1.1 List and briefly explain five (5) steps that should be followed when performing an IT
audit. (10)
Step 1: Preliminary activities
Gather organisational information.
This information will serve as a basis for creating the audit plan.
The organisation’s strategy of and responsibilities for managing and controlling computer
applications will be identified.
Obtain general data about the company, identify financial application areas, and prepare an
audit plan.
Step 2: Audit planning process
Proper planning will ensure that the audit is conducted in an effective and efficient manner.
The planning process involves the following:
Identify the tasks to be performed during an audit.
Allocate those tasks to specific auditors.
Decide when a task should commence.
Quantify the duration of each individual task based on the auditor allocated.
Determine the objectives and scope of the audit tentatively.
Determine overall business objectives of the area to be reviewed as well as control objectives.
For each key performance area (KPA), establish performance objectives.
Review the design of the internal control system for adequacy and tests of compliance with
the designed control system and evaluate the effectiveness of the implementation of the
control system.
Step 3: Evaluation of internal controls
Define internal control
, COSO defines internal control as “a process, influenced by an entity’s board of directors,
management, and other personnel that is designed to provide reasonable assurance in the
effectiveness and efficiency of operations, reliability of financial reporting and the
compliance of applicable laws and regulations”.
Evaluate the five control components
Control environment – management’s philosophy and operating style
Risk assessment – risk identification and analysis
Control activities – policies and procedures implemented in the organisation
Information and communication – all important information obtained and communicated
throughout the organisation
Monitoring – review output generated by control activities
The following controls should be implemented by an organisation: Preventive controls
intended to stop an error from occurring; detective controls that detect whether an error has
occurred or not; and mitigating controls that mitigate the risks associated with key controls.
Evaluation of general and application controls
General controls cover the entire CIS environment within which each set of application
controls functions. General controls are related to all applications and they provide a
framework within which the CIS department exercises control over the development,
operation and maintenance of individual applications.
Application controls are user and programmed controls that are embedded in each of the
data-processing functions, namely input, processing and output.
Tests of control
Determine the effectiveness of the operation of internal control.
Determine whether the design of the control is such that the control prevents material errors
from occurring.
Assess how the control was applied, whether the control was applied consistently, and who
applied it.
audit. (10)
Step 1: Preliminary activities
Gather organisational information.
This information will serve as a basis for creating the audit plan.
The organisation’s strategy of and responsibilities for managing and controlling computer
applications will be identified.
Obtain general data about the company, identify financial application areas, and prepare an
audit plan.
Step 2: Audit planning process
Proper planning will ensure that the audit is conducted in an effective and efficient manner.
The planning process involves the following:
Identify the tasks to be performed during an audit.
Allocate those tasks to specific auditors.
Decide when a task should commence.
Quantify the duration of each individual task based on the auditor allocated.
Determine the objectives and scope of the audit tentatively.
Determine overall business objectives of the area to be reviewed as well as control objectives.
For each key performance area (KPA), establish performance objectives.
Review the design of the internal control system for adequacy and tests of compliance with
the designed control system and evaluate the effectiveness of the implementation of the
control system.
Step 3: Evaluation of internal controls
Define internal control
, COSO defines internal control as “a process, influenced by an entity’s board of directors,
management, and other personnel that is designed to provide reasonable assurance in the
effectiveness and efficiency of operations, reliability of financial reporting and the
compliance of applicable laws and regulations”.
Evaluate the five control components
Control environment – management’s philosophy and operating style
Risk assessment – risk identification and analysis
Control activities – policies and procedures implemented in the organisation
Information and communication – all important information obtained and communicated
throughout the organisation
Monitoring – review output generated by control activities
The following controls should be implemented by an organisation: Preventive controls
intended to stop an error from occurring; detective controls that detect whether an error has
occurred or not; and mitigating controls that mitigate the risks associated with key controls.
Evaluation of general and application controls
General controls cover the entire CIS environment within which each set of application
controls functions. General controls are related to all applications and they provide a
framework within which the CIS department exercises control over the development,
operation and maintenance of individual applications.
Application controls are user and programmed controls that are embedded in each of the
data-processing functions, namely input, processing and output.
Tests of control
Determine the effectiveness of the operation of internal control.
Determine whether the design of the control is such that the control prevents material errors
from occurring.
Assess how the control was applied, whether the control was applied consistently, and who
applied it.
