3 Attest ServicesAn engagement in which a practitioner is engaged to issue, or does issue, a written communication that expresses a conclusion about the reliability of a written assertion that is the responsibility of another party.Attest: To affirm to be correct, true, or genuine
4 Requirements applied to attestation services Attestation services require written assertions and a practitioner’s written report.Attestation services require the formal establishment of measurement criteria or their description in the presentation.The levels of service in attestation engagements are limited to examination, review, and application of agreed-upon procedures.
5 Assurance Services Broader than attestation (Fig. 1-1) Professional services designed to improve the quality of information, both financial and non-financial, used by decision-makers.Intended to help people make better decisions by improving information.Assurance: A statement or indication that inspires confidence; a guarantee or pledge
6 Assurance ServicesEvolution of accounting profession is expected to follow the assurance services model.All “Big Five” professional services firms have renamed their traditional audit functions “Assurance Services.”Organizational unit responsible for conducting IT audits is named either IT Risk Management, Information Systems Risk Management, or Operational Systems Risk Management (OSRM)
7 Financial AuditAn independent attestation performed by an expert, the auditor, who expresses an opinion regarding the presentation of financial statements.Auditor’s role is similar in concept to a judge who collects and evaluates evidence and renders an opinion.
8 Financial AuditKey concept in this process is independence; Judge must remain independent in his or her deliberation.Judge cannot be advocate of either party in the trial, but must apply law impartially based on evidence presented.Likewise, independent auditor collects and evaluates evidence and renders an opinion based on evidence.
9 Financial AuditThroughout audit process, auditor must maintain his or her independence from client organization.Public confidence in the reliability of the company’s internally produced financial statements rests directly on their being evaluated by an independent expert audit.
10 Financial AuditSystematic audit process involves three conceptual phases:Familiarization w/ organization’s businessEvaluating and testing internal controlAssessing the reliability of financial data
11 Auditor’s ReportProduct of attestation function is a formal written report that expresses an opinion about the reliability of the assertions contained in financial statementsAuditor’s report expresses an opinion as to whether the financial statements are in conformity w/ generally accepted accounting principles
12 Auditing StandardsAuditors are guided in their professional responsibility by the ten generally accepted auditing standards (GAAS) Fig. 1-2GAAS establishes a framework for prescribing auditor performance, but it is not sufficiently detailed to provide meaningful guidance in specific circumstances
13 Auditing StandardsTo provide specific guidance, American Institute of Certified Public Accountants (AICPA) issues Statements on Auditing Standards (SASs) as authoritative interpretations of GAAS.SASs are often referred to as auditing standards, or GAAS, although they are not the ten generally accepted auditing standards.
14 SAS First issued by AICPA in 1972 Since then, many SASs have been issued to provide auditors w/ guidance on a spectrum of topics, including methods of investigating new clients, techniques for obtaining background information on client’s industry.
15 External vs. Internal Auditing External auditing is often called independent auditing because it is done by certified public accountants who are independent of the organization being audited.External auditors represent the interests of third-party stakeholders in the organization, such as stockholders, creditors, and government agencies.Because the focus of external audit is on financial statements, this type of audit is called financial audit
16 External vs. Internal Auditing Institute of Internal Auditors defines internal auditing as an independent appraisal function established within an organization to examine and evaluate its activities
17 External vs. Internal Auditing Internal auditors perform a wide range of activities on behalf of the organization, including conducting financial audits, examining an operation’s compliance with organizational policies, reviewing the organization’s compliance with legal obligations, evaluating operational efficiency, detecting and pursuing fraud within the firm, and conducting IT audits.
18 External vs. Internal Auditing While external auditors represent outsiders, internal auditors represent the interests of the organization.Internal auditors often cooperate with and assist external auditors in performing financial audits.This is done to achieve audit efficiency and reduce audit fees. For example, a team of internal auditors can perform tests of computer controls under the supervision of a single external auditor.
19 External vs. Internal Auditing While external auditors represent outsiders, internal auditors represent the interests of the organization.Internal auditors often cooperate with and assist external auditors in performing financial audits.This is done to achieve audit efficiency and reduce audit fees. For example, a team of internal auditors can perform tests of computer controls under the supervision of a single external auditor.
20 Information Technology (IT) Audit Focus on the computer-based aspects of an organization’s information systemThis includes assessing the proper implementation, operation, and control of computer resources
21 Definition of Auditing Auditing is a systematic process of objectively obtaining and evaluating evidence regarding assertions about economic actions and events to ascertain the degree of correspondence between those assertions and established criteria and communicating the results to interested users
22 Elements of auditing A systematic process Management assertions and audit objectivesObtaining evidenceAscertaining the degree of correspondence between established criteriaCommunicating resultsSee Pages 5~7
23 5 Categories of Management Assertions (page 6) Existence or occurrence assertionCompleteness assertionRights and obligations assertionValuation or allocation assertionPresentation and disclosure assertionAuditors develop their audit objectives and design audit procedures based on preceding assertions. See Table 1-1
24 Structure of IT AuditIT audit is divided into three phases: audit planning, tests of controls, and substantive testing (See Figure 1-3)
25 Internal ControlThe establishment and maintenance of a system of internal control is an important management obligation.A fundamental aspect of management’s stewardship responsibility is to provide shareholders with reasonable assurance that the business is adequately controlled.Additionally, management has a responsibility to furnish shareholders and potential investors with reliable financial information on a timely basis. (Sarbanes-Oxley act)An adequate system of internal control is necessary to management’s discharge of these obligations.- Securities and Exchange Commission
26 Internal Control in Concept Internal control system comprises policies, practices, and procedures employed by the organization to achieve four broad objectives:To safeguard assets of the firm.To ensure the accuracy and reliability of accounting records and information.To promote efficiency in the firm’s operations.To measure compliance with management’s prescribed policies and procedures
27 Exposure and RiskInternal control shield (Figure 1-4) to protect firms from numerous undesirable eventsAttempts at unauthorized access to firm’s assets (including information)Fraud perpetrated by persons both in and outside the firmErrors due to employee incompetence, faulty computer programs, corrupted input data
28 Exposure and RiskInternal control shield (Figure 1-4) to protect firms from numerous undesirable eventsMischievous acts, such as unauthorized access by computer hackers and threats from computer viruses that destroy programs and databases
29 Exposure and Risk Absence or weakness of a control is called exposure Exposures increase firm’s risk to financial loss or injury from undesirable events.
30 Exposure and RiskA weakness in internal control may expose the firm to one or more of the following types of risks:Destruction of assets (both physical assets and information)Theft of assetsCorruption of information or the information system (containing errors or alterations)Disruption of information system (to break or burst; rupture )
31 3 Levels of ControlPreventive controls, detection controls, and corrective controls (Fig. 1-5)
32 Preventive Controls First line of defense in the control structure Passive techniques designed to reduce the frequency of occurrence of undesirable eventsPreventing errors and fraud is far more cost-effective than detecting and correcting problems after they occurIn information security: firewall
33 Preventive ControlsFor example, a well-designed data entry screen is an example of a preventive controlNot all problems can be anticipated and prevented.
34 Detective Controls Second line of defense Devices, techniques, and procedures designed to identify and expose undesirable events that elude preventive controlsIn information security: Intrusion detection
35 Corrective ControlsCorrective actions taken to reverse the effects of detected errorsDetective controls identify undesirable events and draw attention to the problem; corrective controls fix the problem.
36 Statement on Auditing Standards No. 78 (SAS 78) Current authoritative document for specifying internal control objectives and techniques.Conforms to the recommendations of the Committee of Sponsoring Organizations of the Treadway Commission (COSO)Consists of five components: control environment, risk assessment, information and communication, monitoring, and control activities
37 Control Environment Foundation for the other control components Important elements:Integrity and ethical values of managementStructure of organizationParticipation of organization’s board of directors and audit committeeManagement’s philosophy and operating style… see page 13
38 Control EnvironmentSAS 78 requires that auditors obtain sufficient knowledge to assess the attitude and awareness of organization’s management, board of directors, and owners regarding internal control.See page 13 for examples of techniques that may be used to obtain an understanding of control environment
39 Risk AssessmentIdentify, analyze, and manage risks relevant to financial reportingSee page 14 for risks that can rise out of changes in circumstancesSAS 78 requires that auditors obtain sufficient knowledge of organization’s risk assessment procedures to understand how management identifies, prioritizes, and manages risks related to financial reporting.
40 Information and Communication Accounting information system consists of records and methods used to initiate, identify, analyze, classify, and record organization’s transactions and to account for related assets and liabilities.Quality of information generated by AIS impacts management’s ability to take actions and make decisions in connection with organization’s operations and to prepare reliable financial statements.
41 Effective AIS Identify and record all valid financial transactions Provide timely information about transactions in sufficient detail to permit proper classification and financial reportingAccurately measure financial value of transactions so their effects can be recorded in financial statementsAccurately record transactions in time period in which they occur
42 Effective AISSAS 78 requires that auditors obtain sufficient knowledge of organization’s information systems to understandClasses of transactions that are material to financial statements and how those transactions are initiatedAccounting records and accounts that are used in processing of material transactions
43 Effective AISSAS 78 requires that auditors obtain sufficient knowledge of organization’s information systems to understandTransaction processing steps involved from initiation of economic event to its inclusion in financial statementsFinancial reporting process used to prepare financial statements, disclosures, and accounting estimates
44 MonitoringProcess by which quality of internal control design and operation can be assessedMay be accomplished by separate procedures or by ongoing activitiesInternal auditors may monitor entity’s activities in separate procedures. They gather evidence of control adequacy by testing controls, then communicate control strengths and weaknesses to management
45 MonitoringOngoing monitoring may be achieved by integrating special computer modules into information system that capture key data and/or permit tests of control to be conducted as part of routine operationsSuch embedded audit modules (EAMs) allow management and auditors to maintain constant surveillance over functioning of internal controls
46 Control ActivitiesPolicies and procedures used to ensure appropriate actions are taken to deal w/ organization’s identified risks
47 Control Activities Can be grouped into two categories: Computer controlsGeneral controlApplication controlPhysical controlstransaction authorizationsegregation of dutiessupervisionaccounting recordsaccess controlindependent verification
48 Computer Controls/General Controls Fall into two broad groups: general controls and application controlsGeneral controls pertain to entity-wide concerns such as controls over data center, organization databases, systems development, and program maintenance
49 Application ControlsApplication controls ensure the integrity of specific systems such as sales order processing, accounts payable, and payroll applications
50 Control Activities Can be grouped into two categories: Computer controlsGeneral controlApplication controlPhysical controlstransaction authorizationsegregation of dutiessupervisionaccounting recordsaccess controlindependent verification
51 Physical ControlsRelates primarily to traditional accounting systems that employ manual proceduresSix traditional categories of physical control activities: transaction authorization, segregation of duties, supervision, accounting records, access control, and independent verification
52 Transaction Authorization Ensure that all material transactions processed by information systems are valid and in accordance w/ management’s objectivesAuthorizations may be general or specific
53 General Authorization Granted to operations personnel to perform day-to-day operationsExample is procedure to authorize purchase of inventories from designated vendor only when inventory levels fall to their predetermined reorder points. This is called programmed procedure
54 Specific Authorization Deal with case-by-case decisions associated w/ non-routine transactions.Example is the decision to extend a particular customer’s credit limit beyond the normal amountIn an IT environment, the responsibility for achieving control objectives of transaction authorization rests directly on accuracy and consistency of computer programs that perform these tasks.
55 Segregation of Duties To minimize incompatible functions 3 objectives provide general guidelines applicable to most organizationsAuthorization for a transaction is separate from processing of the transaction. For example, purchases should not be initiated by purchasing department until authorized by inventory control department
56 Segregation of Duties3 objectives provide general guidelines applicable to most organizationsResponsibility for custody of assets should be separate from recordkeeping responsibility. For example, the department that has physical custody of finished goods inventory should not keep official inventory records. Accounting for finished goods inventory is performed by inventory control, an accounting function.
57 Segregation of Duties3 objectives provide general guidelines applicable to most organizationsOrganization should be structured so that a successful fraud requires collusion between two or more individuals with incompatible responsibilities. In other words, no single individual should have sufficient access to assets and supporting records to perpetrate a fraud.
58 Segregation of Duties in IT Computer errors are programming errors that are, in fact, human errors; no computer has ever perpetrated a fraud unless programmed to do so by a humanSeparating computer processing functions, therefore, serves no purpose
59 Segregation of Duties in IT Segregation of duties still plays a role in IT environmentOnce proper functioning of a program is established at system implementation, its integrity must be preserved throughout the application’s life cycle.The activities of program development, program operations, and program maintenance are critical IT functions that must be adequately separated.
60 SupervisionAchieving adequate segregation of duties often presents difficulties for small organization.In small organizations or in functional areas that lack sufficient personnel, management must compensate for absence of segregation controls with close supervision.For this reason, supervision is also called compensating control.
61 Accounting RecordsSource documents, journals, and ledgers capture economic essence of transactions and provide an audit trail of economic eventsAudit trail enables auditor to trace any transaction through all phases of its processing from initiation of event to financial statements
62 Access ControlsEnsure that only authorized personnel have access to firm’s assetsAccess control in IT environment includes provisions for physical security of computer facilities.Database security and authorization is important access control mechanism in modern organizations.
63 Access Control in IT Environment Limit personnel access authorityRestrict access to computer programsProvide physical security for data processing centerEnsure adequate backup for data filesProvide disaster recovery capability
64 Audit RiskProbability that auditor will render an unqualified opinion on financial statements that are, in fact, materially misstatedAuditor’s objective is to minimize audit risk by performing tests of controls and substantive tests.3 components of audit risk are inherent risk, control risk, and detection risk
65 Inherent RiskAssociated with unique characteristics of the business or industry of the clientFirms in declining industries have greater inherent risk than firms in stable or thriving industries.Auditors can not reduce level of inherent risk.
66 Control Riskis the likelihood that control structure is flawed because controls are either absent or inadequate to prevent or detect errors in the accountsAuditors reduce level of control risk by performing tests of internal controls, e.g., running test transactions and seeing if erroneous transactions can be detected
67 Detection Riskis the risk that auditors are willing to take that errors not detected or prevented by control structure will also not be detected by the auditorLower planned detection risk requires more substantive testing
68 General Framework for IT Risks and Controls See Fig. 1-7