Chapter 4

TOOLS AND
TECHNIQUES USED
IN AUDITING IT
 Objectives
1.Define auditor productivity tools and describe how they
assist the audit process.
2.Describe techniques used to document application
systems, such as flowcharting, and how flowcharts are
developed and appropriate to assist the audit process.
3.Explain what Computer-Assisted Audit Techniques
(CAATs) are and describe the role they play in the
performance of audit work.
4.Describe how CAATs are used to define sample size and
select the sample.
 Objectives

6. Describe the various CAATs used for reviewing applications,

particularly, the audit command language (ACL) audit software.
7. Describe CAATs used when auditing application
controls.
8. Describe CAATs used in operational reviews.
9. Differentiate between "Auditing Around the
Computer" and "Auditing Through the Computer".
10.Describe computer forensics and sources to
evaluate computer forensic tools and techniques.
Audit Productivity Tools

Software that helps auditors

reduce audit time by:

- automating the audit function

and
- integrating information
gathered.
 Tools Help Enhance…
Planning and tracking audit activities
o Through spreadsheets or project
management software
Documentation and presentation
o Through Word processing, flowcharting, etc.
Communication / data transfer
o Immediate communication through electronic
connectivity, centralized servers
 Tools Help Enhance…
Access to data
Access to clients data files or audit work
papers, etc.
Sharing environments
Tools create collaborative environments
(e.g., Groupware)
System Documentation Techniques

to understand client accounting

systems/processes by providing visual
illustration (SAS No. 109)
to identify data sources, relevant
controls, control strengths, control
weaknesses
System Documentation Techniques

Common techniques include:

 Data Flow Diagrams
 Business Process Diagrams

 Flowcharts
 Data Flow Diagrams

Graphically describe the flow of data within an

organization

flow of data includes –

 data sources
 data flows
 transformation processes
 data storage
 data destinations
3-9
Data Flow Diagrams

3-10
 Business Process Diagrams

Visual way to represent activities in a business

process
 Ex.Expenditure Process - shipping the goods
ordered, billing customers, collecting customer
payments

Show the organizational unit performing the

activity

3-11
Business Process Diagrams

3-12
 Flowcharts

Graphical descriptions of a system showing:

 how business processes are performed
 how documents flow through the organization

Flowcharts specifically show/describe:

 Inputs and Outputs
 Information activities (processing data)

 Data storage
 Data flows

 Decision steps
 Flowchart Development - Steps

1. Understand how financial applications process data

2. Identify documents & their flow through the system
3. Define data elements
4. Develop flowchart diagrams
5. Evaluate quality of system documentation
6. Assess controls over documents
7. Determine the effectiveness of data processing
8. Evaluate the accuracy, completeness, and usefulness
of reports
 Flowcharts

Use standard symbols to describe transaction

processing and the flow of data through a system
 symbolsare drawn using a software such as Visio,
Word, Excel, or PowerPoint

See example in next slide…

Flowcharts
 CAATs
Computer-Assisted Audit Techniques
(CAATs)

Software that helps auditors:

- evaluate application controls
and
- select/analyze computerized
data for substantive audit tests
 Why CAATs?
Many audit Computer
tasks take systems
time becoming highly
complex

Support financial,
application, and Enhance audit
operations type of productivity
audit/reviews
 CAATs in the Audit Process

Auditors responsible for:

 selecting and applying appropriate
audit techniques to conduct their
audit tests
 validating the reliability of systems
and programs with test of actual data
 CAATs in the Audit Process

Used to:
 evaluate integrity of applications
 validate application data:
 examine/test application controls and
 verify processing logic from point of:
 input

 execution of processing steps

 generation of output from specific

application
 CAATs in the Audit Process

Used to:
 select/analyze computerized data for
substantive testing
 determine compliance with procedures
 continuously monitor processing results
 query and analyze large amounts of data, using:
 ACL, IDEA, CA-Easytrieve (T), and SAS
 select sample, analyze data trends, data files
(“J/E testing”)
CAATs assist in following ways…
Identifying Items of Audit
Interest (i.e., potential fraud,
material and unusual items)

Providing grand totals to

validate populations so
auditors can select sample
(Audit Mathematics)

Analyzing, comparing,
and/or summarizing data
(Data Analysis)
 Items of Audit Interest
 Auditors can select material/significant items,
unusual items, or statistical samples of items
 Auditors:
 stipulate specific criteria
 let computers do the sample selection

Ex. Ex. Journal

Transactions of entries posted
$100,000 or on holidays;
more etc.
 Audit Mathematics

 Extensions and footings are tedious

and costly when performed manually

 Let’s take a look at an “Auditing

Accounts Receivable (A/R) file”
scenario…
 Audit Mathematics

Scenario: Auditing A/R file

With CAATs, the computer can be programmed to

select items from an A/R file, and (in the process of
looking at this file) extend and foot all invoicing
transactions.

Because of the speed of the computer, these

calculations can be performed on 100% of the items in a
file with no significant addition of time or cost for this
processing.
 Data Analysis

 CAATs allow computers to:

 compare and summarize data Data
 represent data in graphic form Analysis

Using three techniques

 Data Analysis

1) Histograms - graphical representation

of distribution of data; look for
relationships amongst the data
 Data Analysis
2) Modeling -
comparison
of current
data with
trends or
patterns as
a basis for
evaluating
reasonablen
ess
 Data Analysis

3) Comparative Analysis - compares same

data at different time periods

Example:
 compare yearly financial statements (e.g., Income
Statements, etc.)
 compare previous and current year inventory
balances
 variations in balances could lead to additional
tests (e.g., valuation, potential obsolescence,
etc.)
Comparative Analysis Example
 CAATs for Sampling
CAATs allow for the selection and
definition of the audit sample
 Judgmentally - based on auditor’s
experience
 Statistically - randomly generated
 CAATs for Sampling
Good approach - combine the 2 sample
methods.
 Examples: journal entries, purchase
approvals above certain limits, etc.)
Due professional care must always be
exercised in the application and
interpretation of results
Refer to Exhibit 4.8 for additional
statistical sampling techniques used
 CAATs for Application Reviews

Common techniques to test Applications:

Integrated test facility (built-in test environments)
Test data (auditor provides test transactions)
Parallel simulation (tests separate system)
Popular software packages:
 Audit Command Language (ACL)
 Interactive Data Extraction and Analysis (IDEA)

Refer to Exhibit 4.10 Computer-assisted audit

techniques for computer programs.
Audit Command Language (ACL)

General audit software that reads from

most formats
 e.g.,
databases, text files, de-limited files,
Excel files, etc.
Provides data selection, analysis, and
reporting.
File interrogation tool designed to assist
the audit of applications by handling and
processing large amounts of data.
Audit Command Language (ACL)

ACL functions range from:

(1) identifying negative, minimum, and
maximum balances;
(2) performing statistical sampling and aging
analyses;
(3) identifying duplicates or gaps in sequence
testing; and
(4) performing comparative joining and
matching; among others.
 ACL

Video – ACL Analytics

 Source: https://www.acl.com/products/acl-
analytics/
 Time: 2:46min
 Auditing Application Controls
Auditors typically perform procedures with
organization- or client-provided:
 Spreadsheets
 Databases

Spreadsheet or database controls commonly tested:

 checking for mathematical accuracy of records
 validating data input
 performing numerical sequence checks

Auditors must ensure these controls are effectively

implemented to ensure accurate results.
 Spreadsheet Controls
Controls should be
implemented in
spreadsheets to
minimize the risk of
bad data and incorrect
logic.
Some of the key
objectives/controls
that IT Auditors expect to
be in place to minimize
risks in spreadsheet
development and use
include:
Spreadsheet Controls
 Database Controls

Some of the key

objectives and
controls that IT
Auditors expect to
be in place to
minimize risks in
databases
include:
Database Controls
CAATs for Operational Reviews

Several techniques to test Operations:

 ACL, IDEA (file interrogation SW)
 SW Asset Management (SAM)

 Disaster Recovery System (DRS)

Appropriate use and application for above

techniques rely on training, sharing of
experiences, and supervision
 Auditing Around the Computer

Auditor obtains source documents associated with

particular input transactions and reconciles them
against output results
Audit supporting documentation is drawn and
conclusions are reached without considering how
inputs are being processed to provide outputs
 Procedures do not verify/validate whether program logic is
correct, nor it evaluates how the application and its
embedded controls respond to various types of transactions
(anomalies) that can contain errors
Auditing Around the Computer
Auditing Through the Computer

Auditors perform various steps to assess the clients

application system in order to determine reliability of
operations and operating effectiveness of the related
general computer controls (e.g., processing controls,
access controls, etc.)
Has significantly increased and impacted the audit
process
Auditing Through the Computer
 Computer Forensics
Examination, analysis, testing, and
evaluation of computer-based material
conducted to provide relevant and valid
information to a court of law
Fast growing area of CAATs
Computer Forensics Tools
Support law enforcement, computer
security, and computer audit
investigations.
Computer Forensics Tool Testing
(CFTT) Project Web Site at
http://www.cftt.nist.gov
 Homework Problems
Chapter 4:
 Review Questions: [chosen by Instructor]
 Exercises: [chosen by Instructor]

Due: [chosen by Instructor]

END OF CHAPTER 4