilities
• The Public Interest
• Integrity
• Objectivity and Independence
• Due Care
• Scope and Nature of Services
It is most important that auditors maintain objectivity and independence with respect to their client companies.
Accordingly, they should not become too friendly with their clients or develop any financial relationships with
them that could create bias.
Internal auditors and IT auditors must abide by ethical standards established by the IIA and ISACA, respectively.
The IIA Code of Ethics is founded on the principles of integrity, objectivity, confidentiality, and competency.
Similarly, ISACA’s Code of Professional Ethics recognizes due diligence, objectivity, competency, communication,
maintaining privacy and confidentiality, and serving in the interests of stakeholders.
The Sarbanes-Oxley Act places restrictions on auditors by limiting the types of services they can provide for their
audit clients. This is intended to promote objectivity in the conduct of their work by prohibiting the types of
services that involve accounting work that is subject to an audit and other services that put auditors in a role of
managerial decision making. The Sarbanes-Oxley Act also increased public companies’ responsibilities regarding
the fair presentation of financial statements by requiring the following:
• reporting on the effectiveness of internal controls.
• management’s written verification of the fair presentation of the financial statements.
• establishment of an audit committee to promote independence of the audit function.
In fulfilling their ethical responsibilities, auditors must practice professional skepticism, which means that they
should maintain a questioning attitude and persistent approach to evaluating evidence. This is important in
order to increase the chances of detecting fraud, which may be especially difficult to find if perpetrated by
managers who can override internal controls. Forensic audit testing performed by certified fraud examiners
(CFEs) may be used in cases where fraud is suspected or is known to exist.
Also in practicing professional skepticism, auditors should be careful about balancing the mix of audit
procedures between tests of controls and substantive tests. Emphasis on computer processes and internal
controls may lead to an over-reliance on the accounting system, which could be circumvented by management.
Therefore, it is important to also perform substantive procedures that focus on the actual transactions and
account balances that make up the financial statements.
Accountants are sometimes called upon to perform a specialized type of assurance service called forensic
auditing. Forensic auditing involves audit testing specifically for finding and preventing fraud, and is used for
companies where fraud is known or believed to exist.
Other documents randomly have
different content
Im Jahre 1900 wurden in Deutschland insgesamt 149000 t
gefördert. Würde die durchschnittliche Teufe, aus der diese Kohlen
gefördert werden, 500 m betragen haben, so würde unter Annahme
von 6000 Förderstunden im Jahre hierzu dies einer Arbeitsleistung
entsprechen von
149788000000 kg × 500 m
6000 Std. × 3600 Sek. × 75
= 46250 PS.
Unter Voraussetzung von täglich 8 Arbeitsstunden würden für
diese Leistung rd. 150000 Pferde oder rd. 1500000 Menschen, also
rd. ein Vierzigstel der Gesamtbevölkerung Deutschlands erforderlich
gewesen sein.
B.
Die Hebemaschinen im Hüttenwerk.
ie ersten Kulturstufen der Menschheit wurden nach
dem Material, dessen Bearbeitung man damals
verstand, als Steinzeit, Bronzezeit und Eisenzeit
bezeichnet, weil sinnfällig mit dem vollkommenen
Material auch die Kulturstufe eine höhere wurde. Im
Grunde genommen gilt für das 19. Jahrhundert das
Gleiche, wenn auch nur wenige sich dessen bewußt sind. Man
könnte unbedenklich dieses Jahrhundert als das Zeitalter der Kohle
und des Stahls bezeichnen; denn die Kohle bot dem 19. Jahrhundert
die für seine Entwickelung kennzeichnende Maschinenkraft, und der
Stahl bildete den unentbehrlichen Baustoff für die Maschinen,
Eisenbahnen, Brücken, Dampfschiffe, Waffen und Werkzeuge dieses
Jahrhunderts.
Zu Anfang des 19. Jahrhunderts unterschied sich die Gewinnung
des Eisens noch wenig von dem Verfahren der Zeit um 1500:
Hochöfen von geringen Abmessungen und primitivster Ausrüstung
erzeugten das Roheisen; die Stahlbereitung besorgten zum größten
Teil noch Herdfrischen, die nur mit kostspieligen Holzkohlen
betrieben werden können; die Stahlerzeugung mit Steinkohlen in
Puddelöfen wurde erst 1784 von Henry Cort erfunden. Für die
Bearbeitung des schmiedbaren Eisens stand nur der einfache, vom
Wasserrad getriebene Schwanzhammer zur Verfügung. Die sonstigen
maschinentechnischen Hilfsmittel beschränkten sich auf Blasebälge
und primitive Zylindergebläse, die ebenfalls durch Wasserräder
betrieben wurden; die Hebemaschinen der damaligen Zeit bestanden
aus Gichtaufzügen und aus Drehkranen allereinfachster Art.
Im 19. Jahrhundert tritt eine vollständige Umwandlung der
Eisenerzeugung ein; der Hochofen nimmt in seinen Abmessungen
fortwährend zu und wird vollkommener ausgerüstet; die
Stahlerzeugung erhält durch die Einführung des Flußstahls an Stelle
des Schweißstahls eine ungeahnte Ausdehnung; an Stelle des
Schwanzhammers tritt das Walzwerk. Eine Fülle der
verschiedenartigsten Hebemaschinen wird geschaffen, die allen
Besonderheiten des Hüttenbetriebes angepaßt sind. All das
zusammen führt zu einer gewaltigen Entwicklung der
Eisenerzeugung, die in nachstehenden Zahlen ihren Ausdruck findet:
Roheisenerzeugung
der Erde
Roheisenerzeugung
Deutschlands
Anteil
Deutschlands
im Jahre 1807 760000 t 25000 t 1⁄30
im Jahre 1899 40611000 t 9521000 t 1⁄5
Während also die Roheisenerzeugung der Erde im 19.
Jahrhundert auf das 50fache gestiegen ist, ist in derselben Zeit der
Anteil Deutschlands auf das mehr als 300fache gewachsen: die
glänzende wirtschaftliche Entwicklung Deutschlands in diesem
Jahrhundert findet in diesen Zahlen einen beredten Ausdruck.
Die Bedeutung des Eisens für den Volkshaushalt ergibt sich aus
der Tatsache, daß der Verbrauch an Eisen auf den Kopf der
Bevölkerung in Deutschland
im Jahre 1861 25 kg
im Jahre 1900 132 kg
betragen hat.
Mit dieser Ausdehnung der Eisenerzeugung geht eine
Entwickelung ihrer Hebemaschinen Hand in Hand, die so vielgestaltig
ist, daß eine Gliederung, entsprechend den einzelnen Stufen der
Eisenerzeugung — Hochofen — Stahlwerk — Walzwerk — Verladung
— erforderlich ist.
a) Die Hebemaschinen des Hochofens.
Aus der Zeit von 1500 bis 1800 sind uns keine Nachrichten über
die damals gebräuchlichen Hilfsmittel bekannt. Da die Hochöfen
jener Zeit in Gebirgsgegenden lagen, so bot sich als einfachstes
Mittel die Anlage des Hochofens an einem Berghang, so daß die Erze
aus dem Stollen über eine Brücke unmittelbar zur Gicht gefahren
werden konnten, wie es heute noch bei Kalköfen gebräuchlich ist.
1. 1803 bis 1900: Antrieb durch Druckluft und Dampf.
Das Bild der St. Antonihütte — dem Anfang der heutigen
Gutehoffnungshütte — aus dem Jahre 1835 (Fig. 44, entnommen
aus Frölich »Die Werke der Gutehoffnungshütte«) zeigt uns die
typische Erscheinung eines Hochofens aus dem Anfang des 19.
Jahrhunderts. Die Abmessungen sind sehr bescheidene, die Höhe
des Hochofens beträgt etwa 10 m. Aus dem Bild ist ersichtlich, daß
der Ofen mit einem Gichtaufzug ausgerüstet ist.
Fig. 44.
Es lag nahe, für den Betrieb der Gichtaufzüge die stets
vorhandene Gebläseluft zu benutzen.
Fig. 45 (entnommen aus Hülße »Enzyklopädie« 1. Bd.) stellt
einen derartigen mit Luftdruck betriebenen Gichtaufzug dar, der zu
Chatlinot im Jahre 1839 in Betrieb war und in den Einzelheiten
bereits eine gute Durchbildung erkennen läßt.
Diese Druckluftaufzüge fanden sowohl in Europa wie in den
Vereinigten Staaten große Verbreitung. Sie waren sehr
leistungsfähig, ließen aber hinsichtlich der Betriebskosten und der
Betriebssicherheit zu wünschen übrig.
Als die Dampfmaschine in ihrer Steuerfähigkeit hinreichend
durchgebildet war, um für schnellgehende Gichtaufzüge die
erforderliche Sicherheit zu bieten, trat sie allenthalben an Stelle der
Druckluftaufzüge, denen sie an Leistungsfähigkeit gleichkam, an
Betriebssicherheit und Wirtschaftlichkeit überlegen war.
Mit der zunehmenden Höhe der Hochöfen — die bis zu 40 m
stieg — nahm auch die Hubgeschwindigkeit der Gichtaufzüge zu, bis
zu 2 sekm. Eine weitere Steigerung der Geschwindigkeit würde die
Leistungsfähigkeit so verschwindend wenig steigern, daß sie
zwecklos wäre.
Dagegen trat bald das Bedürfnis nach einer Vervollkommnung in
anderer Hinsicht auf. Die einfachen Gichtaufzüge förderten lediglich
die gefüllten Beschickungswagen bis an die Gicht, während das
Abziehen der Wagen von dem Aufzuggerippe bis an die Gicht und
das Entleeren der Wagen von Hand geschehen mußte. Diese Arbeit
erforderte eine beträchtliche Zahl von Arbeitskräften und war wegen
der ausströmenden Gichtgase zudem mit Gefahr verbunden. In den
Vereinigten Staaten machte sich zuerst das Bestreben geltend, die
Gichtaufzüge so zu gestalten, daß die Beschickungswagen selbsttätig
in die Gicht entleert werden, so daß auf der Gicht keinerlei
Bedienungsmannschaft gebraucht wird. Gleichzeitig ging man dazu
über, die Dampfmaschine des Aufzuges durch den steuerfähigeren
und sparsameren Elektromotor zu ersetzen.
Fig. 45.
2. Von 1900 an: Elektrischer Betrieb.
Fig. 46 und 47 stellen einen sogenannten Schrägaufzug nach
amerikanischer Bauart vor.
Die Schräglage des Aufzuggerüstes gewährt den Vorteil, daß der
Beschickungswagen unmittelbar über die Gicht gelangt. Durch
geeignete Gestaltung der Führungsschienen ist dafür gesorgt, daß
der Wagen umkippt, sobald er in seine höchste Stellung gelangt ist.
Neuerdings hat man zu weiterer Vereinfachung der Bedienung den
Aufzug so gestaltet, daß in dem Augenblick des Umkippens
gleichzeitig der Gichtverschluß selbsttätig geöffnet wird, so daß eine
besondere Steuerung des letzteren nicht erforderlich ist. Fig. 48 zeigt
eine derartige Ausführung der Firma Pohlig in Köln.
Die Schräglage des Aufzuges ist nicht unbedingt erforderlich; sie
kann ersetzt werden durch ein Gerüst, welches vom Boden an
zunächst lotrecht aufsteigt und dann in schlanker Krümmung über
die Gicht führt. Diese Anordnung gewährt den Vorteil, daß sie eine
geringere Grundfläche benötigt als der Schrägaufzug.
Fig. 46.
Fig. 47.
Der erzielte Fortschritt ergibt sich aus folgenden
Vergleichswerten:
Druckluftaufzug
mit Entleerung
von Hand
1839
Elektrischer Schräg-
aufzug mit selbst-
tätiger Entleerung
1900
Hubhöhe 12 m 40 m
Nutzlast 200 kg 4000 kg
Hubgeschwindigkeit 1 sekm 1 sekm
Leistung, am Seil gemessen 3 PS 50 PS
Stündliche Förderung 2 t 80 t
Bedienungsmannschaft 7 Mann 3 Mann
Stündlich erzeugtes Roheisen 0,4 t 40 t
Verkaufspreis von 1 t Roheisen 160 M. 60 M.
b) Die Hebemaschinen des Stahlwerks.
Aus der Zeit von 1500 bis 1800 ist wenig zu berichten, weil die
Stahlerzeugung damals auf das Verfahren des Herdfrischens sich
beschränkte, das nur sehr kleine Mengen lieferte und darum
Transportmittel für schwere Lasten nicht erforderte. Es lag einzig
und allein die Aufgabe vor, die Deckel der Triebherde abzuheben. Da
hiefür nur eine ganz kleine Geschwindigkeit notwendig war, so
genügte ein Drehkran mit Handbetrieb vollständig für diesen Zweck.
Fig. 48.
Das schon genannte Werk von Agricola aus der Zeit um 1550
überliefert uns eine deutliche Darstellung eines Drehkrans Fig. 49.
Der Kran ist mit Fuß- und Halszapfen auf dem Boden und an der
Decke der Gießhalle gelagert. Gegenüber älteren Ausführungen zeigt
er zum erstenmal die Anordnung einer verschiebbaren Laufkatze auf
dem Ausleger. Die Verschiebung der Laufkatze kann jedoch nur vor
dem Anheben der Last vorgenommen werden; solange der Kran
arbeitet, ist die Laufkatze durch eine Sperrklinke festgestellt. Das
Gerüst des Krans ist vollständig aus Holz unter sparsamer
Verwendung von schmiedeeisernen Bändern zusammengefügt; die
Triebwerkswellen sind aus Vierkanteisen, die Stirnräder aus Holz
hergestellt.
Fig. 49.
Die hier dargestellte Anordnung wurde in den folgenden drei
Jahrzehnten für Gießereien eine so typische, daß diese Kranform
geradezu als Gießkran bezeichnet wurde.
Fig. 50 zeigt einen Kran, der im Jahre 1827 in der Gießerei der
Herren Manby und Wilson zu Charenton in Betrieb war (entnommen
aus Dinglers Journal 1827, Bd. 23, Taf. 6). Er zeigt im wesentlichen
den gleichen Aufbau wie der Kran von Agricola, nur ist das
Krangerüst nicht aus Holz sondern aus Gußeisen hergestellt. Er
verfügt bereits über eine Tragkraft von 6 t bei einer größten
Ausladung von 6,5 m. Ein wesentlicher Fortschritt ist darin zu finden,
daß die Laufkatze bei angehängter Last verschoben werden kann,
was dadurch erreicht wurde, daß das feste Ende der Lastkette nicht
an der Laufkatze, sondern am äußeren Ende des Auslegers befestigt
wurde. Die Verschiebung wurde durch Zahnstange und Haspelrad
bewirkt.
Fig. 50.
Neben derartigen Gußeisenkonstruktionen wurden auch noch
hölzerne Krangerüste mit gußeisernen Verbindungsstücken bis über
die Mitte des 19. Jahrhunderts hinaus ausgeführt. Im letzten Drittel
des Jahrhunderts trat Walzeisen an die Stelle von Gußeisen und
Holz; die typische Gestalt des Gießereidrehkrans wurde aber immer
noch beibehalten, bis schließlich der elektrische Betrieb dem
Laufkran die Überlegenheit verschaffte.
1. 1840 bis 1900: Antrieb durch Druckwasser.
Die im Jahre 1784 durch Cort erfundene Stahlerzeugung durch
das Puddelverfahren erforderte keine maschinentechnischen
Hilfsmittel, führte daher auch zu keiner weiteren Entwickelung dieser
Mittel. Eine großzügige Gestaltung erhielt die Stahlerzeugung erst
durch das Verfahren von Bessemer, das von diesem im Jahre 1855
erfunden wurde, und das nach Einführung der basischen
Auskleidung durch Thomas und Gilchist im Jahre 1878 auch in
Deutschland sich allgemein einbürgerte. Die Anforderungen, welche
das Bessemerverfahren an die Transportmittel stellt, werden sofort
erkennbar, wenn man die Anordnung eines Bessemerwerks sich vor
Augen hält.
Fig. 51 (entnommen aus Frölich S. 25) stellt einen Schnitt durch
das Bessemerwerk der Gutenhoffnungshütte dar. Man erblickt rechts
die drehbare Birne, die ausgezogen in der Blasstellung, gestrichelt in
der Gießstellung gezeichnet ist. Die Zufuhr des flüssigen Roheisens
zur Birne wird durch fahrbare Gießkübel auf dem Geleis der
Roheisenbühne bewirkt. In der Mitte der Halle ist das Geleis für den
Gießkran angeordnet, in dessen Kübel die Birne nach Beendigung
des Prozesses den flüssigen Stahl ausgießt. Unbedingtes Erfordernis
für die erfolgreiche Durchführung des Verfahrens sind rasch
arbeitende und betriebssichere Gießkrane. Die Stahlwerks-Gießkrane
haben mannigfache Wandlungen durchgemacht; ihre Gestaltung war
maßgebend für die Anordnung des Stahlwerks.
Fig. 51.
Neben schneller und sicherer Bewegung des Gießkübels in
lotrechter und wagrechter Richtung sind größte Einfachheit und
Unempfindlichkeit gegen Staub unerläßliche Betriebsbedingungen für
Gießkrane. Der Dampfbetrieb mit seinen mehrfachen Getrieben und
seiner umständlichen Bedienung ist für diesen Zweck kaum
geeignet.
Um so mehr kam der einfache und sichere Druckwasserantrieb
den Anforderungen des Stahlwerkbetriebs entgegen.
Den Vorläufer des Druckwasserkrans bildet die hydraulische
Presse, die von Bramah im Jahre 1796 erfunden wurde. Aus dem
Jahre 1826 liegt eine Veröffentlichung vor, aus welcher hervorgeht,
daß Bramah bereits einen Kran mit Druckwasserantrieb konstruiert
hat, wenn auch zunächst in einer Form, die dem gewöhnlichen
Handantrieb gegenüber kaum einen Vorteil bot.
Fig. 52 (entnommen aus Nicholson »Der praktische Mechaniker«,
Fig. 386) stellt diesen ersten Versuch dar. Durch eine Handpumpe
wird Druckwasser in einen Treibzylinder gepreßt, dessen Kolben mit
einer Zahnstange gekuppelt ist, die ihrerseits die Seiltrommel durch
ein Stirnrad in Umdrehung versetzt.
Im Jahre 1846 setzte Armstrong in Newcastle einen Kran in
Betrieb, der durch das der städtischen Leitung entnommene
Druckwasser gespeist wurde.
Fig. 52.
Das Grundsätzliche dieses Betriebes ist aus Fig. 53 zu erkennen.
Das Wasserwerk pumpt Wasser aus einem Brunnen in einen
Hochbehälter. Von diesem strömt das Wasser in das Leitungsnetz
und zwar mit einem Druck, welcher der Höhenlage des Behälters
über den Verbrauchsstellen abzüglich der Reibungswiderstände im
Leitungsnetz entspricht. Durch eine geeignete Steuerung — Schieber
oder Ventil — wird entweder das Druckwasser in den Treibzylinder
geleitet, um die Last zu heben, oder es wird der Treibzylinder
abgesperrt, um die Last in gehobener Stellung festzuhalten, oder es
wird schließlich der Treibzylinder in die Abwasserleitung entleert, um
die Last zu senken.
Da die Wasserpressung in der städtischen Wasserleitung wegen
der unregelmäßigen Entnahme stark schwankt, so stellte Armstrong
später in Grimsby einen besonderen Wasserturm auf.
Der Einfachheit des Hochbehältersystems steht der Nachteil
gegenüber, daß der Wasserdruck von der Höhenlage abhängig ist,
daher meist nicht größer als zwei Atmosphären sein kann, daß
infolgedessen große Querschnitte des Treibzylinders und der
Leitungen erforderlich sind, und daß hierdurch die Anlagekosten
außerordentlich hoch werden. Infolge der hohen Besitzkosten wird
der Preis des Druckwassers aus städtischen Leitungen in den
meisten Fällen so hoch, daß die Verwendung desselben zu
Kraftzwecken unwirtschaftlich erscheint.
Fig. 53.
Armstrong suchte nun die Wirtschaftlichkeit dadurch zu
verbessern, daß er den offenen Hochbehälter durch einen
geschlossenen Windkessel ersetzte, in den durch die Pumpe Wasser
gepreßt wird, Fig. 54. Da bei diesem System der Wasserdruck nicht
durch das Eigengewicht des Wassers, sondern durch die Spannkraft
der eingeschlossenen und zusammengepreßten Luft erzeugt wird, so
muß naturgemäß mit steigendem Wasserstand im Windkessel die
Pressung zunehmen, mit fallendem Wasserstand abnehmen. Der
Wasserdruck wird daher um so veränderlicher sein, je kleiner der
Windkessel ist.
Dieses System gestattet, Pressungen bis zu 10 Atm.
anzuwenden, ermöglicht daher eine weitgehende Verkleinerung der
Leitungsquerschnitte und der Treibzylinder, so daß die Anlagekosten
wesentlich verringert werden. Für noch höhere Pressungen ist das
System nicht verwendbar, weil bei höherem Druck die Luft im
Windkessel sehr bald vom Wasser absorbiert wird.
Armstrong gab den Versuch mit Windkessel sehr bald auf, weil er
den Wasserdruck allzu veränderlich fand; vermutlich war der
Windkessel zu klein ausgeführt. Dagegen wurde dieses System
später in Amerika für den Betrieb von Aufzügen sorgfältig
durchgebildet und viel verbreitet.
Fig. 54.
Im Jahre 1851 kam Armstrong auf den Gedanken, den
Wasserdruck dadurch zu erhöhen, daß an Stelle des Hochbehälters
ein Treibzylinder verwendet wurde, dessen Kolben durch ein Gewicht
belastet war. Es entsteht dann eine Anordnung, wie sie in Fig. 55
schematisch dargestellt ist. Ein Pumpwerk preßt Wasser aus einem
Vorratsbehälter in einen Akkumulator, d. h. in einen Zylinder mit
gewichtsbelastetem Kolben. Der Wasserdruck entspricht dem
Querschnitt und der Belastung dieses Kolbens. Aus dem
Akkumulatorzylinder strömt das Druckwasser in das Leitungsnetz
und wird aus diesem den Kranen durch geeignete Steuerungen
zugeführt. Sind alle Krane abgesperrt, so steigt der
gewichtsbelastete Kolben des Akkumulators unter der Einwirkung
des Pumpwerks. Sobald ein Kran dem Leitungsnetz Druckwasser
entnimmt, sinkt der Kolben des Akkumulators wieder herab; das
Wasser steht stets unter gleicher Pressung. Eine besondere
Vorkehrung sorgt dafür, daß bei höchster Stellung des
Akkumulatorkolbens die Pumpe selbständig stillgesetzt wird, damit
der Kolben nicht aus dem Zylinder herausgetrieben wird; sobald der
Kolben wieder sinkt, setzt sich die Pumpe selbsttätig wieder in Gang.
Die Belastung des Akkumulators wird in der Regel so bemessen, daß
die Wasserpressung 50 Atm. beträgt; ausnahmsweise steigert man
die Pressung bis auf 100 Atm.
Fig. 55.
Für Stahlwerke fand der Druckwasserantrieb mit Akkumulator
schon vor der Mitte des 19. Jahrhunderts Anwendung. Die Gießkrane
erhielten durch Cockerill in Seraing eine eigenartige Gestaltung, die
allgemein Verbreitung fand.
Fig. 56 (entnommen aus Ernst »Hebezeuge«, Taf. 82) stellt
diesen Typ dar, der dadurch gekennzeichnet ist, daß der
Treibzylinder gleichzeitig als Krangerüst dient. Der Zylinder ist im
Boden verankert; der Tauchkolben führt sich in dem Grundring der
Stopfbüchse und in einem zweiten in Zylindermitte eingefügten
Halsring und ist dadurch befähigt, in jeder Hubstellung ein
Biegungsmoment auf den Zylinder zu übertragen. Starr mit dem
Tauchkolben verbunden ist ein Ausleger, der auf der einen Seite den
Gießkübel von 11 t Inhalt, auf der andern ein Gegengewicht trägt,
welches das Moment der Nutzlast zur Hälfte ausgleicht. Durch
Einleiten von Druckwasser in den Zylinder wird der Tauchkolben mit
Ausleger und Kübel gehoben; die Schwenkung des Auslegers wird
durch ein Handtriebwerk bewirkt, die Entleerung des Kübels wird
ebenfalls von Hand besorgt. Die Anordnung ist durch ihre
außerordentliche Einfachheit bemerkenswert.
Der Druckwasserzuleitung wegen mußten die Gießkrane stets
feststehend angeordnet werden. Der Gießkübel konnte daher nur die
Ringfläche bestreichen, in deren Mittelpunkt der Kran gestellt war.
Die Gießformen mußten infolgedessen in dieser Ringfläche
angeordnet werden, die Bessemerbirne am Rande der Ringfläche.
Die Eigenart des Krans bedingte daher die Anordnung des
Stahlwerks. Naturgemäß entstanden zwischen den Ringflächen tote
Ecken, die nicht ausgenutzt werden konnten.
Fig. 56.
❏
GRÖSSERES BILD
Fig. 57.
Diesem Nachteil suchte man später in der Weise abzuhelfen, daß
man den flüssigen Stahl aus der Birne nicht unmittelbar dem
Gießkran übergab, sondern daß man zwischen den Birnen und den
Gießkranen ein Geleise anordnete. Auf diesem Geleise lief ein
Gießwagen mit Dampfbetrieb, der den Stahl von den Birnen zu den
einzelnen Gießkranen förderte; der Gießwagen goß den Stahl in die
Kübel der Gießkrane aus, es war ein zweimaliges Ausgießen
erforderlich. Die Gießkrane selbst wurden nun so gestaltet, daß sie
die Grundfläche so viel wie irgend möglich freiließen, und daß sie
anderseits eine möglichst breite Ringfläche bestrichen. Diese
Forderungen führten zu der in Fig. 57 dargestellten Anordnung von
Stuckenholz in Wetter a. Ruhr, bei welcher der Treibzylinder von dem
Krangerüst getrennt ist. Das Gerüst ist aus Walzeisen so gebildet,
daß möglichst wenig Raum verloren geht. In einem feststehenden,
aus Walzeisen genieteten Unterbau ist drehbar die Kransäule
gelagert, die als Kastenträger ausgebildet ist. Hinter ihr ist der
Hubzylinder stehend montiert, der mittels Drahtseilflaschenzugs den
Gießkübel hebt. Liegend auf dem Ausleger ist ein doppelt wirkender
Treibzylinder angeordnet, dessen Kolbenstange die Laufkatze
verschiebt. Neben ihm liegt ein dritter Zylinder, dessen gleichfalls
doppelt wirkende Kolbenstange als Zahnstange ausgebildet ist und
vermittelst Ritzel und Zahnkranz die Schwenkbewegung des
Auslegers herbeiführt. Alle Triebwerksteile liegen frei zugänglich und
so hoch, daß sie dem Einfluß des Staubes möglichst entzogen sind.
2. Von 1900 an: Elektrischer Betrieb.
Völlige Freiheit in der Anordnung des Stahlwerks konnte nur
dann gewonnen werden, wenn es gelang, die Gießkrane selbst
fahrbar einzurichten. Der Druckwasserbetrieb schloß diese
Möglichkeit aus, der Zuleitung wegen.
Der Dampfkran war für den anstrengenden Gießbetrieb zu
verwickelt in seinem Getriebe und zu umständlich in seiner
Steuerung. Lösbar wurde die Aufgabe erst nach Einführung des
elektrischen Betriebes, der durch die Kontaktleitung die notwendige
freie Beweglichkeit und durch seine Steuerfähigkeit die erforderliche
Betriebseinfachheit und Sicherheit gewährte. Sobald die Einzelheiten
des elektrischen Kranbetriebes genügend dem derben Hüttenbetrieb
angepaßt waren, entstanden in rascher Folge neue Gestalten von
Gießkranen.
Fig. 58.
Fig. 58 stellt zunächst eine Ausführung der Union-E.-G. dar, die
dem Dampfkran nachgebildet ist. Der Kran läuft auf einem
Breitspurgeleise und trägt einen Ausleger, der gehoben und
geschwenkt werden kann, und auf dem die fahrbare und kippbare
Gießpfanne ruht. Fünf Elektromotoren betätigen die genannten fünf
Bewegungen des Kübels bzw. des Krans. Die Anordnung befriedigt
alle Anforderungen des Hüttenbetriebes: sie ist frei beweglich,
betriebssicher und vollkommen steuerfähig. Eine Vervollkommnung
war jedoch insofern möglich, als der von dem Breitspurgeleise
beanspruchte Raum einen beträchtlichen Teil des Hallenquerschnitts
in Anspruch nahm. Dieser Raum konnte gewonnen werden dadurch,
daß man die beiden Schienen auf Konsolen an den Hallenwänden
lagerte und den Kranwagen als eine Brücke ausbildete, welche die
ganze Halle überspannte. Dadurch wurde gleichzeitig die Möglichkeit
gewonnen, dem Gießkübel noch eine Bewegung quer zur Halle zu
erteilen und so ein breites Rechteck zu bestreichen.
Fig. 59.
❏
GRÖSSERES BILD
Fig. 59 zeigt eine Ausführung dieser Art von Stuckenholz, die
über eine Tragkraft von 15 t verfügt. Derartige Laufkrane mit großen
Geschwindigkeiten wurden erst durch die Einführung des
elektrischen Betriebes möglich, denn einen Dampfkessel hätte man
auf einem so hoch gelegenen Kran kaum in einwandsfreier Weise
aufstellen können; die mechanische Zuführung der Energie durch
Wellen oder Seile hingegen erlaubte die Anwendung von nur sehr
kleinen Geschwindigkeiten, die für ein Stahlwerk nicht im
entferntesten ausgereicht hätten.
Von der Notwendigkeit schnellarbeitender Hebemaschinen für ein
modernes Stahlwerk kann man sich eine Vorstellung machen, wenn
man sich den Umfang und die Schnelligkeit des Betriebes
vergegenwärtigt. Ein modernes Bessemerwerk leistet mit zwei
Birnen von je 10 t Inhalt 2000 t Stahl im Tag; dementsprechend muß
alle 15 Min. eine Birne entleert werden. Hiervon entfallen 4 Min. auf
das Füllen und Aufrichten der Birne, 9 Min. auf das eigentliche
Blasen, die übrigen 2 Min. stehen zur Verfügung für das Senken der
Birne, das Ausgießen des Stahls und der Schlacke und das Aufrichten
in die Füllstellung. Das flüssige Roheisen wird durch einen
Gießwagen von 20 t Inhalt mit einer Fahrgeschwindigkeit von 2 m in
der Sekunde zugeführt, der flüssige Stahl durch einen Gießkran von
10 t Kübelinhalt, also 15 t Tragkraft in die Kokillen gegossen. Für
diesen ganzen Betrieb sind an Mannschaft erforderlich: ein
Gießmeister und ein Birnensteurer auf der Steuerbühne, ein
Steuermann auf dem Gießwagen und ein zweiter auf dem Gießkran.
Trotz der Geschwindigkeit, mit der die gewaltigen Massen bewegt
werden, vollzieht sich alles mit größter Ruhe: ein überzeugender
Beweis dafür, daß bei einem vollkommenen Maschinenbetrieb alle
menschliche Handlangerarbeit ausgeschaltet ist, so daß der Mensch
das Getriebe nur steuert und beherrscht, nicht ihm dient.
Neben dem Bessemerverfahren gewann für hochwertigen Stahl
das Siemens-Martin-Verfahren bald eine solche Verbreitung, daß
auch hierfür Maschinenkraft den Transport übernehmen mußte. Die
Ansprüche, welche an diesen gestellt wurden, lassen sich aus dem
Querschnitt eines Martin-Werks sofort herauslesen.
Welcome to our website – the perfect destination for book lovers and
knowledge seekers. We believe that every book holds a new world,
offering opportunities for learning, discovery, and personal growth.
That’s why we are dedicated to bringing you a diverse collection of
books, ranging from classic literature and specialized publications to
self-development guides and children's books.
More than just a book-buying platform, we strive to be a bridge
connecting you with timeless cultural and intellectual values. With an
elegant, user-friendly interface and a smart search system, you can
quickly find the books that best suit your interests. Additionally,
our special promotions and home delivery services help you save time
and fully enjoy the joy of reading.
Join us on a journey of knowledge exploration, passion nurturing, and
personal growth every day!
testbankdeal.com

More Related Content

PDF
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
PDF
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
PDF
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
PDF
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
PDF
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
PDF
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
PDF
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
PDF
Solution Manual for Auditing and Assurance Services 17th by Arens
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
Accounting Information Systems Controls Processes 3rd Edition Turner Solution...
Solution Manual for Auditing and Assurance Services 17th by Arens

Similar to Accounting Information Systems Controls Processes 3rd Edition Turner Solutions Manual (20)

PDF
Solution Manual for Auditing and Assurance Services 17th by Arens
PDF
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
PDF
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
PDF
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
PDF
Solution Manual for Auditing and Assurance Services 17th by Arens
PDF
Solution Manual for Auditing and Assurance Services 17th by Arens download pdf
PDF
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
PDF
Intermediate Accounting Kieso 13th Edition Solutions Manual
PDF
Solution Manual for Auditing and Assurance Services 17th by Arens
PDF
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
PDF
Solution Manual for Auditing and Assurance Services 17th by Arens
PDF
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
PDF
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
PDF
Intermediate Accounting Kieso 13th Edition Solutions Manual
PPTX
Information Systems Audit - week 1 lecture
PDF
All chapter download Solution manual for Financial Statements Analysis Subram...
PDF
Solution Manual for Auditing and Assurance Services 17th by Arens
PDF
Cornerstones of Cost Management Hansen 3rd Edition Test Bank
PDF
Get Intermediate Accounting Kieso 13th Edition Solutions Manual free all chap...
PDF
Solution manual for Financial Statements Analysis Subramanyam Wild 11th edition
Solution Manual for Auditing and Assurance Services 17th by Arens
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
Solution Manual for Auditing and Assurance Services 17th by Arens
Solution Manual for Auditing and Assurance Services 17th by Arens download pdf
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
Intermediate Accounting Kieso 13th Edition Solutions Manual
Solution Manual for Auditing and Assurance Services 17th by Arens
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
Solution Manual for Auditing and Assurance Services 17th by Arens
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
Auditing The Art and Science of Assurance Engagements Canadian 13th Edition A...
Intermediate Accounting Kieso 13th Edition Solutions Manual
Information Systems Audit - week 1 lecture
All chapter download Solution manual for Financial Statements Analysis Subram...
Solution Manual for Auditing and Assurance Services 17th by Arens
Cornerstones of Cost Management Hansen 3rd Edition Test Bank
Get Intermediate Accounting Kieso 13th Edition Solutions Manual free all chap...
Solution manual for Financial Statements Analysis Subramanyam Wild 11th edition
Ad

Recently uploaded (20)

PDF
A systematic review of self-coping strategies used by university students to ...
PDF
GENETICS IN BIOLOGY IN SECONDARY LEVEL FORM 3
PPTX
Microbial diseases, their pathogenesis and prophylaxis
PPTX
Cell Types and Its function , kingdom of life
PDF
LDMMIA Reiki Yoga Finals Review Spring Summer
PDF
LNK 2025 (2).pdf MWEHEHEHEHEHEHEHEHEHEHE
PDF
RMMM.pdf make it easy to upload and study
PDF
01-Introduction-to-Information-Management.pdf
PPTX
Final Presentation General Medicine 03-08-2024.pptx
PPTX
master seminar digital applications in india
PPTX
Final Presentation General Medicine 03-08-2024.pptx
PDF
Chinmaya Tiranga quiz Grand Finale.pdf
PPTX
202450812 BayCHI UCSC-SV 20250812 v17.pptx
PDF
Trump Administration's workforce development strategy
PDF
Supply Chain Operations Speaking Notes -ICLT Program
PDF
A GUIDE TO GENETICS FOR UNDERGRADUATE MEDICAL STUDENTS
PDF
What if we spent less time fighting change, and more time building what’s rig...
PPTX
Tissue processing ( HISTOPATHOLOGICAL TECHNIQUE
PDF
RTP_AR_KS1_Tutor's Guide_English [FOR REPRODUCTION].pdf
PDF
Classroom Observation Tools for Teachers
A systematic review of self-coping strategies used by university students to ...
GENETICS IN BIOLOGY IN SECONDARY LEVEL FORM 3
Microbial diseases, their pathogenesis and prophylaxis
Cell Types and Its function , kingdom of life
LDMMIA Reiki Yoga Finals Review Spring Summer
LNK 2025 (2).pdf MWEHEHEHEHEHEHEHEHEHEHE
RMMM.pdf make it easy to upload and study
01-Introduction-to-Information-Management.pdf
Final Presentation General Medicine 03-08-2024.pptx
master seminar digital applications in india
Final Presentation General Medicine 03-08-2024.pptx
Chinmaya Tiranga quiz Grand Finale.pdf
202450812 BayCHI UCSC-SV 20250812 v17.pptx
Trump Administration's workforce development strategy
Supply Chain Operations Speaking Notes -ICLT Program
A GUIDE TO GENETICS FOR UNDERGRADUATE MEDICAL STUDENTS
What if we spent less time fighting change, and more time building what’s rig...
Tissue processing ( HISTOPATHOLOGICAL TECHNIQUE
RTP_AR_KS1_Tutor's Guide_English [FOR REPRODUCTION].pdf
Classroom Observation Tools for Teachers
Ad

Accounting Information Systems Controls Processes 3rd Edition Turner Solutions Manual

  • 1. Download the full version and explore a variety of test banks or solution manuals at https://testbankdeal.com Accounting Information Systems Controls Processes 3rd Edition Turner Solutions Manual _____ Tap the link below to start your download _____ https://testbankdeal.com/product/accounting-information- systems-controls-processes-3rd-edition-turner-solutions- manual/ Find test banks or solution manuals at testbankdeal.com today!
  • 2. We believe these products will be a great fit for you. Click the link to download now, or visit testbankdeal.com to discover even more! Accounting Information Systems Controls Processes 3rd Edition Turner Test Bank https://testbankdeal.com/product/accounting-information-systems- controls-processes-3rd-edition-turner-test-bank/ Accounting Information Systems The Processes Controls 2nd Edition Turner Solutions Manual https://testbankdeal.com/product/accounting-information-systems-the- processes-controls-2nd-edition-turner-solutions-manual/ Accounting Information Systems The Processes and Controls 2nd Edition Turner Test Bank https://testbankdeal.com/product/accounting-information-systems-the- processes-and-controls-2nd-edition-turner-test-bank/ Fundamentals of Corporate Finance 9th Edition Brealey Test Bank https://testbankdeal.com/product/fundamentals-of-corporate- finance-9th-edition-brealey-test-bank/
  • 3. International Trade 3rd Edition Feenstra Solutions Manual https://testbankdeal.com/product/international-trade-3rd-edition- feenstra-solutions-manual/ Management 12th Edition Robbins Solutions Manual https://testbankdeal.com/product/management-12th-edition-robbins- solutions-manual/ Foundations of Strategy 2nd Edition Grant Solutions Manual https://testbankdeal.com/product/foundations-of-strategy-2nd-edition- grant-solutions-manual/ New Perspectives on Computer Concepts 2014 Comprehensive 17th Edition Parsons Test Bank https://testbankdeal.com/product/new-perspectives-on-computer- concepts-2014-comprehensive-17th-edition-parsons-test-bank/ Economic Analysis of Social Issues 1st Edition Alan Grant Test Bank https://testbankdeal.com/product/economic-analysis-of-social- issues-1st-edition-alan-grant-test-bank/
  • 4. Intermediate Algebra 8th Edition Tobey Test Bank https://testbankdeal.com/product/intermediate-algebra-8th-edition- tobey-test-bank/
  • 5. Chapter 7- Auditing Information Technology-Based Processes Instructor’s Manual
  • 6. 2 | P a g e CHATPER 7: AUDITING INFORMATION TECHNOLOGY-BASED PROCESS LEARNING OBJECTIVES:..........................................................................................................................................3 REAL WORLD: AURAFIN BRAND .............................................................................................................................3 INTRODUCTION TO AUDITING IT PROCESSES (STUDY OBJECTIVE 1) ........................................................4 TYPES OF AUDITS AND AUDITORS (STUDY OBJECTIVE 2) .......................................................................4 INFORMATION RISK AND IT-ENHANCED INTERNAL CONTROL(STUDY OBJECTIVE 3) ..........................6 AUTHORITATIVE LITERATURE USED IN AUDITING (STUDY OBJECTIVE 4) ...............................................6 MANAGEMENT ASSERTIONS AND AUDIT OBJECTIVES(STUDY OBJECTIVE 5)..............................................8 PHASES OF AN IT AUDIT (STUDY OBJECTIVE 6)...................................................................................................9 USE OF COMPUTERS IN AUDITS (STUDY OBJECTIVE 7) .........................................................................11 TESTS OF CONTROLS (STUDY OBJECTIVE 8) ..............................................................................................11 GENERAL CONTROLS ........................................................................................................................................11 APPLICATION CONTROLS..................................................................................................................................13 TESTS OF TRANSACTIONS AND TESTS OF BALANCES (STUDY OBJECTIVE 9) ...................................14 AUDIT COMPLETION/REPORTING (STUDY OBJECTIVE 10)..........................................................................15 OTHER AUDIT CONSIDERATIONS (STUDY OBJECTIVE 11 ) ......................................................................15 DIFFERENT ITENVIRONMENTS..........................................................................................................................15 CHANGES IN A CLIENT’S IT ENVIRONMENT ..................................................................................................17 SAMPLING VERSUS POPULATION TESTING......................................................................................................17 ETHICAL ISSUES RELATED TO AUDITING (STUDY OBJECTIVE 12) ..........................................................18 CHAPTER SUMMARY ............................................................................................................................................19
  • 7. 3 | P a g e CHAPTER 7: AUDITING INFORMATION TECHNOLOGY-BASED PROCESS LEARNING OBJECTIVES: 1. An introduction to auditing IT processes 2. The various types of audits and auditors 3. Information risk and IT-enhanced internal control 4. Authoritative literature used in auditing 5. Management assertions used in the auditing process and the related audit objectives 6. The phases of an IT audit 7. The use of computers in audits 8. Tests of controls 9. Tests of transactions and tests of balances 10. Audit completion/reporting 11. Other audit considerations 12. Ethical issues related to auditing REAL WORLD: AURAFIN BRAND • The Aurafin brand is renowned in the jewelry industry as the fashion leader in fine gold. • Owned by Richline Group, Inc., a subsidiary of Berkshire Hathaway, Inc., the brand is sold by retail giants like JCPenney, Macy’s, and many online outlets. • Aurafin has overcome significant challenges in maintaining its customer relationships. Several years ago, Aurafin began experiencing such severe problems with transaction fulfillment and delivery that its customers were taking notice. • JCPenney had implemented a supplier scorecard system, a type of vendor audit whereby companies, which do business with JCPenney were evaluated on the basis of the quality of service provided. This system brought to light some significant violations in Aurafin’s business processes, including weaknesses in controls and inadequate computer systems. Aurafin took quick action, undergoing a thorough IT audit which identified the specific causes of its process failures. Aurafin acted swiftly upon the recommendations made by its auditors and implemented a more reliable technology platform that empowered it to apply a variety of new audit and control techniques and to get its systems in sync with its business goals. Aurafin credits the audit processes to its newfound success, including its subsequent recognition as JCPenney’s “Vendor of the Year.” This chapter focuses on various aspects of an IT audit, as well as the accountant’s techniques for evaluating information-technology processes, and their importance in business processes.
  • 8. 4 | P a g e INTRODUCTION TO AUDITING IT PROCESSES (STUDY OBJECTIVE 1) Nearly all business organizations rely on computerized systems to assist in the accounting function. Technological advances have transformed the business world by providing new ways for companies to do business and maintain records. This boom in technological developments has increased the amount of information that is readily available. Business managers, investors, creditors, and government agencies often have a tremendous amount of data to use when making important business decisions. However, it is often a challenge to verify the accuracy and completeness of the information. Accountants have an important role in the business world because they are called upon to improve the quality of information provided to decision makers. Accounting services that improve the quality of information are called assurance services. Many types of services performed by accountants are considered assurance services because they lend credibility to the underlying financial information. An audit is the most common type of assurance service TYPES OF AUDITS AND AUDITORS (STUDY OBJECTIVE 2) The main purpose of the audit is to assure users of financial information about the accuracy and completeness of the information. To carry out an audit, accountants collect and evaluate proof of procedures, transactions, and/or account balances and compare the information with established criteria. The three primary types of audits include: • compliance audits, • operational audits, and • financial statement audits Compliance audits determine whether the company has complied with regulations and policies established by contractual agreements, governmental agencies, company management, or other high authority. Operational audits assess operating policies and procedures for efficiency and effectiveness Financial statement audits determine whether the company has prepared and presented its financial statements fairly, and in accordance with established financial accounting criteria. • financial statement audits are performed by certified public accountants who have extensive knowledge of generally accepted accounting principles (GAAP) in the United States and/or International Financial Reporting Standards (IFRS)
  • 9. 5 | P a g e There are different types of audit specialization that exist in business practice today, including: • An internal auditor is an employee of the company that he or she audits. Most large companies have a staff of internal auditors who perform compliance, operational, and financial audit functions at the request of management. Some internal auditors achieve special certification as certified internal auditors (CIAs). • IT auditors specialize in information systems assurance, control, and security, and they may work for CPA firms, government agencies, or with the internal audit group for any type of business organization. Some IT auditors achieve special certification as certified information systems auditors (CISAs). • Government auditors conduct audits of government agencies or income tax returns. • CPA firms represent the interests of the public by performing independent audits of many types of business organizations. Only CPA firms can conduct financial statement audits of companies whose stock is sold in public markets such as the New York Stock Exchange. An important requirement for CPA firms is that they must be neutral with regard to the company being audited. The neutrality requirement allows CPA firms to provide an unbiased opinion on the information it audits, and it is the foundation of an external audit performed by CPAs. An external audit is performed by independent auditors who are objective and neutral with respect to the company and information being audited. To keep their neutrality, CPA firms and their individual CPAs are generally prohibited from having financial and managerial connections with client companies and from having personal ties to those working for client companies. A CPA’s objectivity could be impaired by having these types of relationships with a client company or with anyone having the ability to influence the client’s decisions and financial reporting activities. • Performing financial statement audits is a main service of CPA firms. • Because many audited companies use sophisticated IT systems to prepare financial statements, it is important for auditors to enhance the quality of their services in auditing those systems. • IT auditing is a part of the financial statement audit that evaluates a company’s computerized accounting information systems. • An auditor must gain a sufficient understanding of the characteristics of a company’s IT system. • Use of computers may significantly change the way a company processes and communicates information, and it may affect the underlying internal controls. Therefore, the IT environment plays a key role in how auditors conduct their work in the following areas: o Consideration of risk o Audit procedures used to obtain knowledge of the accounting and internal control systems o Design and performance of audit tests
  • 10. 6 | P a g e INFORMATION RISK AND IT-ENHANCED INTERNAL CONTROL (STUDY OBJECTIVE 3) Information risk is the chance that information used by decision makers may be inaccurate. Following are some causes of information risk: • the remoteness of information • the volume and complexity of the underlying data • the motive of the preparer The most common way for decision makers to reduce information risk is to rely upon information that has been audited by an independent party. Various risks are created by the existence of IT-based business processes. For example, because the details of transactions are often entered directly into the computer system, there may be no paper documentation maintained to support the transactions. This is often referred to as the loss of audit trail visibility because there is a lack of physical evidence to visibly view. Advantages of using IT-based systems: • Internal controls can actually be enhanced if care is exercised in implementing these systems • Computer controls can compensate for the lack of manual controls • If programs are tested properly the risk of human error is virtually eliminated • Provide higher quality information to management AUTHORITATIVE LITERATURE USED IN AUDITING (STUDY OBJECTIVE 4) Generally accepted auditing standards (GAAS) are broad guidelines for an auditor’s professional responsibilities. These ten standards are divided into three categories that include general qualifications and conduct of an auditor (general standards), guidelines for performing the audit (standards of fieldwork), and requirements for the written report communicating the results of the audit (standards of reporting).
  • 11. 7 | P a g e General Standards StandardsofFieldwork Standards ofReporting 1. The audit is to be performed by a person or persons having adequate technicaltraining and proficiency as anauditor. 2. Independence in mental attitude is to be maintained in all matters related to the audit engagement. 3. Due professional care is to be exercised in all phases of the audit process. 1. The audit is to be adequately planned and supervised. 2. An understanding of internalcontrol is to be obtained as part of the planning process for the purpose of determining the nature, timing, and extent of tests to beperformed. 3. Evidence is to be obtained through inspection, inquiries, observation, and confirmations in order to provide a reasonable basis for forming an overall opinion on the audit. 1. The written report must state whether the financial statements are presented in accordance with the establishedcriteria. 2. The written report identifies any circumstances in which established principles have not been consistently applied in the current period in relation to the priorperiod. 3. The financial statements are assumed to contain adequate informative disclo- sures unless otherwise indicated in the written report. 4. The written report expresses an opinion on the fairness of the financial statements as a whole, or an assertion to the effect that an opinion cannot be expressed (and the reasons therefor). The report also describes the character of the auditor’s work and the degree of responsibilityassumedbytheauditor.
  • 12. 8 | P a g e The Public Company Accounting Oversight Board (PCAOB) was organized in 2003 for the purpose of establishing auditing standards for public companies in the United States • The PCAOB was established by the Sarbanes–Oxley Act, which was created in response to several major corporate accounting scandals, including those affecting Enron, WorldCom, and others • Prior to the PCAOB, standard-setting was the responsibility of the Auditing Standards Board (ASB) of the American Institute of CPAs (AICPA) • The International Auditing and Assurance Standards Board (IAASB) was established by the International Federation of Accountants (IFAC) to set International Standards on Auditing (ISAs) that contribute to the uniform application of auditing practices on a worldwide basis. ISAs are similar to SASs; however, ISAs tend to extend SASs because of their usefulness in audits of multinational companies. Although auditors have a primary responsibility to comply with standards issued within their own countries, ISAs are useful in expanding those requirements in order to meet different needs in other countries where the audited information may also be used. The Institute of Internal Auditors (IIA) established the Internal Auditing Standards Board (IASB) to issue standards that pertain to attributes of internal audit activities, performance criteria, and implementation guidance. The Information Systems Audit and Control Association (ISACA) issues Information Systems Auditing Standards (ISASs) that provide guidelines for conducting the IT audit. These standards address audit issues unique to a company’s information systems environment, including control and security issues. MANAGEMENT ASSERTIONS AND AUDIT OBJECTIVES (STUDY OBJECTIVE 5) Management assertions are claims regarding the condition of the business organization in terms of its operations, financial results, and compliance with laws and regulations. The role of the auditors is to analyze the underlying facts to decide whether information provided by management is fairly presented. Auditors design audit tests to analyze information in order to determine whether management’s assertions are valid. To accomplish this, audit tests are created to address general audit objectives. Each audit objective relates to one of management’s assertions. The following diagram illustrates management assertions and the corresponding audit objective:
  • 13. 9 | P a g e Auditors must think about how the features of a company’s IT systems influence management’s assertions and the general audit objectives. These matters have a big impact on the choice of audit methodologies used. PHASES OF AN IT AUDIT (STUDY OBJECTIVE 6) There are four primary phases of the audit: • planning, • tests of controls, • substantive tests, and • audit completion/reporting Through each phase of an audit, evidence is accumulated as a basis for supporting the conclusions reached by the auditors. Audit evidence is proof of the fairness of financial information. The techniques used for gathering evidence include the following: • Physically examining or inspecting assets or supporting documentation • Obtaining written confirmation from an independent source • Reperforming tasks or recalculating information • Observing the underlying activities • Making inquiries of company personnel • Analyzing financial relationships and making comparisons to determine reasonableness
  • 14. 10 | P a g e During the planning phase of an audit, the auditor must gain a thorough under- standing of the company’s business and financial reporting systems. In doing so, auditors review and assess the risks and controls related to the business, establish materiality guidelines, and develop relevant tests addressing the assertions and objectives • tasks of assessing materiality and audit risk are very subjective and are therefore typically performed by experienced auditors • Determining materiality, auditors estimate the monetary amounts that are large enough to make a difference in decision making • Materiality estimates are then assigned to account balances so that auditors can decide how much evidence is needed • Below materiality limits are often considered insignificant • Some accounts with immaterial balances may still be audited, though, especially if they are considered areas of high risk • Risk- refers to the likelihood that errors or fraud may occur • Risk can be inherit or it may be caused by weak internal controls A big part of the audit planning process is the gathering of evidence about the company’s internal controls • Auditors typically gain an understanding of internal controls by interviewing key members of management and the IT staff • They observe policies and procedures and review IT user manuals and system flowcharts • They often prepare narratives or memos to summarize the results of their findings • Company personnel generally complete a questionnaire about the company’s accounting systems, including its IT implementation and operations, the types of hardware and software used, and control of computer resources • The understanding of internal controls provides the basis for designing appropriate audit tests to be used in the remaining phases of the audit In recognition of the fact that accounting records and files often exist in both paper and electronic form, auditing standards address the importance of understanding both the automated and manual procedures that make up an organization’s internal controls. In addition, many large and medium-size businesses are capturing an abundance of data. The availability of Big Data sets in auditing may complicate an auditor’s judgment. Yet auditors must always consider how misstatements may occur, including the following: • How data is captured and used • How standard journal entries are initiated, recorded, and processed • How nonstandard journal entries and adjusting entries are initiated, recorded, and processed IT auditors may be called upon to consider the effects of computer processing on the audit or to assist in testing those automated procedures.
  • 15. 11 | P a g e USE OF COMPUTERS IN AUDITS (STUDY OBJECTIVE 7) If the use of IT systems does not have a great impact on the conduct of the audit, since the auditor can perform audit testing in the same manner as would be done for a manual system the practice is referred to as auditing around the computer because it does not require evaluation of computer controls. • Auditing around the computer merely uses and tests output of the computer system in the same manner as the audit would be conducted if the information had been generated manually • Because this approach does not consider the effectiveness of computer controls, auditing around the computer has limited usefulness. Auditing through the computer involves directly testing the internal controls within the IT system, whereas auditing around the computer does not • sometimes referred to as “the white box approach,” because it requires auditors to understand the computer system logic • This approach requires auditors to evaluate IT controls and processing so that they can determine whether the information generated from the system is reliable • Auditing through the computer is necessary under the following conditions: o The auditor wants to test computer controls as a basis for evaluating risk and reducing the amount of substantive audit testing required. o The author is required to report on internal controls in connection with a financial statement audit of a public company. o Supporting documents are available only in electronic form. Auditors can use their own computer systems and audit software to help conduct the audit. This approach is known as auditing with the computer. • A variety of computer-assisted audit techniques (CAATs) are available for auditing with the computer • CAATs are useful audit tools because they make it possible for auditors to use computers to test more evidence in less time. TESTS OF CONTROLS (STUDY OBJECTIVE 8) The tests of controls involve audit procedures designed to evaluate both general controls and application controls. During audit planning, auditors must learn about the types of controls that exist within their client’s IT environment. Then they may test those controls to determine whether they are reliable as a means of reducing risk. Tests of controls are sometimes referred to as “compliance tests,” because they are designed to determine whether the controls are functioning in compliance with management’s intentions. GENERAL CONTROLS General controls MUST be tested before application controls. General controls are the automated controls that affect all computer applications. The reliability of application controls is considered only after general controls are deemed reliable.
  • 16. 12 | P a g e The effectiveness of general controls is the foundation for the IT control environment. If general controls are not functioning as designed, auditors will not devote attention to the testing of application controls; rather, they will reevaluate the audit approach with reduced reliance on controls. There are two broad categories of general controls that relate to IT systems: • IT administration and the related operating systems development and maintenance processes • Security controls and related access issues IT Administration Related audit tests include review for the existence and communication of company policies regarding the following important aspects of administrative control: • Personal accountability and segregation of incompatible responsibilities • Job descriptions and clear lines of authority • Computer security and virus protection • IT systems documentation Security Controls Auditors are concerned about whether a company’s computer system has controls in place to prevent unauthorized access to or destruction of information within the accounting information systems. Unauthorized access may occur internally when employees retrieve information that they should not have, or externally when unauthorized users (or hackers) outside the company retrieve information that they should not have. Access risks tend to escalate as companies embrace newer technologies and allow sensitive data to be shared via smart devices, Web and mobile applications, and social networks. Destruction of information may occur as a result of natural disasters, accidents, and other environ- mental conditions. Controls that protect the company from these risks include: • various access controls, • physical controls, • environmental controls, and • business continuity policies In order to test internal access controls, auditors should determine that the company has properly segregated IT duties or compensated for a lack of segregation by improving supervisory reviews. The company’s authority table should be tested to find out whether access to programs and data files is limited to authorized employees. Auditors should perform authenticity tests for valid use of the company’s computer system, according to the authority tables. In order to test external access controls, auditors may perform the following procedures: • Authenticity tests • Penetration tests
  • 17. 13 | P a g e • Vulnerability assessments • Review access logs to identify unauthorized users or failed access attempts Physical controls include: • locks, • security guards, • alarms, • cameras, and • card keys. Physical controls not only limit access to the company’s computers, but also are important for preventing damage to computer resources. In addition to assessing physical controls, auditors should evaluate the IT environment to determine that proper temperature control is maintained, fireproofing systems are installed, and an emergency power supply is in place. APPLICATION CONTROLS Application controls are computerized controls over application programs. Since any company may use many different computer programs in its day-to- day business, there may be many different types of application controls to con- sider in an audit. Input Controls Auditors perform tests to verify the correctness of information input to soft- ware programs. Auditors are concerned about whether errors are being pre- vented and detected during the input stage of data processing. Auditors observe controls that the company has in place and perform the comparisons on a limited basis to determine their effectiveness. These tests can be performed manually or by electronic methods. Processing Controls IT audit procedures typically include a combination of data accuracy tests, whereby the data processed by computer applications are reviewed for correct dollar amounts or other numerical values. For example, limit tests, described previously as an input control, can also be an effective processing control. Run-to-run totals involve the recalculation of amounts from one process to the next to determine whether data have been lost or altered during the process. Balancing tests involve a comparison of different items that are expected to have the same values, such as comparing two batches or comparing actual data against a predetermined control total. Mathematical accuracy tests verify whether system calculations are correct. Completeness tests and redundancy tests, introduced earlier, check for inclusion of the correct data. Benford’s Law, also known as the first-digit law, was named for a physicist, Frank Benford, who discovered a specific, but nonuniform pattern in the frequency of digits occur- ring as the first number in a list of numbers
  • 18. 14 | P a g e The test data method is an audit and control technique often used to test the processing accuracy of software applications. Test data are fictitious information developed by auditors and entered in the company’s application system. Test data are processed under the company’s normal operating conditions. The results of the test are compared with predicted results to deter- mine whether the application is functioning properly A slight variation of the test data method involves the auditor testing fictitious data, using a copy of the company’s application. The test data may be processed through the application on a different (nonclient) computer. Under these conditions, an auditor can also use another test data method, program tracing, whereby bits of actual data are followed through the application in order to verify the accuracy of its processing. Program mapping, on the other hand, counts the number of times each program statement is executed, so it can identify whether program code has been bypassed. An integrated test facility (ITF) may be used to test application controls without disrupting the client’s operations. Parallel simulation- is an audit technique that processes company data through a controlled program designed to resemble the company’s application Embedded audit module- involves placing special audit testing programs within the company’s operating system Output Controls Regardless of whether the results are printed or retained electronically, auditors may perform the following procedures to test application outputs: • Reasonableness tests compare the reports and other results with test data or other criteria. • Audit trail tests trace transactions through the application to ensure that the reporting is a correct reflection of the processing and inputs. • Rounding errors tests determine whether significant errors exist due to the way amounts are rounded and summarized. Reconciliation- a detailed report assessing the correctness of an account balance or transaction record that is consistent with supporting documentation and the company’s policies and procedures. At the conclusion of the controls testing phase of the audit, an auditor must determine the overall reliability of the client’s internal controls. Auditors strive to rely on internal controls as a way to reduce the amount of evidence needed in the remaining phases of the audit. They can be reasonably sure that information is accurate when it comes from a system that is proven to have strong controls. Therefore, once the general and application controls are tested and found to be effective, the amount of additional evidence needed in the next phase of the audit can be minimized TESTS OF TRANSACTIONS AND TESTS OF BALANCES (STUDY OBJECTIVE 9) Audit tests of the accuracy of monetary amounts of transactions and account balances are known as substantive testing • Substantive tests verify whether information is correct, whereas control tests determine whether the information is managed under a system that promotes correctness • Some level of substantive testing is required regardless of the results of control testing.
  • 19. 15 | P a g e • If weak internal controls exist or if important controls are missing, extensive substantive testing will be required. • If controls are found to be effective, the amount of substantive testing required is significantly lower, because there is less chance of error in the underlying records Most auditors use generalized audit software (GAS) or data analysis soft- ware (DAS) to perform audit tests on electronic data files taken from commonly used database systems. These computerized auditing tools make it possible for auditors to be much more efficient in performing routine audit tests such as the following: • Mathematical and statistical calculations • Data queries • Identification of missing items in a sequence • Stratification and comparison of data items • Selection of items of interest from the data files • Summarization of testing results into a useful format for decision making GAS and DAS are evolving to handle larger and more diverse data sets, which allow auditors to use more types of unstructured data evidence and to perform more creative analytical procedures and predictive analyses. AUDIT COMPLETION/REPORTING (STUDY OBJECTIVE 10) After the tests of controls and substantive audit tests have been completed, auditors evaluate all the evidence that has been accumulated and draw conclusions based on this evidence. This phase is the audit completion/reporting phase. The completion phase includes many tasks that are needed to wrap up the audit. For many types of audits, the most important task is obtaining a letter of representations from company management. The letter of representations is often considered the most significant single piece of audit evidence, because it is a signed acknowledgment of management’s responsibility for the reported information. In this letter, management must declare that it has provided complete and accurate information to its auditors during all phases of the audit. Four types of reports that are issued: 1. Unqualified opinion, which states that the auditors believe the financial statements are fairly and consistently presented in accordance with GAAP or IFRS 2. Qualified opinion, which identifies certain exceptions to an unqualified opinion 3. Adverse opinion, which notes that there are material misstatements presented 4. Disclaimer of opinion, which states that the auditors are unable to reach a conclusion. OTHER AUDIT CONSIDERATIONS (STUDY OBJECTIVE 11 ) DIFFERENT ITENVIRONMENTS Most companies use microcomputers or personal computers (PCs) in their accounting processes. General controls covering PCs are often less advanced than those covering the mainframe and client–server systems. Following are some audit techniques used to test controls specifically in the use of PCs:
  • 20. 16 | P a g e • Make sure that PCs and removable hard drives are locked in place to ensure physical security. In addition, programs and data files should be pass- word protected to prevent online misuse by unauthorized persons. • Make sure that computer programmers do not have access to systems operations, so that there is no opportunity to alter source code and the related operational data. Software programs loaded on PCs should not permit the users to make program changes. Also ascertain that computer-generated reports are regularly reviewed by management. • Compare dates and data included on backup files with live operating pro- grams in order to determine the frequency of backup procedures. • Verify the use of antivirus software and the frequency of virus scans In addition to, or as an alternative to using PCs, companies’ IT environments may involve networks, database management systems, e-commerce systems, cloud computing, and/or other forms of IT outsourcing. All of the risks and audit procedures that apply to a PC environment may also exist in networks, but the potential for loss is much greater. Since network operations typically involve a large number of computers, many users, and a high volume of data transfers, any lack of network controls could cause widespread damage. Auditors must apply tests over the entire network. It is especially important to test the software that manages the network and controls access to the servers. Security risks always exist in companies that use e-commerce, because their computer systems are linked online with the systems of their business partners. As a result, the reliability of a company’s IT system depends upon the reliability of its customers’ and/or suppliers’ systems. The audit procedures used to assess controls in e-commerce environments were addressed earlier in this chapter in the discussion on external access controls. In addition, auditors often • Inspect message logs to identify the points of remote access, verify proper sequencing of transactions, and review for timely follow up on unsuccessful transmissions between business partners • Verify that the company has evaluated the computer systems of its business partners prior to doing business over the Internet • Reprocess transactions to see whether they are controlled properly Some companies may rely on external, independent computer service providers to handle all or part of their IT needs. This is known as IT outsourcing. IT outsourcing creates a challenge for auditors, who must gain an adequate under- standing of risks and controls that are located at an independent service center. It is important for a company and its auditors to carefully consider whether all relevant risks have been identified and controlled. Below are some sample questions for auditors to consider when evaluating a cloud computing environment: Security Risks: • What damage could result if an unauthorized user accessed the company’s data? • How and when are data encrypted? • How does the cloud service provider handle internal security?
  • 21. 17 | P a g e Availability Risks: • What damage could result if the company’s data were unavailable during peak times or for an extended period? • How does the cloud service provider segregate information between clients? • What disaster recovery and business continuity plans are in place? Processing Risks: • How are response times and other aspects of operating performance monitored? • How does the service provider monitor its capacity for data storage and usage? • Is the service provider’s system flexible enough to accommodate the company’s anticipated growth? Compliance Risks: • What compliance standards does the cloud service provider meet? • What third-party assurance documentation is in place? • What additional documentation is available to help the company maintain compliance with applicable laws and regulations? CHANGES IN A CLIENT’S IT ENVIRONMENT When a company changes the type of hardware or software used or otherwise modifies its IT environment, its auditors must consider whether additional audit testing is needed. During its period of change, data may be taken from different systems at different times. As a result, auditors should consider applying tests of controls at multiple times throughout the period in order to determine the effectiveness of controls under each of the systems. Specific audit tests include verification of the following items: • An assessment of user needs • Proper authorization for new projects and program changes • An adequate feasibility study and cost–benefit analysis • Proper design documentation, including revisions for changes made via updates, replacements, or maintenance • Proper user instructions, including revisions for changes made via updated versions, replacements, or maintenance • Adequate testing before the system is put into use SAMPLING VERSUS POPULATION TESTING Auditors often rely on sampling, whereby they choose and test a limited number of items or transactions and then draw conclusions about the information as a whole on the basis of the results. Since many audit tests do not cover all items in the population, there is some risk that a sample, or subset, of the population may not represent the balance as a whole. Auditors try to use sampling so that a fair representation of the population is evaluated. As businesses evolve, they are more likely to possess Big Data sets, and auditors may transition from using sampling strategies toward population testing, where continuous auditing techniques are used to evaluate 100% of the population, often in real time.
  • 22. 18 | P a g e ETHICAL ISSUES RELATED TO AUDITING (STUDY OBJECTIVE 12) All types of auditors must follow guidelines promoting ethical conduct. For financial statement auditors, the PCAOB/AICPA has established a Code of Professional Conduct, commonly called its code of ethics. This code of ethics is made up of two sections, the principles and the rules. Six Principles of the code: 1. Responsibilities 2. The Public Interest 3. Integrity 4. Objectivity and Independence 5. Due Care 6. Scope and Nature of Services The Sarbanes–Oxley Act: • placed restrictions on auditors by prohibiting certain types of services historically performed by auditors for their clients • increased management’s responsibilities regarding the fair presentation of the financial statements • requires public companies to have an audit committee as a subcommittee of the board of directors • requires top management to verify in writing that the financial statements are fairly stated and that the company has adequate internal controls over financial reporting In fulfilling their ethical responsibilities, auditors must practice professional skepticism during the audit. Professional skepticism means that the auditors should not automatically assume that their clients are honest, but must have a questioning mind and a persistent approach to evaluating evidence for possible misstatements. It is important for auditors to consider the conditions under which fraud could be committed, including the possible pressures, opportunities, and rationalization for committing dishonest acts. In the context of a client’s IT systems, audi- tors should also think about the possibility that computer programs could be altered to report information in a manner that is favorable for the company. Accountants are sometimes called upon to perform a specialized type of assurance service called forensic auditing. Forensic auditing is designed specifically for finding and preventing fraud and is used for companies where fraud is known or believed to exist. Some accountants who work on forensic audits become certified fraud examiners (CFEs) and are considered experts in the detection of fraud. Some CFEs specialize in computer forensics, which involves the detection of abuses within computer systems. IT auditors may play an instrumental role in gathering and analyzing data needed to perform or assist in a forensic audit.
  • 23. 19 | P a g e CHAPTER SUMMARY ➢ Introduction to Auditing IT Processes. Most businesses rely upon computerized systems to assist in the accounting function. Advancements in technology have brought huge increases in the amount of information that is readily available for decision-makers. Accountants play an important role in the business world because they are called upon to improve the quality of information. Accountants provide assurance services, which help to verify the accuracy and completeness of financial information, thereby improving the quality and lending credibility to this information. An audit is the most common type of assurance service. ➢ Types of Audits and Auditors. The main purpose of an audit is to assure users of financial information about the accuracy and completeness of the information by evaluating evidence supporting the underlying procedures, transactions, and/or account balances. This evidence is compared to established criteria. There are three primary types of audits, including (1) compliance audits, (2) operational audits, and (3) financial statement audits. Although each type of audit involves an investigation of supporting evidence, each type has a different objective. ○ Compliance audits determine whether the client has complied with regulations and policies established by contractual agreements, governmental agencies, company management, or other high authority. ○ Operational audits assess operating policies and procedures for efficiency and effectiveness. ○ Financial statement audits determine whether the company has prepared and presented its financial statements fairly, and in accordance with generally-accepted accounting principles (GAAP) or some other financial accounting criteria. Internal auditors, IT auditors, and governmental auditors typically conduct compliance audits and operational audits. Certified public accountants (CPAs) may conduct any type of audit, but CPA firms tend to concentrate on financial statement audits and other financial assurance services. It is important that CPAs be independent, or objective and neutral, with respect to their audit clients and the financial information being audited. Because many companies use sophisticated IT accounting systems to support their financial statements, it is increasingly important for auditors to understand the impact of information technology on their clients’ accounting systems and internal controls. The IT environment plays a key role in how auditors conduct their work related to the consideration of risk in the audit, understanding the underlying systems, and the related design and performance of audit tests. ➢ Information Risk and IT-Enhanced Internal Control. Information risk is the chance that information used by decision-makers may be inaccurate. Information risk may be caused by: • The remoteness of information, or the extent to which the source of the information is removed from the decision-maker. • The volume and complexity of the underlying data. • The motive, goals, or viewpoint of the preparer of the information. The most common way to reduce information risk is to rely upon information that has been audited by an independent party. This is why a chapter on information-based processing and the related audit function is included in the study of accounting information systems. IT-based processes generally provide high quality information to management, which aids in effective decision- making. Information is high quality when it is provided in a timely manner and administered effectively. IT systems are also advantageous because they often include computerized controls to enhance the company’s internal controls, and they eliminate the risk of human errors such as mathematical or classification mistakes. On the other
  • 24. 20 | P a g e hand, IT systems present various risks, including loss of audit trail visibility, lost/destroyed data, system failures, and unauthorized access. ➢ Authoritative Literature Used in Auditing. The work of an auditor must be conducted in accordance with several sources of authoritative literature, including: ○ Generally accepted auditing standards (GAAS), which are broad guidelines for an auditor’s professional responsibilities in the areas of general qualifications and conduct (general standards), performance of the audit (standards of fieldwork), and written communication of results (standards of reporting). Exhibit 7-1 presents the ten generally accepted auditing standards. ○ The Public Company Accounting Oversight Board (PCAOB) establishes auditing standards (AS) for public companies. Prior to the PCAOB, accounting standards were established by the Auditing Standards Board (ASB) of the American Institute of CPAs (AICPA) through the issuance of Statements on Auditing Standards (SASs). The ASB is still serves as the standard-setting body for non-public companies. ○ The International Auditing and Assurance Standards Board (IAASB) issues international standards on auditing (ISAs) and contributes to the uniform application of auditing practices on a worldwide basis. ○ The International Internal Auditing Standards Board (IASB) to issue standards that pertain to attributes of internal audit activities, performance criteria, and implementation guidance. ○ The Information Systems Audit and Control Association (ISACA) issues information systems auditing standards (ISASs) that address control and security issues and provide relevant guidelines for conducting and IT audit. Although SASs, ISAs, and ISASs each provide detailed guidance that supports GAAS, they still do not furnish auditors with detailed directions regarding the types of audit tests to use and the manner in which conclusions should be drawn. Industry guidelines and other resources such as CPA firm’s own policies and procedures are needed for such specific guidelines. ➢ Management Assertions and Audit Objectives. Management assertions are claims regarding the financial condition of the business organization and its results of in terms of its operations, financial results, and compliance with applicable laws and regulations. Management assertions relate to existence/occurrence, valuation and allocation, accuracy, classification, cutoff, completeness, rights and obligations, and presentation and disclosure. These assertions and related audit objectives are presented in Exhibit 7-2. Auditors recognize that management of the company is primarily responsible for the preparation and presentation of the financial statements. Accordingly, auditors analyze information supporting the financial statements in order to determine whether management’s assertions are valid. Audit tests should be documented in an audit program and should be uniquely developed for each audit client to address management’s assertions. ➢ Phases of an IT Audit. Exhibit 7-4 provides an overview of the four primary phases of the audit: planning, tests of controls, substantive tests, and audit completion/reporting. Through each phase of the audit, evidence is accumulated as a basis for supporting the conclusions reached by the auditors. Auditors use combinations of various techniques to collect evidence, including physically examining and inspecting assets or supporting documentation, obtaining written confirmation from an independent source, rechecking or recalculating information, observing activities, making inquiries of client personnel, and analyzing financial relationships and trends. o Audit Planning. Auditors must gain a thorough understanding of the company’s business and financial reporting systems during the planning phase of the audit. In doing so, auditors review and assess the risks and controls related to the business, establish materiality guidelines, and develop relevant tests addressing the objectives. Risk assessment involves careful consideration of the likelihood that errors or fraud may occur. Risk may be
  • 25. 21 | P a g e inherent in the business or it may be caused by weak internal controls. Accordingly, a big part of the audit planning process involves gaining an understanding of internal controls. In determining materiality, auditors estimate the monetary amounts that are large enough to make a difference in decision making. Materiality estimates are then assigned to account balances so that auditors can decide how much evidence in needed in the testing phases of the audit. If the company has adopted IFRS or is in the process of convergence, changes in the audit approach should be anticipated. ➢ Use of Computers in Audits. The audit planning tasks of evaluating internal controls and designing meaningful audit tests is more complex for automated accounting systems than for manual systems. In recognition of the fact that accounting records and files often exists in both paper and electronic form, auditing standards address the importance of understanding both the automated and manual procedures that make up an organization’s internal control. Misstatements may occur through the data entry and processing functions of the system. Auditors must consider the effects of such computer processing on the audit. Three options may exist for the auditor in deciding upon a testing approach for a client’s automated process, including auditing around the computer, auditing through the computer, and auditing with the computer. • Auditing around the computer is commonly known as the “black box” approach because auditors are not required to gain detailed knowledge about the company’s computer system; rather, documents used to input data into the system can be compared with reports generated from the system. Computer controls are not considered. • Auditing through the computer is commonly known as the “white box” approach because it involves directly testing the internal controls within the IT system. It requires the auditors to understand the computer system logic and related IT controls. Auditing through the computer is necessary when the auditor wants to test computer controls as a basis for reducing the amount of substantive testing required, when the auditor is required to report on internal controls of a public company, and when supporting documents are available only in electronic form. • Auditing with the computer involves the auditors’ use of their own computer systems and audit software to perform audit testing. A variety of computer assisted audit techniques (CAATs) are available for auditing with the computer. ➢ Tests of Controls. After auditors have learned about the types of controls that exist within their client’s IT environment, they may then test those controls to determine whether they are reliable as a means of reducing risk. Test of controls are sometimes referred to as “compliance tests”, because they are designed to determine whether the controls are functioning in compliance with management’s intentions. Both general controls and application controls must be considered. General Controls. The effectiveness of general controls is the foundation of the IT control environment because general controls affect all computer applications. If general controls are not functioning as designed, auditors will not devote attention to the testing of application controls; rather, they will reevaluate the audit approach with reduced reliance on controls. There are two broad categories of general controls that relate to IT systems: IT administration and the related operating systems development and maintenance processes, and security controls and related access issues. • IT administration. IT departments should be organized so that an effective and efficient workplace is created and supported. The important aspects of administrative control include personal accountability and segregation of incompatible responsibilities, job descriptions and clear lines of authority, computer security
  • 26. 22 | P a g e and virus protection, and thorough documentation about the internal logic of computer systems and surrounding controls. • Security controls. Auditors must be concerned about whether a company’s computer system has controls in place to prevent unauthorized access that may result in the destruction or alteration of information within the accounting information systems. Unauthorized access may be from an internal or external source, and can be controlled internally through the use of various access controls, including authenticity tests, passwords and security tokens, and other techniques that were described in Chapter 4. External access controls may include authenticity tests, penetration tests, vulnerability assessments, and monitoring of access logs and other security reports. Physical controls such as locks, security alarms, etc. are also used to protect and limit access to a company’s computer resources. In addition, a disaster recovery plan, backup procedures, virus protection, and adequate insurance coverage should all be in place in order to protect the company’s computer systems and data. Application Controls. Since companies tend to use many different computer programs in their day-to-day business, there may be different types of application controls to consider in an audit. However, application controls are considered only if general controls have already been tested and found to be operating effectively. It would not be worthwhile to test application controls if the auditor already knew that the underlying general controls were weak. The three main functions of computer applications include input, processing, and output. Each of these functions should be tested by the auditor. • Auditors are concerned about whether errors are being prevented or detected during the input of data into a computerized system. The most widely used tests of input controls include financial totals, hash totals, completeness or redundancy tests, limit tests, validation checks, and field checks. Companies may implement these tests as internal control measures, and auditors may perform the same type of test to determine their effectiveness. • Data accuracy tests are typically performed to evaluate the processing integrity of a company’s computer systems. Limit tests, balancing tests, run-to-run totals, mathematical accuracy tests, and completeness or redundancy tests can each be performed to test for the possibility of lost, altered, or unprocessed data. When evaluating financial information, auditors can often use Benford’s Law to help discover whether errors or fraud may exist in a data set. Benford’s Law applies to large data sets of naturally-occurring numbers, and is therefore useful to auditors in evaluating possible errors or fraud in sales and accounts receivable balances, accounts payable and disbursements balances, income tax data, and more. Audit procedures that apply Benford’s Law can be carried out using spreadsheet programs or special applications of audit software. Exhibit 7-8 presents a comparison of several CAATs for testing applications controls, including the test data method, program tracing, an integrated test facility, parallel simulation, and embedded audit modules. • Audit tests that evaluate general controls over access and backup procedures may also be used in the testing of specific computer application outputs. Regardless of whether the outputs are printed or retained electronically, auditors may perform reasonableness tests, audit trail tests, and/or rounding errors tests to verify the accuracy of system outputs. At the conclusion of the controls testing phase of the audit, auditors must determine the overall reliability of the company’s internal controls. Auditors may rely on internal controls as a way to reduce the amount of evidence needed in the remaining phases of the audit. They can be reasonably sure that financial information is accurate when it comes from a system that is proven to have strong controls.
  • 27. 23 | P a g e ➢ Tests of Transactions and Tests of Balances. When auditors test the accuracy of monetary amounts of transactions and account balances, this is known as substantive testing. Substantive testing therefore determines whether financial information is accurate, whereas control tests determine whether the financial information is managed under a system that promotes accuracy. Some level of substantive testing is required on all financial statement audits, however, the results of the tests of controls will determine the extent of substantive testing. There is an inverse relationship between the two: the stronger the internal controls, the less substantive testing is required, and vice versa. Some testing strategies used to test controls can also be used to perform substantive testing. For instance, parallel simulations, the test data method, the embedded audit module, and the integrated test facility can be used for both controls and substantive testing. Recent trends such as advances in automated controls, new compliance requirements, integration of governance, risk management, and compliance (GRC) activities, and real-time financial reporting have created the need for continuous auditing. Continuous auditing, or continuous monitoring, is a process of constant evidence gathering and analysis to provide assurance on the information as soon as it occurs or shortly thereafter. Continuous monitoring of internal controls is important so that control deficiencies can be detected before they become significant. The SEC, PCAOB, and AICPA also approve of the use of continuous auditing. Continuous auditing helps auditors stay involved in their client’s business and perform audit testing in a more thorough manner. This requires that the auditors have online access to the company’s systems so that data can be obtained on an ongoing basis. Then the data are downloaded and tested by auditors within a very short timeframe. Most CPA firms used generalized audit software (GAS) or data analysis software (DAS) to perform audit tests on electronic files taken from commonly used database systems. These computerized audit tools assist auditors in the performance of mathematical and statistical computations, data queries, identification of missing information in a sequence, stratification and comparison of data items, selection of items of interest from the data files, and summarization of testing results into a useful format for decision-making. ➢ Audit Completion/Reporting. The final phase of the audit involves overall evidence accumulation and drawing final conclusions. The auditors must determine whether the financial statements are presented fairly and whether all of the evidence supports the financial information presented. The auditors must also consider whether the extent of testing has been adequate in light of the risks and controls identified during the planning phase versus the results of procedures performed in the testing phases. A letter of representation must be obtained during the final phase of the audit. This is often considered the single most important piece of audit evidence because it includes management’s acknowledgment of responsibility for the fair presentation of the financial statements. Auditors have four choices from which to select a report that communicates the final conclusions of the audit. The four types of reports include an unqualified opinion, which states that the financial statements are fairly stated; a qualified opinion, which sets forth limited exceptions; an adverse opinion, which warns that the financial statements are not fairly stated; or a disclaimer, which explains that an opinion cannot be formed. When reporting on the effectiveness of internal controls, auditors must choose between an unqualified, adverse, or disclaimer opinion. ➢ Other Audit Considerations. o Different IT Environments. Auditors are responsible for understanding how information is managed so that it is reliable. A company’s computer systems may include mainframe and client-server systems, microcomputers and
  • 28. 24 | P a g e personal computers (PCs), networks, database management systems, and/or e-commerce systems. PCs may face a greater risk of loss and therefore require strong controls such as locked hard drives, password protection, separation of operating and programming functions, backup procedures, and virus protection. All of the risks and audit procedures that apply to PCs are also likely to exist in networks, but the potential for loss is much greater because of the larger number of computers, users, and information involved in network operations. For database operations, it is especially important that a database administrator monitors access to the company’s data on a regular basis. In addition, since many users and many applications will share information in the database, the data must be organized and controlled consistently. Finally, companies that use e-commerce depend upon the reliability of other companies’ systems; external access controls are critical in such systems. An increasing number of companies use IT outsourcing, which places reliance upon an external, independent computer service center to handle all or part of the IT needs. Auditors must still gain an understanding of the internal controls surrounding such computer applications, which can be accomplished by testing controls at the service center or by testing around the computer. When companies use cloud computing, their auditors need to thoroughly understand the underlying technologies and related risks and controls. In addition to merely identifying the threats inherent in a cloud computing environment, it is particularly difficult to estimate their potential costs and overall impact. Exhibit 7- 11 presents the general areas of risk assessment that should be addressed by auditors, and some sample questions for each area. Useful guidance in conducting audit procedures for cloud computing is available from ISACA’s IT Assurance Framework, the International Organization for Standardization (ISO) user guides, and the AICPA’s Service Organization Controls (SOC) Framework. Auditors can perform their own testing, or they can rely upon SOC reports from a service provider’s auditors. The SOC 1 report addresses internal controls over financial reporting. A SOC 1 Type I report contains management’s assessment and the auditor’s opinion on the operating design of internal controls over financial reporting. A SOC 1 Type II report is an extension of the Type I report in that it also evaluates the operating effectiveness of those internal controls. A SOC 2 report considers controls over compliance and operations, including the Trust Services Principles of security, availability, processing integrity, confidentiality, and privacy of a service provider’s systems. Similar to the SOC 1 reports, the SOC 2 reporting options also allow for a Type I or Type II conclusion depending upon whether the auditor considers suitability of design or operating effectiveness of those controls, respectively. Finally, a SOC 3 report is an unaudited report that is available to the general public containing a CPA firm’s conclusion on the elements of the Trust Services Principles. o Changes in a Client’s IT Environment. When a company changes the type of hardware or software used or otherwise modifies its IT environment, auditors should consider applying tests of controls at multiple times throughout the period in order to determine the effectiveness of controls under each of the systems. Auditors must evaluate a client’s procedures for developing, implementing, and maintaining new systems or changes in existing systems. o Sampling versus Population Testing. Auditors must rely on sampling to test a limited number of items and then use these limited tests to draw conclusions about the overall control effectiveness and accuracy of transactions and account balances. There is always some risk that a sample may not represent the population as a whole. The rise in Big Data and increased use of continuous auditing techniques has led to auditors increasingly testing 100% of a population.
  • 29. 25 | P a g e ➢ Ethical Issues Related To Auditing. The AICPA has established a Code of Professional Conduct to provide the foundation for ethical behavior expected of CPAs. The six principles of the Code include: • Responsibilities • The Public Interest • Integrity • Objectivity and Independence • Due Care • Scope and Nature of Services It is most important that auditors maintain objectivity and independence with respect to their client companies. Accordingly, they should not become too friendly with their clients or develop any financial relationships with them that could create bias. Internal auditors and IT auditors must abide by ethical standards established by the IIA and ISACA, respectively. The IIA Code of Ethics is founded on the principles of integrity, objectivity, confidentiality, and competency. Similarly, ISACA’s Code of Professional Ethics recognizes due diligence, objectivity, competency, communication, maintaining privacy and confidentiality, and serving in the interests of stakeholders. The Sarbanes-Oxley Act places restrictions on auditors by limiting the types of services they can provide for their audit clients. This is intended to promote objectivity in the conduct of their work by prohibiting the types of services that involve accounting work that is subject to an audit and other services that put auditors in a role of managerial decision making. The Sarbanes-Oxley Act also increased public companies’ responsibilities regarding the fair presentation of financial statements by requiring the following: • reporting on the effectiveness of internal controls. • management’s written verification of the fair presentation of the financial statements. • establishment of an audit committee to promote independence of the audit function. In fulfilling their ethical responsibilities, auditors must practice professional skepticism, which means that they should maintain a questioning attitude and persistent approach to evaluating evidence. This is important in order to increase the chances of detecting fraud, which may be especially difficult to find if perpetrated by managers who can override internal controls. Forensic audit testing performed by certified fraud examiners (CFEs) may be used in cases where fraud is suspected or is known to exist. Also in practicing professional skepticism, auditors should be careful about balancing the mix of audit procedures between tests of controls and substantive tests. Emphasis on computer processes and internal controls may lead to an over-reliance on the accounting system, which could be circumvented by management. Therefore, it is important to also perform substantive procedures that focus on the actual transactions and account balances that make up the financial statements. Accountants are sometimes called upon to perform a specialized type of assurance service called forensic auditing. Forensic auditing involves audit testing specifically for finding and preventing fraud, and is used for companies where fraud is known or believed to exist.
  • 30. Other documents randomly have different content
  • 31. Im Jahre 1900 wurden in Deutschland insgesamt 149000 t gefördert. Würde die durchschnittliche Teufe, aus der diese Kohlen gefördert werden, 500 m betragen haben, so würde unter Annahme von 6000 Förderstunden im Jahre hierzu dies einer Arbeitsleistung entsprechen von 149788000000 kg × 500 m 6000 Std. × 3600 Sek. × 75 = 46250 PS. Unter Voraussetzung von täglich 8 Arbeitsstunden würden für diese Leistung rd. 150000 Pferde oder rd. 1500000 Menschen, also rd. ein Vierzigstel der Gesamtbevölkerung Deutschlands erforderlich gewesen sein.
  • 32. B. Die Hebemaschinen im Hüttenwerk. ie ersten Kulturstufen der Menschheit wurden nach dem Material, dessen Bearbeitung man damals verstand, als Steinzeit, Bronzezeit und Eisenzeit bezeichnet, weil sinnfällig mit dem vollkommenen Material auch die Kulturstufe eine höhere wurde. Im Grunde genommen gilt für das 19. Jahrhundert das Gleiche, wenn auch nur wenige sich dessen bewußt sind. Man könnte unbedenklich dieses Jahrhundert als das Zeitalter der Kohle und des Stahls bezeichnen; denn die Kohle bot dem 19. Jahrhundert die für seine Entwickelung kennzeichnende Maschinenkraft, und der Stahl bildete den unentbehrlichen Baustoff für die Maschinen, Eisenbahnen, Brücken, Dampfschiffe, Waffen und Werkzeuge dieses Jahrhunderts. Zu Anfang des 19. Jahrhunderts unterschied sich die Gewinnung des Eisens noch wenig von dem Verfahren der Zeit um 1500: Hochöfen von geringen Abmessungen und primitivster Ausrüstung erzeugten das Roheisen; die Stahlbereitung besorgten zum größten Teil noch Herdfrischen, die nur mit kostspieligen Holzkohlen
  • 33. betrieben werden können; die Stahlerzeugung mit Steinkohlen in Puddelöfen wurde erst 1784 von Henry Cort erfunden. Für die Bearbeitung des schmiedbaren Eisens stand nur der einfache, vom Wasserrad getriebene Schwanzhammer zur Verfügung. Die sonstigen maschinentechnischen Hilfsmittel beschränkten sich auf Blasebälge und primitive Zylindergebläse, die ebenfalls durch Wasserräder betrieben wurden; die Hebemaschinen der damaligen Zeit bestanden aus Gichtaufzügen und aus Drehkranen allereinfachster Art. Im 19. Jahrhundert tritt eine vollständige Umwandlung der Eisenerzeugung ein; der Hochofen nimmt in seinen Abmessungen fortwährend zu und wird vollkommener ausgerüstet; die Stahlerzeugung erhält durch die Einführung des Flußstahls an Stelle des Schweißstahls eine ungeahnte Ausdehnung; an Stelle des Schwanzhammers tritt das Walzwerk. Eine Fülle der verschiedenartigsten Hebemaschinen wird geschaffen, die allen Besonderheiten des Hüttenbetriebes angepaßt sind. All das zusammen führt zu einer gewaltigen Entwicklung der Eisenerzeugung, die in nachstehenden Zahlen ihren Ausdruck findet: Roheisenerzeugung der Erde Roheisenerzeugung Deutschlands Anteil Deutschlands im Jahre 1807 760000 t 25000 t 1⁄30 im Jahre 1899 40611000 t 9521000 t 1⁄5 Während also die Roheisenerzeugung der Erde im 19. Jahrhundert auf das 50fache gestiegen ist, ist in derselben Zeit der Anteil Deutschlands auf das mehr als 300fache gewachsen: die glänzende wirtschaftliche Entwicklung Deutschlands in diesem Jahrhundert findet in diesen Zahlen einen beredten Ausdruck. Die Bedeutung des Eisens für den Volkshaushalt ergibt sich aus der Tatsache, daß der Verbrauch an Eisen auf den Kopf der Bevölkerung in Deutschland im Jahre 1861 25 kg im Jahre 1900 132 kg
  • 34. betragen hat. Mit dieser Ausdehnung der Eisenerzeugung geht eine Entwickelung ihrer Hebemaschinen Hand in Hand, die so vielgestaltig ist, daß eine Gliederung, entsprechend den einzelnen Stufen der Eisenerzeugung — Hochofen — Stahlwerk — Walzwerk — Verladung — erforderlich ist.
  • 35. a) Die Hebemaschinen des Hochofens. Aus der Zeit von 1500 bis 1800 sind uns keine Nachrichten über die damals gebräuchlichen Hilfsmittel bekannt. Da die Hochöfen jener Zeit in Gebirgsgegenden lagen, so bot sich als einfachstes Mittel die Anlage des Hochofens an einem Berghang, so daß die Erze aus dem Stollen über eine Brücke unmittelbar zur Gicht gefahren werden konnten, wie es heute noch bei Kalköfen gebräuchlich ist. 1. 1803 bis 1900: Antrieb durch Druckluft und Dampf. Das Bild der St. Antonihütte — dem Anfang der heutigen Gutehoffnungshütte — aus dem Jahre 1835 (Fig. 44, entnommen aus Frölich »Die Werke der Gutehoffnungshütte«) zeigt uns die typische Erscheinung eines Hochofens aus dem Anfang des 19. Jahrhunderts. Die Abmessungen sind sehr bescheidene, die Höhe des Hochofens beträgt etwa 10 m. Aus dem Bild ist ersichtlich, daß der Ofen mit einem Gichtaufzug ausgerüstet ist.
  • 36. Fig. 44. Es lag nahe, für den Betrieb der Gichtaufzüge die stets vorhandene Gebläseluft zu benutzen. Fig. 45 (entnommen aus Hülße »Enzyklopädie« 1. Bd.) stellt einen derartigen mit Luftdruck betriebenen Gichtaufzug dar, der zu Chatlinot im Jahre 1839 in Betrieb war und in den Einzelheiten bereits eine gute Durchbildung erkennen läßt. Diese Druckluftaufzüge fanden sowohl in Europa wie in den Vereinigten Staaten große Verbreitung. Sie waren sehr leistungsfähig, ließen aber hinsichtlich der Betriebskosten und der Betriebssicherheit zu wünschen übrig. Als die Dampfmaschine in ihrer Steuerfähigkeit hinreichend durchgebildet war, um für schnellgehende Gichtaufzüge die erforderliche Sicherheit zu bieten, trat sie allenthalben an Stelle der Druckluftaufzüge, denen sie an Leistungsfähigkeit gleichkam, an Betriebssicherheit und Wirtschaftlichkeit überlegen war.
  • 37. Mit der zunehmenden Höhe der Hochöfen — die bis zu 40 m stieg — nahm auch die Hubgeschwindigkeit der Gichtaufzüge zu, bis zu 2 sekm. Eine weitere Steigerung der Geschwindigkeit würde die Leistungsfähigkeit so verschwindend wenig steigern, daß sie zwecklos wäre. Dagegen trat bald das Bedürfnis nach einer Vervollkommnung in anderer Hinsicht auf. Die einfachen Gichtaufzüge förderten lediglich die gefüllten Beschickungswagen bis an die Gicht, während das Abziehen der Wagen von dem Aufzuggerippe bis an die Gicht und das Entleeren der Wagen von Hand geschehen mußte. Diese Arbeit erforderte eine beträchtliche Zahl von Arbeitskräften und war wegen der ausströmenden Gichtgase zudem mit Gefahr verbunden. In den Vereinigten Staaten machte sich zuerst das Bestreben geltend, die Gichtaufzüge so zu gestalten, daß die Beschickungswagen selbsttätig in die Gicht entleert werden, so daß auf der Gicht keinerlei Bedienungsmannschaft gebraucht wird. Gleichzeitig ging man dazu über, die Dampfmaschine des Aufzuges durch den steuerfähigeren und sparsameren Elektromotor zu ersetzen.
  • 39. 2. Von 1900 an: Elektrischer Betrieb. Fig. 46 und 47 stellen einen sogenannten Schrägaufzug nach amerikanischer Bauart vor. Die Schräglage des Aufzuggerüstes gewährt den Vorteil, daß der Beschickungswagen unmittelbar über die Gicht gelangt. Durch geeignete Gestaltung der Führungsschienen ist dafür gesorgt, daß der Wagen umkippt, sobald er in seine höchste Stellung gelangt ist. Neuerdings hat man zu weiterer Vereinfachung der Bedienung den Aufzug so gestaltet, daß in dem Augenblick des Umkippens gleichzeitig der Gichtverschluß selbsttätig geöffnet wird, so daß eine besondere Steuerung des letzteren nicht erforderlich ist. Fig. 48 zeigt eine derartige Ausführung der Firma Pohlig in Köln. Die Schräglage des Aufzuges ist nicht unbedingt erforderlich; sie kann ersetzt werden durch ein Gerüst, welches vom Boden an zunächst lotrecht aufsteigt und dann in schlanker Krümmung über die Gicht führt. Diese Anordnung gewährt den Vorteil, daß sie eine geringere Grundfläche benötigt als der Schrägaufzug.
  • 41. Fig. 47. Der erzielte Fortschritt ergibt sich aus folgenden Vergleichswerten: Druckluftaufzug mit Entleerung von Hand 1839 Elektrischer Schräg- aufzug mit selbst- tätiger Entleerung 1900 Hubhöhe 12 m 40 m Nutzlast 200 kg 4000 kg Hubgeschwindigkeit 1 sekm 1 sekm Leistung, am Seil gemessen 3 PS 50 PS Stündliche Förderung 2 t 80 t Bedienungsmannschaft 7 Mann 3 Mann Stündlich erzeugtes Roheisen 0,4 t 40 t Verkaufspreis von 1 t Roheisen 160 M. 60 M.
  • 42. b) Die Hebemaschinen des Stahlwerks. Aus der Zeit von 1500 bis 1800 ist wenig zu berichten, weil die Stahlerzeugung damals auf das Verfahren des Herdfrischens sich beschränkte, das nur sehr kleine Mengen lieferte und darum Transportmittel für schwere Lasten nicht erforderte. Es lag einzig und allein die Aufgabe vor, die Deckel der Triebherde abzuheben. Da hiefür nur eine ganz kleine Geschwindigkeit notwendig war, so genügte ein Drehkran mit Handbetrieb vollständig für diesen Zweck.
  • 43. Fig. 48. Das schon genannte Werk von Agricola aus der Zeit um 1550 überliefert uns eine deutliche Darstellung eines Drehkrans Fig. 49. Der Kran ist mit Fuß- und Halszapfen auf dem Boden und an der Decke der Gießhalle gelagert. Gegenüber älteren Ausführungen zeigt er zum erstenmal die Anordnung einer verschiebbaren Laufkatze auf dem Ausleger. Die Verschiebung der Laufkatze kann jedoch nur vor dem Anheben der Last vorgenommen werden; solange der Kran arbeitet, ist die Laufkatze durch eine Sperrklinke festgestellt. Das Gerüst des Krans ist vollständig aus Holz unter sparsamer Verwendung von schmiedeeisernen Bändern zusammengefügt; die
  • 44. Triebwerkswellen sind aus Vierkanteisen, die Stirnräder aus Holz hergestellt. Fig. 49. Die hier dargestellte Anordnung wurde in den folgenden drei Jahrzehnten für Gießereien eine so typische, daß diese Kranform geradezu als Gießkran bezeichnet wurde. Fig. 50 zeigt einen Kran, der im Jahre 1827 in der Gießerei der Herren Manby und Wilson zu Charenton in Betrieb war (entnommen aus Dinglers Journal 1827, Bd. 23, Taf. 6). Er zeigt im wesentlichen den gleichen Aufbau wie der Kran von Agricola, nur ist das Krangerüst nicht aus Holz sondern aus Gußeisen hergestellt. Er verfügt bereits über eine Tragkraft von 6 t bei einer größten Ausladung von 6,5 m. Ein wesentlicher Fortschritt ist darin zu finden, daß die Laufkatze bei angehängter Last verschoben werden kann,
  • 45. was dadurch erreicht wurde, daß das feste Ende der Lastkette nicht an der Laufkatze, sondern am äußeren Ende des Auslegers befestigt wurde. Die Verschiebung wurde durch Zahnstange und Haspelrad bewirkt. Fig. 50. Neben derartigen Gußeisenkonstruktionen wurden auch noch hölzerne Krangerüste mit gußeisernen Verbindungsstücken bis über die Mitte des 19. Jahrhunderts hinaus ausgeführt. Im letzten Drittel des Jahrhunderts trat Walzeisen an die Stelle von Gußeisen und Holz; die typische Gestalt des Gießereidrehkrans wurde aber immer
  • 46. noch beibehalten, bis schließlich der elektrische Betrieb dem Laufkran die Überlegenheit verschaffte.
  • 47. 1. 1840 bis 1900: Antrieb durch Druckwasser. Die im Jahre 1784 durch Cort erfundene Stahlerzeugung durch das Puddelverfahren erforderte keine maschinentechnischen Hilfsmittel, führte daher auch zu keiner weiteren Entwickelung dieser Mittel. Eine großzügige Gestaltung erhielt die Stahlerzeugung erst durch das Verfahren von Bessemer, das von diesem im Jahre 1855 erfunden wurde, und das nach Einführung der basischen Auskleidung durch Thomas und Gilchist im Jahre 1878 auch in Deutschland sich allgemein einbürgerte. Die Anforderungen, welche das Bessemerverfahren an die Transportmittel stellt, werden sofort erkennbar, wenn man die Anordnung eines Bessemerwerks sich vor Augen hält. Fig. 51 (entnommen aus Frölich S. 25) stellt einen Schnitt durch das Bessemerwerk der Gutenhoffnungshütte dar. Man erblickt rechts die drehbare Birne, die ausgezogen in der Blasstellung, gestrichelt in der Gießstellung gezeichnet ist. Die Zufuhr des flüssigen Roheisens zur Birne wird durch fahrbare Gießkübel auf dem Geleis der Roheisenbühne bewirkt. In der Mitte der Halle ist das Geleis für den Gießkran angeordnet, in dessen Kübel die Birne nach Beendigung des Prozesses den flüssigen Stahl ausgießt. Unbedingtes Erfordernis für die erfolgreiche Durchführung des Verfahrens sind rasch arbeitende und betriebssichere Gießkrane. Die Stahlwerks-Gießkrane haben mannigfache Wandlungen durchgemacht; ihre Gestaltung war maßgebend für die Anordnung des Stahlwerks.
  • 48. Fig. 51. Neben schneller und sicherer Bewegung des Gießkübels in lotrechter und wagrechter Richtung sind größte Einfachheit und Unempfindlichkeit gegen Staub unerläßliche Betriebsbedingungen für Gießkrane. Der Dampfbetrieb mit seinen mehrfachen Getrieben und seiner umständlichen Bedienung ist für diesen Zweck kaum geeignet. Um so mehr kam der einfache und sichere Druckwasserantrieb den Anforderungen des Stahlwerkbetriebs entgegen. Den Vorläufer des Druckwasserkrans bildet die hydraulische Presse, die von Bramah im Jahre 1796 erfunden wurde. Aus dem Jahre 1826 liegt eine Veröffentlichung vor, aus welcher hervorgeht, daß Bramah bereits einen Kran mit Druckwasserantrieb konstruiert hat, wenn auch zunächst in einer Form, die dem gewöhnlichen Handantrieb gegenüber kaum einen Vorteil bot. Fig. 52 (entnommen aus Nicholson »Der praktische Mechaniker«, Fig. 386) stellt diesen ersten Versuch dar. Durch eine Handpumpe wird Druckwasser in einen Treibzylinder gepreßt, dessen Kolben mit einer Zahnstange gekuppelt ist, die ihrerseits die Seiltrommel durch ein Stirnrad in Umdrehung versetzt.
  • 49. Im Jahre 1846 setzte Armstrong in Newcastle einen Kran in Betrieb, der durch das der städtischen Leitung entnommene Druckwasser gespeist wurde. Fig. 52. Das Grundsätzliche dieses Betriebes ist aus Fig. 53 zu erkennen. Das Wasserwerk pumpt Wasser aus einem Brunnen in einen Hochbehälter. Von diesem strömt das Wasser in das Leitungsnetz und zwar mit einem Druck, welcher der Höhenlage des Behälters über den Verbrauchsstellen abzüglich der Reibungswiderstände im Leitungsnetz entspricht. Durch eine geeignete Steuerung — Schieber oder Ventil — wird entweder das Druckwasser in den Treibzylinder geleitet, um die Last zu heben, oder es wird der Treibzylinder abgesperrt, um die Last in gehobener Stellung festzuhalten, oder es wird schließlich der Treibzylinder in die Abwasserleitung entleert, um die Last zu senken.
  • 50. Da die Wasserpressung in der städtischen Wasserleitung wegen der unregelmäßigen Entnahme stark schwankt, so stellte Armstrong später in Grimsby einen besonderen Wasserturm auf. Der Einfachheit des Hochbehältersystems steht der Nachteil gegenüber, daß der Wasserdruck von der Höhenlage abhängig ist, daher meist nicht größer als zwei Atmosphären sein kann, daß infolgedessen große Querschnitte des Treibzylinders und der Leitungen erforderlich sind, und daß hierdurch die Anlagekosten außerordentlich hoch werden. Infolge der hohen Besitzkosten wird der Preis des Druckwassers aus städtischen Leitungen in den meisten Fällen so hoch, daß die Verwendung desselben zu Kraftzwecken unwirtschaftlich erscheint.
  • 51. Fig. 53. Armstrong suchte nun die Wirtschaftlichkeit dadurch zu verbessern, daß er den offenen Hochbehälter durch einen geschlossenen Windkessel ersetzte, in den durch die Pumpe Wasser gepreßt wird, Fig. 54. Da bei diesem System der Wasserdruck nicht durch das Eigengewicht des Wassers, sondern durch die Spannkraft der eingeschlossenen und zusammengepreßten Luft erzeugt wird, so muß naturgemäß mit steigendem Wasserstand im Windkessel die Pressung zunehmen, mit fallendem Wasserstand abnehmen. Der Wasserdruck wird daher um so veränderlicher sein, je kleiner der Windkessel ist.
  • 52. Dieses System gestattet, Pressungen bis zu 10 Atm. anzuwenden, ermöglicht daher eine weitgehende Verkleinerung der Leitungsquerschnitte und der Treibzylinder, so daß die Anlagekosten wesentlich verringert werden. Für noch höhere Pressungen ist das System nicht verwendbar, weil bei höherem Druck die Luft im Windkessel sehr bald vom Wasser absorbiert wird. Armstrong gab den Versuch mit Windkessel sehr bald auf, weil er den Wasserdruck allzu veränderlich fand; vermutlich war der Windkessel zu klein ausgeführt. Dagegen wurde dieses System später in Amerika für den Betrieb von Aufzügen sorgfältig durchgebildet und viel verbreitet. Fig. 54. Im Jahre 1851 kam Armstrong auf den Gedanken, den Wasserdruck dadurch zu erhöhen, daß an Stelle des Hochbehälters ein Treibzylinder verwendet wurde, dessen Kolben durch ein Gewicht
  • 53. belastet war. Es entsteht dann eine Anordnung, wie sie in Fig. 55 schematisch dargestellt ist. Ein Pumpwerk preßt Wasser aus einem Vorratsbehälter in einen Akkumulator, d. h. in einen Zylinder mit gewichtsbelastetem Kolben. Der Wasserdruck entspricht dem Querschnitt und der Belastung dieses Kolbens. Aus dem Akkumulatorzylinder strömt das Druckwasser in das Leitungsnetz und wird aus diesem den Kranen durch geeignete Steuerungen zugeführt. Sind alle Krane abgesperrt, so steigt der gewichtsbelastete Kolben des Akkumulators unter der Einwirkung des Pumpwerks. Sobald ein Kran dem Leitungsnetz Druckwasser entnimmt, sinkt der Kolben des Akkumulators wieder herab; das Wasser steht stets unter gleicher Pressung. Eine besondere Vorkehrung sorgt dafür, daß bei höchster Stellung des Akkumulatorkolbens die Pumpe selbständig stillgesetzt wird, damit der Kolben nicht aus dem Zylinder herausgetrieben wird; sobald der Kolben wieder sinkt, setzt sich die Pumpe selbsttätig wieder in Gang. Die Belastung des Akkumulators wird in der Regel so bemessen, daß die Wasserpressung 50 Atm. beträgt; ausnahmsweise steigert man die Pressung bis auf 100 Atm.
  • 54. Fig. 55. Für Stahlwerke fand der Druckwasserantrieb mit Akkumulator schon vor der Mitte des 19. Jahrhunderts Anwendung. Die Gießkrane erhielten durch Cockerill in Seraing eine eigenartige Gestaltung, die allgemein Verbreitung fand. Fig. 56 (entnommen aus Ernst »Hebezeuge«, Taf. 82) stellt diesen Typ dar, der dadurch gekennzeichnet ist, daß der Treibzylinder gleichzeitig als Krangerüst dient. Der Zylinder ist im Boden verankert; der Tauchkolben führt sich in dem Grundring der Stopfbüchse und in einem zweiten in Zylindermitte eingefügten Halsring und ist dadurch befähigt, in jeder Hubstellung ein Biegungsmoment auf den Zylinder zu übertragen. Starr mit dem
  • 55. Tauchkolben verbunden ist ein Ausleger, der auf der einen Seite den Gießkübel von 11 t Inhalt, auf der andern ein Gegengewicht trägt, welches das Moment der Nutzlast zur Hälfte ausgleicht. Durch Einleiten von Druckwasser in den Zylinder wird der Tauchkolben mit Ausleger und Kübel gehoben; die Schwenkung des Auslegers wird durch ein Handtriebwerk bewirkt, die Entleerung des Kübels wird ebenfalls von Hand besorgt. Die Anordnung ist durch ihre außerordentliche Einfachheit bemerkenswert. Der Druckwasserzuleitung wegen mußten die Gießkrane stets feststehend angeordnet werden. Der Gießkübel konnte daher nur die Ringfläche bestreichen, in deren Mittelpunkt der Kran gestellt war. Die Gießformen mußten infolgedessen in dieser Ringfläche angeordnet werden, die Bessemerbirne am Rande der Ringfläche. Die Eigenart des Krans bedingte daher die Anordnung des Stahlwerks. Naturgemäß entstanden zwischen den Ringflächen tote Ecken, die nicht ausgenutzt werden konnten.
  • 57. Fig. 57. Diesem Nachteil suchte man später in der Weise abzuhelfen, daß man den flüssigen Stahl aus der Birne nicht unmittelbar dem Gießkran übergab, sondern daß man zwischen den Birnen und den Gießkranen ein Geleise anordnete. Auf diesem Geleise lief ein Gießwagen mit Dampfbetrieb, der den Stahl von den Birnen zu den einzelnen Gießkranen förderte; der Gießwagen goß den Stahl in die Kübel der Gießkrane aus, es war ein zweimaliges Ausgießen erforderlich. Die Gießkrane selbst wurden nun so gestaltet, daß sie die Grundfläche so viel wie irgend möglich freiließen, und daß sie anderseits eine möglichst breite Ringfläche bestrichen. Diese Forderungen führten zu der in Fig. 57 dargestellten Anordnung von Stuckenholz in Wetter a. Ruhr, bei welcher der Treibzylinder von dem Krangerüst getrennt ist. Das Gerüst ist aus Walzeisen so gebildet, daß möglichst wenig Raum verloren geht. In einem feststehenden, aus Walzeisen genieteten Unterbau ist drehbar die Kransäule gelagert, die als Kastenträger ausgebildet ist. Hinter ihr ist der Hubzylinder stehend montiert, der mittels Drahtseilflaschenzugs den
  • 58. Gießkübel hebt. Liegend auf dem Ausleger ist ein doppelt wirkender Treibzylinder angeordnet, dessen Kolbenstange die Laufkatze verschiebt. Neben ihm liegt ein dritter Zylinder, dessen gleichfalls doppelt wirkende Kolbenstange als Zahnstange ausgebildet ist und vermittelst Ritzel und Zahnkranz die Schwenkbewegung des Auslegers herbeiführt. Alle Triebwerksteile liegen frei zugänglich und so hoch, daß sie dem Einfluß des Staubes möglichst entzogen sind.
  • 59. 2. Von 1900 an: Elektrischer Betrieb. Völlige Freiheit in der Anordnung des Stahlwerks konnte nur dann gewonnen werden, wenn es gelang, die Gießkrane selbst fahrbar einzurichten. Der Druckwasserbetrieb schloß diese Möglichkeit aus, der Zuleitung wegen. Der Dampfkran war für den anstrengenden Gießbetrieb zu verwickelt in seinem Getriebe und zu umständlich in seiner Steuerung. Lösbar wurde die Aufgabe erst nach Einführung des elektrischen Betriebes, der durch die Kontaktleitung die notwendige freie Beweglichkeit und durch seine Steuerfähigkeit die erforderliche Betriebseinfachheit und Sicherheit gewährte. Sobald die Einzelheiten des elektrischen Kranbetriebes genügend dem derben Hüttenbetrieb angepaßt waren, entstanden in rascher Folge neue Gestalten von Gießkranen.
  • 60. Fig. 58. Fig. 58 stellt zunächst eine Ausführung der Union-E.-G. dar, die dem Dampfkran nachgebildet ist. Der Kran läuft auf einem Breitspurgeleise und trägt einen Ausleger, der gehoben und geschwenkt werden kann, und auf dem die fahrbare und kippbare Gießpfanne ruht. Fünf Elektromotoren betätigen die genannten fünf Bewegungen des Kübels bzw. des Krans. Die Anordnung befriedigt alle Anforderungen des Hüttenbetriebes: sie ist frei beweglich, betriebssicher und vollkommen steuerfähig. Eine Vervollkommnung war jedoch insofern möglich, als der von dem Breitspurgeleise beanspruchte Raum einen beträchtlichen Teil des Hallenquerschnitts in Anspruch nahm. Dieser Raum konnte gewonnen werden dadurch, daß man die beiden Schienen auf Konsolen an den Hallenwänden lagerte und den Kranwagen als eine Brücke ausbildete, welche die
  • 61. ganze Halle überspannte. Dadurch wurde gleichzeitig die Möglichkeit gewonnen, dem Gießkübel noch eine Bewegung quer zur Halle zu erteilen und so ein breites Rechteck zu bestreichen. Fig. 59. ❏ GRÖSSERES BILD Fig. 59 zeigt eine Ausführung dieser Art von Stuckenholz, die über eine Tragkraft von 15 t verfügt. Derartige Laufkrane mit großen Geschwindigkeiten wurden erst durch die Einführung des elektrischen Betriebes möglich, denn einen Dampfkessel hätte man auf einem so hoch gelegenen Kran kaum in einwandsfreier Weise aufstellen können; die mechanische Zuführung der Energie durch Wellen oder Seile hingegen erlaubte die Anwendung von nur sehr kleinen Geschwindigkeiten, die für ein Stahlwerk nicht im entferntesten ausgereicht hätten. Von der Notwendigkeit schnellarbeitender Hebemaschinen für ein modernes Stahlwerk kann man sich eine Vorstellung machen, wenn man sich den Umfang und die Schnelligkeit des Betriebes
  • 62. vergegenwärtigt. Ein modernes Bessemerwerk leistet mit zwei Birnen von je 10 t Inhalt 2000 t Stahl im Tag; dementsprechend muß alle 15 Min. eine Birne entleert werden. Hiervon entfallen 4 Min. auf das Füllen und Aufrichten der Birne, 9 Min. auf das eigentliche Blasen, die übrigen 2 Min. stehen zur Verfügung für das Senken der Birne, das Ausgießen des Stahls und der Schlacke und das Aufrichten in die Füllstellung. Das flüssige Roheisen wird durch einen Gießwagen von 20 t Inhalt mit einer Fahrgeschwindigkeit von 2 m in der Sekunde zugeführt, der flüssige Stahl durch einen Gießkran von 10 t Kübelinhalt, also 15 t Tragkraft in die Kokillen gegossen. Für diesen ganzen Betrieb sind an Mannschaft erforderlich: ein Gießmeister und ein Birnensteurer auf der Steuerbühne, ein Steuermann auf dem Gießwagen und ein zweiter auf dem Gießkran. Trotz der Geschwindigkeit, mit der die gewaltigen Massen bewegt werden, vollzieht sich alles mit größter Ruhe: ein überzeugender Beweis dafür, daß bei einem vollkommenen Maschinenbetrieb alle menschliche Handlangerarbeit ausgeschaltet ist, so daß der Mensch das Getriebe nur steuert und beherrscht, nicht ihm dient. Neben dem Bessemerverfahren gewann für hochwertigen Stahl das Siemens-Martin-Verfahren bald eine solche Verbreitung, daß auch hierfür Maschinenkraft den Transport übernehmen mußte. Die Ansprüche, welche an diesen gestellt wurden, lassen sich aus dem Querschnitt eines Martin-Werks sofort herauslesen.
  • 63. Welcome to our website – the perfect destination for book lovers and knowledge seekers. We believe that every book holds a new world, offering opportunities for learning, discovery, and personal growth. That’s why we are dedicated to bringing you a diverse collection of books, ranging from classic literature and specialized publications to self-development guides and children's books. More than just a book-buying platform, we strive to be a bridge connecting you with timeless cultural and intellectual values. With an elegant, user-friendly interface and a smart search system, you can quickly find the books that best suit your interests. Additionally, our special promotions and home delivery services help you save time and fully enjoy the joy of reading. Join us on a journey of knowledge exploration, passion nurturing, and personal growth every day! testbankdeal.com