IT Auditing, Hall, 3e

Transcription

1 IT Auditing,

2 an economic event that affects the assets and equities of the firm, is reflected in its accounts, and is measured in monetary terms. similar types of transactions are grouped together into three transaction cycles: the expenditure cycle the conversion cycle the revenue cycle 1

3 Relationship between Transaction Cycles 2

4 Expenditure Cycle: time lag between the two due to credit relations with suppliers: physical component (acquisition of goods) financial component (cash disbursements to the supplier) Conversion Cycle : the production system (planning, scheduling, and control of the physical product through the manufacturing process) the cost accounting system (monitors the flow of cost information related to production) Revenue Cycle: time lag between the two due to credit relations with customers : physical component (sales order processing) financial component (cash receipts) 3

5 Source Documents - used to capture and formalize transaction data needed for transaction processing Product Documents - the result of transaction processing Turnaround Documents - a product document of one system that becomes a source document for another system 4

6 Journals - a record of chronological entry special journals - specific classes of transactions that occur in high frequency general journal - nonrecurring, infrequent, and dissimilar transactions Ledger - a book of financial accounts general ledger - shows activity for each account listed on the chart of accounts subsidiary ledger - shows activity by detail for each account type 5

7 Flow of Information from Economic Event Into the General Ledger 6

8 Accounting Records in a Computer-Based System EXPLANATION OF STEPS IN FIGURE: 1. Compare the AR balance in the balance sheet with the master file AR control account balance. 2. Reconcile the AR control figure with the AR subsidiary account total. 3. Select a sample of update entries made to accounts in the AR subsidiary ledger and trace these to transactions in the sales journal (archive file). 4. From these journal entries, identify source documents that can be pulled from their files and verified. If necessary, confirm these source documents by contacting the customers. 7

9 Example of Tracing an Audit Trail Verifying Accounts Receivable Accounts Receivable Control Account-General Ledger Accounts Receivable Subsidiary Ledger (sum of all customers receivables) Physical Sales Journal Financial Cash Receipts Journal Sales Order Shipping Notice Deposit Slip Remittance Advice 8

10 The audit trail is less observable in computer-based systems than traditional manual systems. The data entry and computer programs are the physical trail. The data are stored in magnetic files. 9

11 Master File - generally contains account data (e.g., general ledger and subsidiary file) Transaction File - a temporary file containing transactions since the last update Reference File - contains relatively constant information used in processing (e.g., tax tables, customer addresses) Archive File - contains past transactions for reference purposes 10

12 Documentation in a CB environment is necessary for many reasons. Five common documentation techniques: Entity Relationship Diagram Data Flow Diagrams Document Flowcharts System Flowcharts Program Flowcharts 11

13 A documentation technique to represent the relationship between entities in a system. The REA model version of ERD is widely used in AIS. REA uses 3 types of entities: resources (cash, raw materials) events (release of raw materials into the production process) agents (inventory control clerk, vendor, production worker) 12

14 Represent the numerical mapping between entities: one-to-one one-to-many many-to-many 13

15 Cardinalities Entity Relationship Entity Salesperson 1 Assigned 1 Car Type Customer 1 Places M Order Vendor M Supply M Inventory 14

16 use symbols to represent the processes, data sources, data flows, and entities in a system represent the logical elements of the system do not represent the physical system 15

17 Entity Name Data Store Name N Process Description Direction of data flow 16

18 illustrate the relationship among processes and the documents that flow between them contain more details than data flow diagrams clearly depict the separation of functions in a system 17

19 Symbol Set for Representing Manual Procedures Terminal showing source or destination of documents and reports Source document or report Calculated batch total On-page connector Manual operation File for storing source documents and reports Accounting records (journals, registers, logs, ledgers) Off-page connector Description of process or comments Document flowline 18

20 Flowchart Showing Stated Fact Translated into Visual Symbols Sales Department Credit Department Warehouse Shipping Department Customer Customer Order Prepare Sales Orders Sales Order Sales #1 Order #1 Sales Order #1 Sales Order #1 19

21 Flowchart Showing All Stated Facts Translated into Visual Symbols 20

22 are used to represent the relationship between the key elements--input sources, programs, and output products--of computer systems depict the type of media being used (paper, magnetic tape, magnetic disks, and terminals) in practice, not much difference between document and system flowcharts 21

23 Symbol Set for Representing Computer Processes Hard copy Terminal input/ output device Computer process Process flow Direct access storage device Real-time (online) connection Magnetic tape Video display device 22

24 Flowchart Showing Translation of Facts 1, 2, and 3 into Visual Symbols 23

25 2 4

26 illustrate the logic used in programs Program Flowchart Symbols Logical process Terminal start or end operation Decision Input/output operation Flow of logical process 25

27 Modern systems characteristics: client-server based and process transactions in real time use relational database tables have high degree of process integration and data sharing some are mainframe based and use batch processing Some firms employ legacy systems for certain aspects of their data processing. Accountants need to understand legacy systems. Legacy systems characteristics: mainframe-based applications batch oriented early legacy systems use flat files for data storage later legacy systems use hierarchical and network databases data storage systems promote a single-user environment that discourages information integration 26

28 27

29 Destructive updates leave no backup. To preserve adequate records, backup procedures must be implemented, as shown below: The master file being updated is copied as a backup. A recovery program uses the backup to create a pre-update version of the master file. 28

30 Two broad classes of systems: batch systems real-time systems

31 A batch is a group of similar transactions that are accumulated over time and then processed together. The transactions must be independent of one another during the time period over which the transactions are accumulated in order for batch processing to be appropriate. A time lag exists between the event and the processing. 30

32 Batch Processing/Sequential File Sales Orders Keying Unedited Transactions correct errors and resubmit Errors Edit Run catches clerical errors Edited Transactions Sort Run rearranges the transaction data by key field so that it is in the same sequence as the master file Transactions Old Master (father) New Master (son) AR AR Update Run changes the values in the master file to reflect the transactions that have occurred Transactions (eventually transferred to an archive file) 31

33 Keystroke - source documents are transcribed by clerks to magnetic tape for processing later Edit Run - identifies clerical errors in the batch and places them into an error file Sort Run - places the transaction file in the same order as the master file using a primary key Update Run - changes the value of appropriate fields in the master file to reflect the transaction Backup Procedure - the original master continues to exist and a new master file is created 32

34 Organizations can increase efficiency by grouping large numbers of transactions into batches rather than processing each event separately. Batch processing provides control over the transaction process via control figures. 33

35 process transactions individually at the moment the economic event occurs have no time lag between the economic event and the processing generally require greater resources than batch processing since they require dedicated processing capacity; however, these cost differentials are decreasing oftentimes have longer systems development time 34

36 35

37 AIS processing is characterized by high-volume, independent transactions, such are recording cash receipts checks received in the mail. The processing of such high-volume checks can be done during an off-peak computer time. This is one reason why batch processing maybe done using real-time data collection. 36

38 Concisely represent large amounts of complex information that would otherwise be unmanageable Provide a means of accountability over the completeness of the transactions processed Identify unique transactions and accounts within a file Support the audit function by providing an effective audit trail 37

39 Represent items in sequential order Used to prenumber source documents Track each transaction processed Identify any out-of-sequence documents Disadvantages: arbitrary information hard to make changes and insertions 38

40 Represent whole classes by assigning each class a specific range within the coding scheme Used for chart of accounts The basis of the general ledger Allows for the easy insertion of new codes within a block Don t have to reorganize the coding structure Disadvantage: arbitrary information 39

41 Represent complex items or events involving two or more pieces of data using fields with specific meaning For example, a coding scheme for tracking sales might be , meaning: Store Number Dept. Number Item Number Salesperson Disadvantages: arbitrary information overused 40

42 Used for many of the same purposes as numeric codes Can be assigned sequentially or used in block and group coding techniques May be used to represent large numbers of items Can represents up to 26 variations per field Disadvantage: arbitrary information 41

43 Alphabetic characters used as abbreviations, acronyms, and other types of combinations Do not require users to memorize the meaning since the code itself is informative and not arbitrary NY = New York Disadvantages: limited usability and availability 42

44 Input Process Output General ledger systems should: collect transaction data promptly and accurately classify/code data and accounts validate collected transactions/ maintain accounting controls (e.g., equal debits and credits) process transaction data post transactions to proper accounts update general ledger accounts and transaction files record adjustments to accounts store transaction data generate timely financial reports 43

45 Billings Financial Reporting System Management Reporting System Sales Cash Receipts General Ledger System (GLS) Inventory Control Payroll Cost Accounting Accounts Payable Cash Disbursements 44

46 General ledger master file principal FRS file based on chart of accounts General ledger history file used for comparative financial support Journal voucher file all journal vouchers of the current period Journal voucher history file journal vouchers of past periods for audit trail Responsibility center file financial data by responsibility centers for MRS Budget master file budget data by responsibility centers for MRS 45

47 46

48 Source documents Journal entries in the journal Post entries to the ledger Trial balance Adjusting and closing Financial statements 47

49 48

50 General ledger analysis: listing of transactions allocation of expenses to cost centers comparison of account balances from prior periods trial balances Financial statements: balance sheet income statement statement of cash flows Managerial reports: analysis of sales analysis of cash analysis of receivables Chart of accounts: coded listing of accounts 49

51 Improperly prepared journal entries Unposted journal entries Debits not equal to credits Subsidiary not equal to G/L control accounts Inappropriate access to the G/L Poor audit trail Lost or damaged data Account balances that are wrong because of unauthorized or incorrect journal vouchers 50

52 Transaction authorization - journal vouchers must be authorized by a manager at the source dept Segregation of duties G/L clerks should not: have recordkeeping responsibility for special journals or subsidiary ledgers prepare journal vouchers have custody of physical assets 51

53 Access controls: Unauthorized access to G/L can result in errors, fraud, and misrepresentations in financial statements. Sarbanes-Oxley requires controls that limit database access to only authorized individuals. Accounting records - trace source documents from inception to financial statements and vice versa 52

54 Independent verification G/L dept. reconciles journal vouchers and summaries. Two important operational reports used: journal voucher listing details of each journal voucher posted to the G/L general ledger change report the effects of journal voucher postings on G/L accounts 53

55 54

56 Advantages: immediate update and reconciliation timely, if not real-time, information Removes separation of transaction authorization and processing Detailed journal voucher listing and account activity reports are a compensating control Centralized access to accounting records Passwords and authorization tables as controls 55

57 Format used to produce Web pages defines the page layout, fonts, and graphic elements used to lay out information for display in an appealing manner like one sees in magazines and newspapers using both text and graphics (including pictures) appeals to users Hypertext links to other documents on the Web Even more pertinent is HTML s support for hypertext links in text and graphics that enable the reader to jump to another document located anywhere on the World Wide Web. 56

58 XML is a meta-language for describing markup languages. Extensible means that any markup language can be created using XML. includes the creation of markup languages capable of storing data in relational form, where tags (formatting commands) are mapped to data values can be used to model the data structure of an organization s internal database 57

59 XBRL is an XML-based language for standardizing methods for preparing, publishing, and exchanging financial information, e.g., financial statements. XBRL taxonomies are classification schemes. Advantages: Business offer expanded financial information to all interested parties virtually instantaneously. Companies that use XBRL database technology can further speed the process of reporting. Consumers import XBRL documents into internal databases and analysis tools to greatly facilitate their decision-making processes. 58

60 Audit implication for XBRL taxonomy creation: incorrect taxonomy results in invalid mapping that may cause material misrepresentation of financial data validation of instance documents: ensure that appropriate taxonomy and tags have been applied audit scope and timeframe: impact on auditor responsibility as a consequence of real-time distribution of financial statements 59