McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-1 Chapter 7 CHAPTER 7 THE EFFECT OF INFORMATION TECHNOLOGY ON THE AUDIT FUNCTION

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-2 TYPES OF CONTROLS IN AN IT ENVIRONMENT General Controls: Relate to the overall information processing environment. Application Controls: Apply to the processing of specific computer applications.

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-3 GENERAL CONTROLS Organizational controls (see Figures 7-3 and 7-4, and Table 7-2) Data center and network operations controls Hardware and systems software acquisition and maintenance controls (see Table 7-3)

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-4 GENERAL CONTROLS Access security controls Applications system acquisition, development and maintenance controls

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-5 APPLICATION CONTROLS Data capture controls (see Table 7-5) Data validation controls (see Table 7-6) Processing controls (see Table 7-7)

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-6 APPLICATION CONTROLS Output controls Error controls (see Figure 7-5)

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-7 THE EFFECT OF IT ON INTERNAL CONTROL COMPONENTS The presence of computer processing for significant accounting applications affects how an entity implements its internal controls. In particular, the control environment factors and control activities are affected by IT.

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-8 THE AUDIT PROCESS IN AN IT ENVIRONMENT The auditor's knowledge of the entity's IT processing must include the following factors: The extent to which IT is used in each significant accounting application. The complexity of the entity's IT operations. The organizational structure of the IT processing activities. The availability of data for evidential matter.

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-9 COMPUTER-ASSISTED AUDIT TECHNIQUES (CAATs) Generalized audit software (see Table 7-9) Custom audit software

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved COMPUTER-ASSISTED AUDIT TECHNIQUES (CAATs) Test data (see Figure 7-6) Parallel simulation (see Figure 7-7) Integrated test facility

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved USE OF PERSONAL COMPUTERS AS AN AUDIT TOOL Trial balance and lead schedule preparation. Audit documentation. Audit program preparation. Analytical procedures.

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved USE OF PERSONAL COMPUTERS AS AN AUDIT TOOL Documentation of internal control. Data retrieval and analysis. Performance of statistical sampling applications.

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved AUDITING ACCOUNTING APPLICATIONS PROCESSED BY SERVICE ORGANIZATIONS The auditor should consider the following factors when a client who uses a service organization to process certain transactions: The inherent risk and significance of the audit assertion affected by the controls. The extent of the interaction between the client's controls and the service organization's controls. Controls applied by the client to transactions processed by the service organization.

McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved AUDITING ACCOUNTING APPLICATIONS PROCESSED BY SERVICE ORGANIZATIONS (continued) The auditor's prior experience with the service organization. The extent of auditable data within the client's internal control.