Computer Aided Audit Technique

Fasilkom UI
INTRODUCTION TO INFORMATION
SYSTEMS AUDIT
Computer Aided
Audit Technique
Objectives
Continous Auditing
Audit Productivity Tools
Computer-Assisted Audit Techniques (CAATs)
Computer Forensics Methods and Techniques
2
Benefits of Audit Automation
Risk
 Increase audit productivity Assessment
and coverage
Audit
Reporting
Schedule
 Provide responsiveness to
the change
 Enhance service quality by Audit Results Budget
having a standard set of

audit tools and procedures
Audit
Analysis
 Better knowledge Program
management
Audit Tests
3
What Is Continuous Auditing?
 Continous Auditing
 a methodology or framework that enables auditors (external and
internal) to provide written results on the subject matter using
one or a series of reports issued simultaneously.
 Continuous monitoring
 allows an organization to observe the performance of one or
many processes, systems or types of data. similar to executive
information systems.
 Continous Assurance :
 result of the combination of continous auditing and audit
oversight of continous monitoring
4
Continuum of Continuous
Auditing
5
Conceptual Model
6
Managment effort and audit
activity relationship
7
KEY STEPS TO IMPLEMENTING
CONTINUOUS AUDITING
 These steps include:

 Establishing priority areas.
 Identifying monitoring and continuous audit rules.
 Determining the process' frequency.
 Configuring continuous audit parameters.
 Following up.
 Communicating results.
8
CONTINUOUS AUDITING
 Establishing priority areas :

 Identify the critical business processes that need to be audited
by breaking down and rating risk areas.
 Understand the availability of continuous audit data for those
risk areas.
 Evaluate the costs and benefits of implementing a continuous
audit process for a particular risk area.
 Consider the corporate ramifications of continuously auditing the
particular area or function.
 Choose early applications to audit where rapid demonstration of
results might be of great value to the organization.
• Long extended efforts tend to decrease support for continuous
auditing. 9
CONTINUOUS AUDITING
 Identifying monitoring and continuous audit rules :

 determining the rules or analytics that will guide the continuous
audit activity, which need to be programmed, repeated
frequently, and reconfigured when needed .
 Determining the process frequency.
 consider the natural rhythm of the process being audited,
 including the timing of computer and business processes as well
as the timing and availability of auditors
 following up on testing results might increase the costs of the
continuous audit activity.
10
CONTINUOUS AUDITING
 Configuring continuous audit parameters.

 rules, initial parameters, and the activity's frequency ― also a
special type of parameter ― should be defined
 reconfigured based on the activity's monitoring results
 False positive – False Negative
 Following up.
 who will receive the alarm?
 when the follow-up activity must be completed?
 Communicating results
 development and implementation of communication guidelines
and follow-up procedures
11
 must consider the risk of collusion.
IMPLEMENTION ISSUES RELATTED
CONTINUOUS AUDITING
 Continuous Monitoring Vs. Continuous Auditing
 Obtain and nurture audit committee and senior management support
 Meta Control
 monitoring particular configurable items, continuous auditing
provides an additional level of controls and acts as a meta
control.
 Independence and Objectivity
 when these principles are impaired, so too is the value of an
audit.
 IT Auditor often asked to assist management with their CM efforts
 Develop and maintain the technical competencies and enabling
technology necessary
12
Use of software tools
Two categories
 Audit productivity tools: automate the audit
function and integrate information gathered
 Computer-assisted audit tools (CAATs): tools for
substantive audit tests such as data and control
evaluation
Appropriate use and application of CAATTs
relies on appropriate training, sharing of
experiences, and supervision.
13
Audit productivity tools
 Planning and tracking audit activities

 Spreadsheets or project management tools
 Documentation and presentations
 Word, PowerPoint, flowcharting, etc.
 Communications
 allows auditors to communicate but also provides access for
audit clients to exchange informatio
 Data management
 A central knowledge base, a central repository of historical data
 Groupware
 For distributed workforces
 Information sharing & individual customization
 Document-oriented databases
 Example: Lotus Notes, Ms Exchange, 14
CAATs
CAATs can be classified into four broad

categories:
 Data analysis software (GAS)
 Network security evaluation software/ utilities
 OS and DBMS security evaluation
software/utilities
 Software and code testing tools
15
CAATs
 Validate the process

 Test for the existence and execution of computer
controls at all levels
 Gather information and data from production cycles
 Support audit findings
 Gather evidence
16
General Audit Software
 perform required functions directly on application files,

this include :
 Analyze and compare files
 Select specific records for examination
 Conduct random samples
 Validate calculations
 Prepare confirmation letters
 Analyze aging of transaction files
 Examples:
 Audit Command Language (ACL)
 Interactive Data Extraction and Analysis (IDEA)
Dasar-Dasar Audit SI
Application Testing
 Submit a set of test data that will produce known results

 Both valid and invalid transactions
 Parallel simulation
 A copy of original program
 Reperform the logic of the application
 Could partially duplicate the application logic to test
key functions
 Continuous monitoring
 Extract anomalies in real time
18
Sampling
 Judgmental sampling
 Select the sample based on the auditor’s experience
 Item of audit interests
• Specify criteria based on amount, time, region, etc.
 Statistical sampling
 Random selection
 Representative of the population
 Various methods
• Random number samplings :
– Items are randomly selected from a population so that each
item has an equal chance of being selected. 19
Data Analysis
 Goal: using computers to compare and summarize data

 Histogram
 Graphical representation
 Identify relationships among data
 Modeling
 Identify trends or patterns for evaluating
reasonableness
 Comparative analysis
 Compare same data at different time periods
20
Other CATTS - Technique
 Transaction tagging:
 Follow a selected transaction through the entire
application (e.g., Trace function)
 Snapshot
 Examine selected variables
 Check the value before and after a certain process
 Integrated test facility
 Create a fictitious entity, such as a customer, within
the context of the regular application
 Process test transaction together with live inputs 21
Computer Forensics
 Computer criminals become more advanced right along

with the technology
 Fast developing field
 A few rules:
 Never work on the original evidence
 Establish and maintain a continuing chain of custody
 Document everything
22
Computer Forensics:
Challenges
 Advancement of encryption
 Maintaining credible certifications and industry
standards
 More standards need to be developed
 Hiding data
 Various data storage media
 Change file extension
 Requires high degree of patience and perseverance
23

Computer Aided Audit Technique

Uploaded by

Copyright:

Available Formats

Computer Aided Audit Technique

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Computer Aided Audit Technique

Uploaded by

Copyright:

Available Formats

Fasilkom UI

 Enhance service quality by Audit Results Budget

having a standard set of

 These steps include:

 Establishing priority areas :

 Identifying monitoring and continuous audit rules :

 Configuring continuous audit parameters.

 Planning and tracking audit activities

CAATs can be classified into four broad

 Validate the process

 perform required functions directly on application files,

 Submit a set of test data that will produce known results

 Goal: using computers to compare and summarize data

 Computer criminals become more advanced right along

You might also like