hhhh.ppt
- 1. IT TRAINING- ICAN Computer Aided Audit Tools & Techniques CA. Dhruba Adhikari, ISA
- 2. STAGES OF AN AUDIT Plan the audit Understand the entity (Preliminary Review) Assess risk of material misstatement Respond to risk Expect effective controls Expect ineffective controls Test of Control Unsatisfactory Report significant deficiencies to those charged with governance to management and all weakness to mgmt. Satisfactory Full Substantive tests Restricted substantive tests Overall review of Financial Statement Report to Mgmt. Auditor’s Report
- 3. OBJECTIVES AND CONTEXT OF AUDIT OBJECTIVE is what we are trying to accomplish. What goal we want. CONTEXT is the environment in which we perform our work. Its background and circumstances in which we perform our audit. What works for one organization, may not work for another, its all due to objectives and context
- 4. PRELIMINARY REVIEW In preliminary review, the auditor will gather general information and the process and systems under review. An overall summary or an overview flowchart of the major applications subsystems and their inter-relationships, including inputs and outputs Programming languages, data processing standards, and procedures manuals used in the computer system Data control procedures Procedures and provisions for backup, recovery, and restart of operations in the event of equipment failure or accidental destruction of data Descriptions of physical security control Method applied in gathering these data are mainly interviews and review of documentation.
- 5. SUBSTANTIVE TEST IN IT AUDIT In an IT audit, substantive testing is used to determine the accuracy of information being generated by a process or application. Audit tests are designed and conducted to verify the functional accuracy, efficiency, and control of the audit subject. During the audit of an Information System application, the auditor may build and process test data to verify the processing steps of an application. Whether accounting system is manual or computerized , the procedures of auditing are more or less same except some changes in controls, documentation, audit techniques, and technical qualifications required by audit staff members.
- 6. CONTROLS AND AUDITING IN COMPUTER ENVIRONMENT Since accounting system is vulnerable to various mismanagements, frauds, errors etc, but these type of threats can be coped by adopting/implementing strong system of internal control Why internal control in computerized environment Lack of proper audit trails Information recorded cannot be read by bare eyes without computer Financial and business transaction are often generated by system itself based on data previously entered without further human instruction. Errors in computerized environment may go undetected as there is less involvement of human in computerized environment. There is maximum chances of errors in processing that might be applied to large number of transaction With proper controls, computerized system are more reliable than non-computerized systems.
- 7. CLASSIFICATION OF CONTROLS 1. General Controls 2. Application Controls 1. General Control General control is the control governing the environment in which the computer system is developed, maintained, and operated. 2. Application Control Its control for both computerized and manual, within the business application to ensure that data is processed completely, accurately and in a timely manner. Application controls are typically specific to the business application and include *Input control *Run to run comtrols
- 8. INPUT CONTROL •Field Check (Numeric- Alphabetic) •Limit Check •Range Check- Day in a month •Slab Check – like city •Existence- data should exist in some field •Check digit Record Level Tests Field’s logical interrelationship with other fields in a record {PF 10% of Basic Salary} Reasonableness check 20 hours of overtime in a day Consistency/Validity check A district must fall in a particular zone Length PAN No 9 digit, Mobile no. 10 digit Sign test PF cannot be (-)ve Sequence Check Country code- Area Code- Phone No
- 9. GROUP OF RECORDS (BATCH) TESTS WHETHER THE CHARACTERISTICS OF A BATCH RECORDS ENTERED ARE IN LINE WITH THE STATED CHARACTERISTICS OF THE BATCH FOLLOWING TYPES OF BATCH CHECK CAN BE APPLIED CONTROL TOTALS: IS SUM OF A FIELD ACROSS ALL RECORDS IN A BATCH TRANSACTION TYPE: ALL DATA IN A PARTICULAR BATCH ARE OF SIMILAR TYPE BATCH SERIAL NUMBER: ALL RECORDS MUST HAVE A SERIAL NUMBER SEQUENCE CHECK: THE INPUT RECORDS MUST FOLLOW A PARTICULAR ORDER
- 10. PROCESSING CONTROL After data are entered (input is given) , transactions enter the processing stage of the system. Processing control are programmed procedures and can be divided into 3 categories- namely batch control, run to run control and audit trail controls Batch controls used to manage the flow of high volumes of transactions through batch processing systems - to reconcile system output with the input To ensure All records in the batch are processed. No records are processed more than once. An audit trail of transactions is created from input through processing to the output stage of the system.
- 11. PROCESSING CONTROL CONTD. Run-to-run control use of batch figures to monitor the batch as it moves from one programmed procedure (run) to another. {Error Handling and Reprocessing} Hash total summation of a nonfinancial field to keep track of the records in a batch Inter table tests when a new transaction is entered- checks the other related tables for validity Master reference where master is present, the data is validated against that master - customer exists? Audit trail controls ensure that every transaction can be traced through each stage of processing Transaction Logs: successfully processed transactions should be recorded Log of Automatic Transactions: reorder point, entry scheduling Transaction Listings: listing of all successful transactions
- 12. SYSTEM & INTERSYSTEM TEST Testing of system focus on evaluation of individual modules within a program. There are two types of system test- static analysis and dynamic analysis Static analysis test:- it evaluates the quality of module through direct examination of source code. Like desk checking , structured walk through, design and code inspection Dynamic analysis test:- Dynamic analysis test require the module to be executed on a machine Two important dynamic analysis test are •Black Box •White Box Inter system tests Evaluating groups of program modules (1) whether their interfaces are defective (2) overall whether they fail to meet their requirement specifications