Term 4 :
IT AUDIT
,AUDIT PROCESS
AUDIT PROCESS
planning
-> Knowledge of the business
-> understanding the systems
-> materialitly
Pre-engagement activities -> audit risk and risk assessment
-> audit strategy and approach
Audit procedures
evaluation and reporting -> test of control
-> substantive
procedures
How do computers impact the audit process
What changes at the CLIENT? What changed for the AUDIT What must the AUDITORS do?
Characteristics of the accounting & The following DOES change: Consider additional aspects:
system of internal control CHANGES ➔ Risks on which the audit ➔ Pre-engagement activities
For example: must focus ➔ Obtain an understanding of
➔ Transactions (generating, ➔ Methods of obtaining audit the accounting and system of
processing and storage) (eg evidence internal control (knowledge
manual VS automated) ➔ Methods of conducting audit of the business)
➔ Manual & IT internal controls procedures ➔ During the planning of
(there are additional risks for ➔ Nature, extent and timing of nature/ time and extent of
the client) procedures auditor procedures
➔ Information send to ➔ Performing the audit
management (reports are The following does NOT change : procedures
automated) ➢ Overall extent and objective
➢ Audit objectives
➢ Audit process
, 1) Pre-engagement activities (stage 1 )
- BEFORE accepting the audit engagement (the client ), consider if you have the following :
o Skills required (DO I have the skills required to audit a complex system , IF NOT hire a specialist )
o Resources (hardware, software & time) (AT the client AND at myself )
o Funding (can I do this audit in a cost effective manner
o May require a computer specialist services
2) Planning (stage 2 )
A) Knowledge of the Considering normal aspects when understanding the IS AND :
business & ➢ Complexity of accounting activities
understanding the ➢ Significance of the computer activities
system ➢ Data availability
➢ Method of processing used
B) Understand the system Obtain an understanding of the accounting and system of Internal control
➢ IC around transactions (& info) relevant to the audit
➢ Specifically controls relating to significant classes of transactions ,
accounts & balances and process to prepare the financial statements
➢ Focus on systems relating to financial reporting framework
➢ Identify relevant risks ( AT financial statement AND accounting level)
➢ Distinguish between :
o Direct (internal controls that address RMM AT
account/assertion level)
o Indirect
C) Risk assessment CIS results in a change in the characteristics of the system
AR = IR x CR x DR ➢ Giving rise to additional risks & introduces compensating controls
➢ Has an impact on the auditors risk assessment AND timing, nature
and extent of audit procedures
Internal control (IC) characteristics and risks associated with the CIS
environment :
➔ Identify “NEW” risks (IR) which are introduced by the CIS
o Financial statement level: errors and unusual items in the AFS
o Account/ assertion level : with respect to figures in the
financial statements
➔ Evaluate internal controls which have been implemented in CIS (CR)
➔ Magnitude and likelihood of IR & CR evaluated separately
Risk evaluation is a systematic and iterative process :
1) Identify controls
2) Evaluate the design (on paper)
3) Test implementation (high level test/ walk through
4) Test operations
Characteristic / factors of CIS that give risk to RISKS:
a) NATURE OF PROCESSING
▪ Absence of input documents
IT AUDIT
,AUDIT PROCESS
AUDIT PROCESS
planning
-> Knowledge of the business
-> understanding the systems
-> materialitly
Pre-engagement activities -> audit risk and risk assessment
-> audit strategy and approach
Audit procedures
evaluation and reporting -> test of control
-> substantive
procedures
How do computers impact the audit process
What changes at the CLIENT? What changed for the AUDIT What must the AUDITORS do?
Characteristics of the accounting & The following DOES change: Consider additional aspects:
system of internal control CHANGES ➔ Risks on which the audit ➔ Pre-engagement activities
For example: must focus ➔ Obtain an understanding of
➔ Transactions (generating, ➔ Methods of obtaining audit the accounting and system of
processing and storage) (eg evidence internal control (knowledge
manual VS automated) ➔ Methods of conducting audit of the business)
➔ Manual & IT internal controls procedures ➔ During the planning of
(there are additional risks for ➔ Nature, extent and timing of nature/ time and extent of
the client) procedures auditor procedures
➔ Information send to ➔ Performing the audit
management (reports are The following does NOT change : procedures
automated) ➢ Overall extent and objective
➢ Audit objectives
➢ Audit process
, 1) Pre-engagement activities (stage 1 )
- BEFORE accepting the audit engagement (the client ), consider if you have the following :
o Skills required (DO I have the skills required to audit a complex system , IF NOT hire a specialist )
o Resources (hardware, software & time) (AT the client AND at myself )
o Funding (can I do this audit in a cost effective manner
o May require a computer specialist services
2) Planning (stage 2 )
A) Knowledge of the Considering normal aspects when understanding the IS AND :
business & ➢ Complexity of accounting activities
understanding the ➢ Significance of the computer activities
system ➢ Data availability
➢ Method of processing used
B) Understand the system Obtain an understanding of the accounting and system of Internal control
➢ IC around transactions (& info) relevant to the audit
➢ Specifically controls relating to significant classes of transactions ,
accounts & balances and process to prepare the financial statements
➢ Focus on systems relating to financial reporting framework
➢ Identify relevant risks ( AT financial statement AND accounting level)
➢ Distinguish between :
o Direct (internal controls that address RMM AT
account/assertion level)
o Indirect
C) Risk assessment CIS results in a change in the characteristics of the system
AR = IR x CR x DR ➢ Giving rise to additional risks & introduces compensating controls
➢ Has an impact on the auditors risk assessment AND timing, nature
and extent of audit procedures
Internal control (IC) characteristics and risks associated with the CIS
environment :
➔ Identify “NEW” risks (IR) which are introduced by the CIS
o Financial statement level: errors and unusual items in the AFS
o Account/ assertion level : with respect to figures in the
financial statements
➔ Evaluate internal controls which have been implemented in CIS (CR)
➔ Magnitude and likelihood of IR & CR evaluated separately
Risk evaluation is a systematic and iterative process :
1) Identify controls
2) Evaluate the design (on paper)
3) Test implementation (high level test/ walk through
4) Test operations
Characteristic / factors of CIS that give risk to RISKS:
a) NATURE OF PROCESSING
▪ Absence of input documents
