Advanced Audit Final

Front 1

SSA (strategic systems audit)

Back 1

auditor learns client's strategies, processes, and business risks for a more effective audit

Front 2

3 primary phases of SSA

Back 2

1. strategic analysis-external concerns
2. process analysis-internal concerns
3. audit/residual risk analysis-links business risks to objectives of audit

Front 3

PEST analysis

Back 3

4 forces: political, economic, social, and technological

Front 4

Porter's 5 competitive forces

Back 4

threat of new entrants
bargaining power of buyers
bargaining power of suppliers
threat of substitutes
intensity of competitor rivalry

Front 5

CSFs (critical success factors)

Back 5

elements of competitive strategy, product attributes, resources, etc that most affect the ability of the entity to succeed in the marketplace

Front 6

KPIs (key performance indicators)

Back 6

Both financial and non-financial measures that an entity uses to monitor and evaluate performance of its critical business processes (typically focused on process cycle time, effectiveness/quality, and efficiency/cost)

Front 7

residual risk

Back 7

strategic or process risk that is either uncontrolled by the organization and/or is the risk remaining after considering the extent to which a risk reduction strategy reduces an inherent risk; high leads to increased RMM

Front 8

COBIT

Back 8

Control OBjectives for Information and related Technology: basically best practices for IT mgmt

Front 9

Information Technology General Controls (ITGC)

Back 9

address the overall operation and activities of the information system and user environment that are pervasive over all or most applications

Front 10

Information Technology Application Contorls (ITAC)

Back 10

apply to a specific use of the system and should be evaluated separately for each audit area in which the client uses IT

Front 11

5 ITCG control areas

Back 11

1. IT management
2. System/program development
3. Data security (physical and online)
4. Program change mgmt
5. Business continuity planning and computer operations

Front 12

IT management key concepts

Back 12

IT goals aligned w/ business goals
segregation of duties (structure)
position within the organization
role of internal audit

Front 13

application controls

Back 13

computerized steps within the application software to control the processing of transactions; they provide incremental reliance on information produced by an application.
types: input, processing, output

Front 14

input controls

Back 14

provide reasonable assurance that input is properly authorized and accurately entered for processing
ex: check digits, record counts, batch totals, etc

Front 15

processing controls

Back 15

provide reasonable assurance that transactions are processed accurately and that all transactions are processed once and only once

Front 16

output controls

Back 16

provide reasonable assurance that output reflects accurate processing and only authorized people receive output/get access

Front 17

auditing 'around' computer

Back 17

for simple computer transactions, is less extensive, there are hard copy source docs, basically reconciling inputs with outputs

Front 18

auditing 'through' computer

Back 18

for more complex computer systems, is more extensive, source docs are electronic format, checks each stage in computerized process

Front 19

test data

Back 19

a set of fictitious entries, or inputs, that are processed though the client’s computer system under the control of the auditor

Front 20

integrated test facility

Back 20

test data commingled with actual data; transactions are manually processed and compared

Front 21

parallel simulation

Back 21

1. auditor creates a software program that parallels the logic used in the client's program
2. same data processed through both and compared

Front 22

controlled reprocessing

Back 22

audit copy of clients program, reprocesses actual data and results are compared

Front 23

types of computer abuse/fraud controls

Back 23

preventative: stop fraud from entering system
detective: identify fraud when it enters system
damage-limiting: reduce monetary impacts of fraud and control to specified levels

Front 24

sampling risk

Back 24

risk that the decision made based on the sample differs from the decision that would have been made by examining the population

Front 25

causes and controls of sampling risk

Back 25

cause: non-representative sample
controls: appropriate sample size, all items have equal chance of selection, evaluate sample results

Front 26

sampling risk: Type I

Back 26

risk of incorrect rejection: risk that the sample supports a conclusion that the balance is not fairly stated when it is

Front 27

sampling risk: Type II

Back 27

risk of incorrect acceptance: the risk that the sample supports a conclusion that the balance is fairly stated when it contains material misstatements

Front 28

statistical sampling

Back 28

use laws of probability to select sample items and evaluate sample results. these methods measure the auditor's exposure to sampling risk

Front 29

non-statistical sampling

Back 29

violate one of the 2 criteria for statistical sampling