Isys 414 - Chapter 9 - Vocab

Front 1

Five Audit Scope Standards:

Back 1

a. Review the reliability and integrity of operating and financial information and how it is identified, measured, classified, and reported.

b. Determine if the systems designed to comply with operating and reporting policies, plans, procedures, laws and regulations are actually being followed.

c. Review how assets are safeguarded, and verify the existence of assets as appropriate.

d. Examine company resources to determine how effectively and efficiently they are used.

e. Review company operations and programs to determine if they are being carried out as planned and if they are meeting their objectives.

Front 2

Auditing

Back 2

Systematic process of objectively obtaining and evaluating evidence regarding assertions about economic actions and events to ascertain the degree of correspondence between those assertions and established criteria and communicating the results to interested users.

Front 3

Three Types of Audits:

Back 3

1. Financial Audit
2. Information Systems Audit/Internal Control Audit
3. Operational Audit/Management Audit

Front 4

Financial Audit

Back 4

Examines the reliability and integrity of accounting records (both financial and operating information) and correlated with the first of the five scope standards.

Front 5

Information Systems Audit/Internal Control Audit

Back 5

Reviews the controls of an AIS to assess its compliance with internal control policies and procedures and its effectiveness in safeguarding assets. Its scope roughly corresponds to the IIA’s 2nd and 3rd standards.

Front 6

Operational Audit/Management Audit

Back 6

Concerned with the economical and efficient use of resources and the accomplishments of established goals and objectives. Its scope corresponds to the 4th and 5th standards.

Front 7

Three Types of Risk when conducting an audit

Back 7

1. Inherent Risk
2. Control Risk
3. Detection Risk

Front 8

Inherent Risk

Back 8

The susceptibility to material risk in the absence of controls.

Front 9

Control Risk

Back 9

The risk that a material misstatement will get through the internal control structure and into the financial statements. Weak controls = higher control risk. Can be determined by reviewing the control environment, testing internal controls, and considering control weaknesses identified in prior audits and evaluating how they have been rectified.

Front 10

Detection Risk

Back 10

The risk that auditors and their audit procedures will not detect a material error or misstatement.

Front 11

Materiality

Back 11

What is or isn’t important in a given set of circumstances.

Front 12

Reasonable Assurance

Back 12

Assurance that no material error exists in the information or process audited. To get full assurance is too expensive, so we find an assurance threshold.

Front 13

Systems Review

Back 13

Evaluating control procedures by reviewing system documentation and interviewing appropriate personnel to determine if the necessary procedures are in place.

Front 14

Test of Controls

Back 14

Conducted to determine if control procedures are satisfactorily followed.

Front 15

Compensation Controls

Back 15

Procedures that compensate for the control deficiency in the system.

Front 16

ISYS Audits

Back 16

a. Security Provisions

b. Program Development and acquisitions performed with authorization

c. Program modifications have approval

d. Processing of transactions, files, reports and records is accurate and complete

e. Identify source data that are inaccurate or improperly authorized

f. Computer data files are accurate, complete and confidential

Front 17

Reprocessing

Back 17

Technique which uses a verified copy of the source code to reprocess data and compare output to system’s output.

Front 18

Parallel Simulation

Back 18

Same as reprocessing, but auditor writes a program instead of saving a verified copy of the source code.

Front 19

Test Data Generator Program

Back 19

Automatically prepares test data based on program specifications.

Front 20

Concurrent Audit Techniques

Back 20

Continually monitor system and collect audit evidence while live data are processed during regular operating hours.

Front 21

Embedded Audit Modules

Back 21

Segments of program code that perform audit functions. Helps facilitate concurrent auditing.

Front 22

Integrated Test Facility (ITF)

Back 22

Technique which places a small set of fictitious records in the master files and allows them to be processed in the system as normal to observe how they are processed.

Front 23

Snapshot Technique

Back 23

Examines the way transactions are processed. Selected transactions are marked with special code that triggers the snapshot process.

Front 24

System Control Audit Review File (SCARF)

Back 24

Uses embedded modules to continuously monitor transaction activity and collect data on transactions with special audit significance.

Front 25

Audit Log

Back 25

aka SCARF File. Transactions recorded here include those exceeding a specified dollar limit, involving inactive accounts, deviating from company policy, or containing write-downs of asset values.

Front 26

Audit Hooks

Back 26

Audit routines that flag suspicious transactions.

Front 27

Real-time Notification

Back 27

A type of audit hook that displays a message on the auditor’s terminal.

Front 28

Continuous and Intermittent Simulation (CIS)

Back 28

Embeds an audit module in a database management system. Examines all transactions that update the database using criteria similar to those of SCARF. If the transaction has special audit significance, the module independently processes the data, records the results, and compares them with those obtained by the DBMS.

Front 29

Aids in Analysis of Program Logic:

Back 29

a. Automated Flowcharting Programs

b. Automated Decision Table Programs

c. Scanning Routines

d. Mapping Programs

e. Program Tracing

Front 30

Automated Flowcharting Programs

Back 30

Interpret program source code and generate a corresponding flowchart.

Front 31

Automated Decision Table Programs

Back 31

Generates a decision table representing the program logic.

Front 32

Scanning Routines

Back 32

Search a program for occurrences of a specified variable name or other characteristic combinations.

Front 33

Mapping Programs

Back 33

Identify unexecuted program code. Could uncover program code that an unscrupulous programmer inserted to erase all computer files when he was terminated.

Front 34

Program Tracing

Back 34

Prints all application program steps executed during a program run. This list is intermingled with a regular output so auditors can observe the precise sequence of events that unfold during program execution. Helps auditors detect unauthorized program instructions, incorrect logic paths, and unexecuted program code.

Front 35

Input Controls Matrix:

Back 35

Table which shows the control procedures applied to each field of an input record.

Front 36

Computer Audit Software (CAS)/Generalized Audit Software (GAS)

Back 36

Programs written especially for auditors. ACL and IDEA are two most popular.