General Computer Controls Flashcards
1
Q
Name 7 general controls for computers
A
- System development and implementation controls
- System maintenance controls
- Organisational and management controls
- Access controls to data and programs
- Computer operating controls
- System software controls
- Business continuity controls
2
Q
What is an on-line system?
A
A computer system where data is captured via a terminal as the transaction occurs and the data is immediately edited, processed and written to computer file.
3
Q
Name the advantages of on-line system.
A
- Files are up to date
- Accuracy of entry
- The risk of non-recording of transactions is small
- The system is fast
4
Q
Name the disadvantages of on-line system.
A
- Absence of visible entry and audit trails
- Higher risk of unauthorized:
- access to the system and data
- processing on the system
- changes to data
5
Q
Give the characteristics of an on-line system.
A
- On-line (direct)entry of data
- Authorization of input by the system through validation tests
- On-line access to the system by users
- Absence of visible audit trails
- Risk that programmers could gain unauthorized access to the system
6
Q
What are the risk indicators specific to IT environment?
A
- Risks which relate to the integrity of financial information (relevant to both management and auditors)
- Risks relate principally to Management’s requirements
7
Q
What are the risks relating to the integrity of financial information relating to access?
A
- Uncontrolled access to data leading to:
- duplication
- corruption
- manipulation
- sabotage
- unauthorized processing of data
- Unauthorized changes to transaction data
- Unauthorized changes to master files (standing data)
- Uncontrolled access to programs leading to unauthorized changes
- Access through a third party such as service provider
- Corruption of data by viruses
8
Q
What are the risks relating to the integrity of financial information relating to input?
A
- Absence of input documentation
2. Lack of visible audit trail providing evidence of authorization
9
Q
What are the risks relating to the integrity of financial information relating to transfer of data?
A
- Unauthorized access through telephone lines, wireless connections, etc which could result in duplication, corruption or manipulation of data on transfer
- Data could be lost or corrupted in transmission
10
Q
What are the risks relating to the integrity of financial information relating to staff issues?
A
- Loss of supervision in a decentralized/distributed processing environment
- Staff may be limited experience of or lack training on computers
- Segregation of duties may be weaker
11
Q
What are the risks relating to the integrity of financial information relating to processing?
A
- Multiple functions performed by single person
- Where systems are integrated, individual errors may affect different systems
- System generated transactions
- Uniform processing duces the risk of clerical error but may increase the risk of consistent error
- Errors might not be noticed owing to high speed of processing and the volumes involved
12
Q
What are the risks relating to the integrity of financial information relating to output?
A
- Absence of reports /loss of audit trail
2. There is often less manual review of information
13
Q
What are the risks relating to the integrity of financial information relating to continuity?
A
- Loss of data
14
Q
What are the risks relating to the integrity of financial information relating to specific issues?
A
- Financial loss due to electronic fund transfer
- Failure to clear computer suspense files
- Abuse of credit cards
15
Q
What are the risks relating to the integrity of financial information relating to general issues?
A
- Types of computer used
- Types of software: developed or bought
- The processing method applied and any changes thereto
- Effectiveness of the control environment and Management’s attitude towards computer controls
- Effectiveness of computerized controls and potential weaknesses in:
- general controls
- application controls
- Nature of the business/ transactions
- The size of the entity and the volume of transactions
- Materiality of data/transaction processed
16
Q
What are the risks relating principally to management’s requirements relating to access?
A
- Confidentiality of data
- Unauthorized use of data
- Business continuity could’ve affected by viruses,hackers or denial of service attacks
- Privacy of third parties’ data
17
Q
What are the risks relating principally to management’s requirements relating to computer fraud?
A
- Possible fraud
18
Q
What are the risks relating principally to management’s requirements relating to quality of management information?
A
- Completeness of information
- Availability of information
- Usefulness of data provided
- Whether data is up to date
- Loss of continuity leading to temporary lack of data
19
Q
What are the risks relating principally to management’s requirements relating to operating issues?
A
- Inability of system to cope with volumes could result in poor customer service
- Contractual liability arising from dealing with third parties
- Non-compliance with tax law, regulation or software license conditions
- Loss of control where third parties are involve
- Adequacy and competence of IT staff
- Dependence on communication
- Dependence on technology
- Cost control
- Staff morale problems arising from changes in systems
20
Q
What are some control risks in an IT environment?
A
- Program processing data inaccurately
- Inaccurate data
- Failure to make necessary changes to systems
- Unauthorized access to data
- Inappropriate manual intervention
- A breakdown in segregation of duties
- Unauthorized changes to systems or programs
- Unauthorized changes to data in master files
- Loss of data or inability to access data as required
21
Q
What are some benefits of IT controls?
A
- Consistent processing
- Accurate complex calculations for larger volumes of data
- Enhanced timeliness, availability and accuracy of information
- Additional, and more accurate, analysis of information
- Enhanced monitoring of performance of the entity’s activities and compliance with policies and procedures
- Reduce the risk of control override
- Improved security over systems and data
22
Q
What is the objective of general computer controls?
A
Maintenance of integrity of data and programs
Effective functioning of the computer system
23
Q
Identify the feasibility studies need to be done when purchasing a new computer system
A
- User needs
- Specification and requirements of available packages
- Costs
- Assistance and support by suppliers
- Adaptability and expansion ability of the package
- Standing and reputation of the supplier
- Conclusion supported by enquiring with staff and testing
24
Q
Name the steps in purchasing a new computer system package
A
- Feasibility study
- Authorization by management, users and computer staff
- Implementation
- System conversion
25
List the advantages of a purchased system
1. Immediate installation
2. Pre-determined costs, often cheaper
3. Criteria reviewed at demonstration before buying therefore reduce risk
4. Usually de-bugged and error-free
5. Documentation sold with package
6. Supplier usually offer training
7. Supplier support
8. Continual upgrade with new version at reasonable cost
26
List the disadvantages of a purchased system
1. Not tailor-made to requirements
2. Pre-written and not adaptable for changes
3. Processing speed and storage space not always sufficient
4. Written to supplier standards
5. Often overseas, not cater for SA requirements
6. Manual often inadequate and low quality
27
List the steps in system conversion for a new system
1. Plan
2. Prepare for conversion
3. Control by data control group
4. Testing after conversion
5. System documentation updated
6. Back up new system/files
7. Post implementation review
28
What needs to be included in planning of system conversion?
1. Date and time schedules prepared
2. Cut-off point determined
3. Conversion method defined
29
What needs to be done for preparation of conversion?
1. Preparation of standing data files on the new system
2. Balancing files on the old system
3. Training staff
4. Prepare premises
5. Authorization of data to be transferred
30
What are the testing done after system conversion?
1. Balancing of files on new with balances in old - control totals
2. Print-out of converted data and compare with source data/report from the old system
3. Follow up items on exception reports
4. Approval by users
31
System documentation updated should include the following...
1. Approval documents
2. Application documents, including course codes
3. File documentation, including file layouts
4. Operation documentation (instruction/ manuals)
5. Documentation concerning testing
6. Approval at various stages
32
What are the purposes of system documentations?
1. Record investigation, development, design and approval
2. Provide basis of communication between systems analysts and
Programmers
3. As processing manual
4. Source references
5. For review and change to system
6. Staff training
7. Basis of evaluation of internal controls
33
Steps involved in developing a system in-house.
1. Project authorization
2. Project management
3. Determine user needs
4. Purchase of hardware and software
5. Standards in respect of system development and programming
6. System specification and programming
7. Testing of system
8. Approval
9. Training
10. System documentation
11. Back ups
12. Conversion
13. Post implementation review
14. Long term plan
34
What is involved in project authorization?
1. System development plan
2. Steering committee conduct feasibility study and define selection criteria
3. Result from requests by users and management
4. Feasibility study
5. Authorization after analyzing user needs and performing proper system analysis
6. System specification should be developed regardless of any specific technology hardware which may be available
7. Project authorized before commencement by computer steering committee
35
What is involved in project management when developing a system in house?
1. Project team made up of management and user computer staff
2. Development in stages
3. Functions of the system analysis and programmers are to be defined
4. Deadlines and time schedules must be prepared for each task and stages of the project
5. Formal plan of action and development
36
What is involved in the system maintenance controls?
1. Changes to a system after implementation to correct errors or meet the changing needs of users
2. Requests for changes/ corrections promptly completely carried out
3. Only authorized changes should be made
4. Compliance with standard
5. Controls over program changes
6. Testing and final approval
7. Changes made to test version not live version
8. Changes fully documented
9. Changes backed up and stored in program library
10. Train users
11. Post-implementation review
37
What is included in organizational and management controls?
1. Division of duties, review and virus protection are met
2. Level of responsibility determined
3. Division of duties
38
Division of duties...
1. Separate IT department
2. Computer department segregated from user department
3. Within the computer environment
4. Management
5. Supervision and review
6. Staff policies
7. All computer output to be reviewed by user department
8. Controls against viruses
9. Email policy to be in place
39
What should be considered when segregation of duties from computer department to user department?
1. Computer department not to to originate or authorize transactions
2. Computer department not to have control over non-computer assets
3. Computer department not to authorize master file changes
4. User department to review all master file changes
5. User department to maintain independent control totals
6. User department to have custody over stationery
40
What are some organizational and management controls within staff policies?
1. Employment of honest qualified, competent reliable IT staff
2. Rotation of IT staff duties
3. IT staff must regularly take leave
4. Scheduling of work
5. Training and career development
6. Supervision and review
7. Cancellation of access on dismissal
41
Access controls to data and programs
1. Procedures designed to restrict access to on-line terminals, devices, programs and data
2. User authorization
3. User authentication
4. Program security
5. Data file security
6. Access to terminals and files
7. Access through other electronic devices
42
Access controls framework:
Programmed controls and user controls
43
Programmed control for access control:
1. Terminal controls -limit access to specific applications
2. Identification of users
3. Authorization of users
4. Authorization of use
5. Use access control software
6. Monitoring access and processing
7. Communication line and networks
8. Password control
9. Restrict access
10. Data to be encrypted
11. Establish separate systems for vulnerable and sensitive applications
12. Program library control
13. Utilities control
14. User programming controls
15. Terminals and other electronic devices
44
What can be used for user authentication?
1. Unique login ID
2. Passwords
3. Access cards
4. Biometric data
45
Name the programmed controls for terminals and other electronic devices.
1. Device disconnect after 5 mins of inactivity
2. Terminal is disconnected and shut down after 3 unsuccessful attempts to gain access
3. Investigation to each disconnection
4. Simultaneous log on by one user at more than one terminal is prohibited
5. Restricted hours of operation
6. Polling by central computer of remote devices to ID unauthorized users
46
Name the ways programmed control is used to identify users
1. Passwords and their identification numbers
2. Verify user's computer serial number
3. Verify user's Internet protocol (IP) address
4. Use of biometric data
5. Magnetic card
47
Programmed control for authorization of users
1. Log-on IDs
2. Passwords
- required to sign on and off
- limit access to system/ part of system
- limit access to certain terminals
- limit processing/access to certain time of day
48
Programmed controls for authorization of use
1. Passwords structured for authorized levels of access
2. Multi-level passwords
3. One time passwords
4. Introduce a system of system owners
49
List the password controls
1. Maximum length
2. Mix of alphabet and numerical and other characters
3. Not obvious or easily guessed
4. Not shown on screen
5. Changed regularly - forced by system
6. Confidentiality emphasized to users
7. Rejects identical password used already
8. Cancelled immediately on resignation/dismissal
9. Cancelled after specific period of inactivity
10. Cancelled after a number of unsuccessful attempts to gain access
11. Changes to passwords should be logged and reviewed
50
List the physical access controls implemented by users
1. Terminals locked in visible area and in lockable terminal room with access control
2. Computer hardware situated in lockable room with constant supervision and review and physically secured
3. Use of terminal logs to control over processing
4. Distributed processing
5. All logs and activity register should be regularly reviewed and followed up by independent person
6. Screening and training of staff before access
7. Controls allowing circumvention of access controls in case of emergency
51
List the computer operating controls
1. Proper operation of the system and procedures applied correctly and consistently
2. Duties of IT controllers to be defined
3. Scheduling of processing
4. Set-up of execution of programs
5. Use correct programs
6. Use correct data files
7. Operating procedures
8. Recovery procedures
52
What are the recovery procedures for computer operating controls?
1. Emergency plan and written instructions for error correction
2. Backup of data after processing stored on separate premises
53
List the operating procedures in computer operating controls
1. Monitor and review of functioning of the hardware
2. Standardized procedures and operating instructions
3. User manuals
4. Division of duties
5. Supervision and review
6. Rotation of duties
7. Maintenance of system and manual logs with regular follow up by management
54
List the system software controls
1. Ensure installed or developed and maintained in an authorized and effective manner
2. Acquisition, development of and changes to system software
3. Security over system software
4. Database system - access controls
5. Networks - programmed controls
6. Processing by users on PCs - control of software
55
List the business continuity controls
1. Ensure continuity of processing, be preventing system interruption or limiting to a minimum
2. Physical environment controls
3. Emergency plan and disaster recovery procedures
4. Back ups
5. Other controls
56
List the controls to physical environment
1. Protection against elements
- fire (extinguisher)
- water (away from taps)
- power (uninterrupted power supply)
- environment (air conditioned, constant humidity, dust free)
57
What is involved in back ups for business continuity controls
1. Back up data files regularly on rotation basis
2. store copies of backup files on separate premises
3. Removable media is stored in fireproof facilities
4. Arrange for hardware back up facilities
5. On-line back ups
6. Retention of data, records and files for required time
58
List the other controls in business continuity controls
1. Physical security
2. Proper system development including selection of suppliers and testing the system
3. Maintenance of hardware
4. Adequate insurance
5. Cable protection
6. Uninterrupted power supply
7. Prevention of viruses
8. No over-reliance on staff
9. Logical access controls
10. Personnel controls affecting security and continuity
59
What are application controls?
Application controls are control over the input, processing and output of financial information to ensure that the information is valid, complete and accurate. It includes programmed and user controls.
60
List the objectives of application controls
1. Validity
2. Completeness
3. Accuracy
61
Application controls over input is to ensure that data entered to update master file is valid,complete and accurate. It prevents the following for occurring.
1. Unauthorized data entered
2. Error in creation of data
3. Data lost during input
4. Data added or altered
5. Error in correction and re-entering of rejected data
6. Corruption of data during capture or transfer
62
List the programmed controls that will ensure completeness of input.
1. Sequential numbering
2. Matching by computers
3. Field presence checks
63
List the user controls that will ensure completeness over input.
1. Stationery control
| 2. Examination of processing logs for missing input entries
64
List the programmed controls that will ensure accuracy of input.
1. Matching transaction with data on files by computer
2. Edit checks(validation checks) to test accuracy of data
3. Batch input and processing
65
List the edit checks performed by computer to ensure accuracy of input.
1. Formatting checks - numerical/alphanumeric
2. Sign check - positive/negative
3. Screen check - checking of accuracy by users
4. Screen prompt - "are you sure?"
5. Validity/existence - field size, codes etc
6. Limit and reasonableness check - comparison with predetermined values
7. Check digits - accuracy of codes
8. Control totals - batch processing and comparison
9. Dependency check - check interdependence of data in respect of other fields
10. Field presence - all critical input fields are present
11. Field size check - overflow of fields
12. Specific character - space in the right place
13. Arithmetic check
14. Logic check
66
List the user controls to ensure accuracy of input
1. Review by user/senior staff
2. Batch input and process
3. Use well designed documents to minimize error
4. Staff training
67
List the programmed controls for validity of input
1. Access controls
2. Authorization of transactions
3. Authorization of changes to data
4. Transaction generated by computer
5. Validation tests
68
List the user controls to ensure validity of input
1. Segregation of duties, staff training and staff recruitment policies
2. Authorization of transactions by user
3. Review authorization procedures
4. Authorization of changes to data
69
List the programmed controls that will ensure that all objective are met.
1. Control totals and reconciliation
| 2. Batch processing - balancing batch totals
70
List the user controls that will ensure all objectives are met.
1. Control totals and reconciliation
2. Batch processing - senior independent person to check for errors
3. Reviewing of output reports by users
4. Regular back ups during and after processing
5. Adequate error correction procedures
71
Application controls during processing prevents the following from occurring.
1. Data altered during processing
2. Calculative or accounting errors
3. Logic, precision rounding errors
4. Incorrect program or data file
5. Incorrect values or internal tables in program
6. Data corrupted during transmission
7. Equipment malfunction
72
List the programmed controls that will ensure completeness of processing.
1. Reconciliation of control totals
2. Sequential testing by computer
3. Reconciliation of accounts/balances
4. Logs of processing
5. Edit tests by computer programs
6. Control over transmission of data
73
List the user controls that will ensure completeness of processing.
1. Reconciliation of control totals
2. Sequential testing by the computers checked by senior independent person
3. Reconciliation of accounts/balances
4. Logs of processing checked and reviewed regularly
5. Break point re-runs
6. Processing errors reported and corrected
7. Adequate back up procedure
74
List the programmed controls that will ensure the accuracy of processing.
1. Control over computer hardware
2. Edit checks by computer program
3. Produce exception report for review by management
4. Reconciliation and balance of control totals and control accounts
5. Batch controls where data is processed in batches as opposed to online real time processing
75
List the user controls that will ensure accuracy of processing
1. Exception report, reconciliation and batch processing
2. Operator's manual and user instruction
3. Supervision a d review by competent staff
76
List the programmed controls that will ensure validity of processing.
1. Access control over transactions and standing data during processing
2. Librarian function to ensure correct program and file version used
3. Files should have internal or external label and program should be identified with version numbers
4. Computer monitor and prints abnormal activities
5. Record of comparison and matching by the computer
6. Computer generate adequate audit trails
77
List the user controls to ensure validity of processing
1. Authorization of override if incorrect version is detected
2. Authorize manual intervention if the system breaks down
3. User logs for monitoring unscheduled processing
78
List the programmed controls that will ensure the completeness of processing or changes to master files
A sequentially numbered audit trail of master file changes is produced
79
What is the user control implemented to ensure completeness of processing or changes to master file.
Reconciliation of changes with the list/register of requests for changes and follow-up of outstanding items
80
Name the programmed control that will ensure validity of processing or changes to master files.
Access controls and levels of authorization on the system
81
Name the user control to ensure validity of processing or changes to master files
Written authorization of changes by senior management and checking of changes to master files
82
Programmed controls that will ensure all objectives are met in terms of master files
Master file is protected by:
- encryption
- library control
- record counts
- reconciliations
83
What is the user control that will ensure all objectives are met with regards to master files?
The whole master file is reviewed regularly by management.
84
List the programmed controls that will ensure completeness of output.
1. Output reports should be sequentially numbered
85
List the user controls that will ensure completeness of output.
1. IT control group to follow up missing numbers
2. Review of output reports by users
3. Reconciliation of input to output by the IT control group
4. Sequence check on page numbers or document numbers
5. End of report message
6. Page counts
7. Reviewing of report by users for missing/duplicated items
86
List the programmed controls that will ensure the validity (authorisation) of output
1. Logs, listing activities and output produced, maintained by computer system regularly reviewed by IT control group for unauthorized output
87
List the user controls that will ensure validity of output
1. Distribution list of authorized users, listing to whom output is to be sent
2. Distribution schedule
3. Distribution controlled by the IT control group
4. Distribution register in which user sign for receipt
5. Review of report by users
88
List the user controls that will ensure accuracy of output.
1. Reconciliation of output to input by user department for accuracy of processing
2. Review of output by IT users for obvious errors
3. physical checking of accuracy of calculation by users
4. Review and follow up of items in exception reports by an independent control group
5. Scrutiny (review) of processed information by users for accuracy
6. Checking by users of the accuracy of posting from subsidiary ledgers to general ledger
89
List the programmed controls that will ensure confidentiality of output
Control over online output
- access controls to limit access to information on screen
- users should log out or log off when the terminal or device are not in use
- terminal or device to be disconnected automatically if not used for a specific period
- user should be forced to log on after system interruption to prevent data from remaining on the screen
- simultaneous log-on by users prohibited
90
List the user controls to ensure confidentiality of outputs
1. Only authorized users have access to terminals
2. Restrictions on which printers can be used for confidential reports
3. Controls over stationery used for confidential reports
91
Additional issues to be considered when auditing in an information technology environment
1. Engagement consideration - knowledge and skills required
2. Planning - understand the computer environment and internal control system
3. Consider risks in the system
92
List the general controls in database system
1. Standard approach for development and maintenance of application programs
2. Data ownership
3. Access to database
4. Division of duties
5. Data resource management
6. Database recovery
93
List the impact on audit procedure in a database system
1. The extent to which database are used to process accounting data
2. Type and materiality of transaction processed
3. Nature of files and programs used
4. Adequacy of general controls and application controls
5. Access control and security
6. Standards and procedures for development and maintenance of application programs in database
7. How data resources are managed
8. Job descriptions, standards
9. Controls and procedures to ensure security, integrity and accuracy of data
10. Availability of audit facilities within the database system
94
List the use of database system for auditing purposes.
1. Generate test data
2. Test access controls
3. Print audit trails
4. Test the integrity of the database
5. Provide access to enable the use of CAATs
6. Obtain information which is necessary for audit purposes
95
Name the important aspects when it comes to developing and understanding of the computer environment and processing in the planning process of an audit.
1. The entity's use and attitude towards information technology
2. The use of information technology in relation to the industry
3. Changes and intended changes to the computer system
4. Changes and intended changes to non-financial system which will impact on the reporting function
96
List the aspects to be considered when gaining understanding of the accounting and internal control system in an information technology environment.
1. The organization structure
2. The extent to which the computer is used in each financial application
3. Complexity of processing
4. Availability of data
5. The hardware and software utilized
6. The layout and organization of facilities
7. Processing methods in use
8. Where information is processed
9. By whom
10. Overview of manual and computer controls
11. Extent of audit trails
12. Complexity of system
13. The need for CAATs
14. The extent to which the client depends on the computer system
15. Intended changes to the system
97
List the internal control characteristics and risks in a computer environment
1. Absence of input documentation
2. Lack of visible audit trails
3. Staff may have limited experience with computers
4. Segregation of duties
5. New system not functioning properly when first introduced
6. Lack of transaction audit trails
7. Absence of report
8. Potential errors and irregularities
9. Lack of human intervention to identify errors
10. Automatic initiation and generation of transactions
11. Dependence on programmed controls
98
List the formulation of an audit approach in information technology system.
1. Obtain understanding of the system
2. Consider implication of any new system
3. Combined (reliance can be placed on general and application controls) or substantive approach
4. Nature of audit procedure dependent test of controls
99
List the characteristics that would lead to necessity to increase test of controls in computer system.
1. Presence of controls which manages significant risks
2. Situation where sufficient audit evidence cannot be obtained from substantive procedure/testing alone
3. Large volume of information
4. No input documentations
5. Dependency on computerized controls
6. Complexity
7. System generate items
8. Integration
9. Lack of audit trails
10. Short retention of data
100
List the detailed review of the controls within computerized environment.
1. Perform a review of general and application controls
2. Decide on specific controls to be tested
3. Perform test of general control environment
4. Perform test on application controls
5. Evaluate the tests of controls
101
What is involved in view of general and application controls?
1. Detailed flow-chart, diagrams, notes, etc
2. Detailed internal control questionnaire
3. Enquiry with client staff
4. Full system walk through
102
How to decide on which controls to be tested?
1. Are the controls performed?
2. How well are the controls performed?
3. By whom are the controls performed?
4. Are the controls performed consistently throughout the year?
5. Conclude on which controls to rely on.
103
What is involved in detailed substantive procedures?
1. Timing
- detailed testing of transactions
- detailed testing to verify balances
- analytical review procedures
2. Extent
- reduced if control is sound
3. Timing
- influenced by result of tests of controls
104
What is a CAAT?
CAATs are computer assisted audit techniques.
| They are used to test computerized controls.
105
List the methods of CAATs.
1. Audit softwares
2. Purpose written softwares
3. Utilities
4. System management programs
106
System oriented audit software are used for the following.
1. Test data
2. Control and reprocessing
3. Program code analysis
4. Simulation
5. Embedded audit routine
107
List the steps in testing data in system oriented audit software.
1. Create simulated data by auditor and capture on the system for processing, results are checked against preprepared results.
2. Used to test controls and processing of data
3. Test data should include valid and invalid data
4. Auditor should ensure that test data runs in client's computer and on correct version of program
5. Major risks of test data are:
- lack of surprise element
- program subjected to test data may not be program used throughout the year
- possible corruption of live data
108
What does embedded audit routine involve?
1. Snapshot
2. Integrated test facility
3. Online audit
4. Evolving techniques
109
What is the data oriented audit software used for?
1. Used as substantive procedures to access, retrieve, manipulate data from computerized information system
110
What does an audit retrieval software do?
1. Used for re-perform casts and calculations
2. Perform investigations and analysis
3. Select samples
4. Extract summaries
5. Perform comparison
111
What are some of the uses of CAATs?
1. Substantive testing of detailed transactions and balances
2. Analyzing and selecting samples from a large volume of transactions
3. Analytical procedures
112
List the advantages of CAATs.
1. Assist in achieving audit efficiency by saving time
2. Reduction in audit costs
3. Improving the quality of the audit
4. Better knowledge of the computerized information system is developed
5. Able to deal with large volumes
6. Audit staff develop improved expertise
7. Reduced reliance on client computer personnel
8. Improved client service
113
Factors to consider in application of CAATs.
1. Computer knowledge, competence and experience
2. Availability of CAATs And computer facilities
3. Impracticality of human/manual testing
4. Effectiveness and efficiency
5. Timing of testing
6. Other considerations
114
List the characteristics of CAATs.
1. Ease of use
2. Require limited technical knowledge
3. Cost effective
4. Adaptable and flexible to meet auditor's need
5. Developed and run under audit supervision
6. Machine independent
7. Audit-oriented
8. Readily available
9. Good supplier support
115
List the procedures in the application of CAATs.
1. Determine the objectives of applications of CAATs
2. Determine the contents and accessibility of the entity's file
3. Define transactions to be tasted
4. Define the procedures to be performed
5. Define the output requirement
6. Arrange with client personnel for copies of the relevant data to be available
7. Identify audit and computer staff to assist in the design and application of CAATs
8. Estimate the costs and benefits
9. Control the application of CAATs
10. Administration of computer knowledge and facilities
11. Execute the application of CAATs
12. Reconcile all data used by CAAT with accounting records
13. Evaluate the results
14. Document the use off CAATs in working papers
116
Name the procedures to control audit retrieval software.
1. Participate in design and testing
2. Check program coding
3. Ensure that the software will run on the client operating system
4. Run audit software on small test files before running on main system
5. Ensure that the correct version of client files are used
6. Obtain evidence such as reconciliation to prove that the software functioned as planned
7. Ensure scrutiny over data and CAAT output
117
Name the procedures to control test data.
1. Checking of the sequence of test data runs
2. Test runs with small quantities of data
3. Comparison of processed results with own preprepared results
4. Confirmation that the correct version of the program was used
5. Confirmation that the program on which the test data was run is the same as the one used throughout the period
118
List the advantages of using PC
1. Eliminating manual casting cross-casting and other routine calculations may save time
2. Calculations, comparisons and other data manipulations are more accurately performed
3. Analytical calculations may be more efficiently perform
4. The Scope of analytical procedures may be broadened
5. Audit sampling may be more efficient
6. Working papers may be generated and are easily stored and Accessed
7. Graphic capabilities may allow the auditor to generate display and evaluate various financial and non-financial relationship graphically
8. Staff morale and productivity improved by reducing time spent on clerical tasks
9. Client personnel may not need to manually prepare as many schedules and otherwise spend as much time assisting the auditor
10. Computer generated working papers are generally more legible and Consistent
119
List the security in the used of personal computers
1. Limiting of client access
2. Programs and data file security
3. Security of client data
4. Staff
5. General
120
List the specific audit and control considerations for an online computer systems
1. Absence of established security policy
2. Distribution of various input device throughout the entity increases the risk of unauthorized used and input
3. Increased risk of unauthorized use of the computer such as unauthorized changes
4. Network have greater risk
5. Greater dependence on validation checks performed at time of entry
6. There is an increased risk of lost transactions owing to interruption of processing
