Presentation is loading. Please wait.

Presentation is loading. Please wait.

Conducting an Information Systems Audit

Similar presentations


Presentation on theme: "Conducting an Information Systems Audit"— Presentation transcript:

1 Conducting an Information Systems Audit
Chapter 2

2 Dealing with Complexity
The Nature of Controls Preventive control Detective control Corrective control Dealing with Complexity Given the purposes of the IS audit, factor the system to be evaluated into subsystems. Determine the reliability of each subsystem and the implications of each subsystem’s level of reliability for the overall level of reliability in the system.

3 Decomposition of the information systems function
IS Function Management systems Cycles Application systems Management subsystems Application subsystems

4 Management Subsystem :
- Top management - IS management - Systems development management - Programming management - Data administration - Quality assurance management - Security administration - Operations management

5 Application Subsystems :
- Boundary - Input - Communication - Processing - Database - Output Assessing Subsystem Reliability

6 Audit Risks Audit risk model for the external audit function : DAR = IR x CR x DR DAR = Desired audit risk IR = inherent risk CR = control risk DR = detection risk

7 Types of Audit Procedures
Procedures to obtain an understanding of controls Tests of controls Substantive tests of details of transactions Substantive tests of details of account balances Analytical review procedures

8 Auditors can use similar types of procedures if they are concerned with evaluating the effectiveness and efficiency of organization’s operation : Procedures to obtain an understanding of controls Tests of controls Substantive tests of details of transactions Substantive tests of overall results Analytical review procedures

9 Overview of Steps in an Audit
Planning The Audit Start Rely on Controls ? no Preliminary Audit work Yes Tests of controls Obtain Understanding Of control structure Reassess Control risk Assess control risk Extended Substantive testing Still Rely on Control ? no Form audit Opinion and Issue report yes Increase Reliance on Controls ? no Stop Limited Substantive testing yes

10 Tests of controls Tests of transactions Tests of balances or overall results Completion of the audit Auditing Around or Through The Computer Auditing around the computer Auditing through the computer


Download ppt "Conducting an Information Systems Audit"

Similar presentations


Ads by Google