Acct 9

Front 1

External auditors are primarily responsible to

Back 1

shareholders and investors.

Front 2

The American Accounting Association (AAA) defines auditing as:

Back 2

A systematic process of objectively obtaining and evaluating evidence.
Regarding assertions about economic actions and events.

Front 3

Auditing involves

Back 3

collecting, reviewing, and documenting audit evidence.

Front 4

According to the IIA, the purpose of an internal audit is to:

Back 4

Evaluate the adequacy and effectiveness of a company’s internal control system; and
Determine the extent to which assigned responsibilities are carried out.

Front 5

The IIA’s five audit scope standards outline the internal auditor’s responsibilities:

Back 5

Review the reliability and integrity of operating and financial information and how it is identified, measured, classified, and reported.

Determine if the systems designed to comply with these policies, plans, procedures, laws, and regulations are being followed.

Review how assets are safeguarded, and verify their existence.

Examine company resources to determine how effectively and efficiently they are used.

Review company operations and programs to determine if they are being carried out as planned and if they are meeting their objectives.

Front 6

Five different types of audits are commonly performed.

Back 6

financial, internal control, operational, information systems, management

Front 7

Financial audit

Back 7

Examines reliability and integrity of accounting records (financial and operating).

Front 8

Information systems audit

Back 8

Reviews the controls of an AIS to assess:
Compliance with internal control policies and procedures; and
Effectiveness in safeguarding assets.

Front 9

Operational or management audit

Back 9

Concerned with economical and efficient use of resources and accomplishment of established goals and objectives.

Front 10

All audits follow a similar sequence of activities and may be divided into four stages:

Back 10

Planning
Collecting evidence
Evaluating evidence
Communicating audit results

Front 11

Audit planning

Back 11

Purpose: Determine why, how, when, and by whom the audit will be performed.

Front 12

The first step in audit planning is to establish the

Back 12

scope and objectives of the audit.

Front 13

There are three types of risk when conducting an audit

Back 13

Inherent risk
Control risk
Detection risk

Front 14

The following are among the most commonly used evidence collection methods:

Back 14

Observation
Review of documentation
Discussions
Physical examination
Confirmation
Re-performance
Vouching

Front 15

An audit designed to evaluate AIS internal controls would make greater use of:

Back 15

Observation
Review of documentation
Discussions
Re-performance

Front 16

An audit of financial information would focus on:

Back 16

Physical examination
Confirmation
Vouching
Analytical review
Re-performance

Front 17

A risk-based audit approach is a four-step approach to internal control evaluation that provides a logical framework for carrying out an audit. Steps are:

Back 17

Determine the threats (errors and irregularities) facing the AIS.
Identify control procedures implemented to minimize each threat by preventing or detecting such errors and irregularities.
Evaluate the control procedures.
Evaluate weaknesses (errors and irregularities not covered by control procedures) to determine their effect on the nature, timing, or extent of auditing procedures and client suggestions.

Front 18

IT Auditing Objective

Back 18

Review & evaluate internal controls that protect the AIS.

Front 19

6 Objectives of IT Auditing

Back 19

Objective 1: Overall Security
Objective 2:
Software Development
and Acquisition
Objective 3:
Software Modification
Objective 4: Computer Processing
Objective 5: Source Data
Objective 6:
Data Files

Front 20

IT Auditing – Objective 1: Overall Security Threats include

Back 20

Hardware & files – theft, damage, unauthorized access
Software & Data – theft, destruction, modification, unauthorized access
Interruption of business activities
Disclosure of confidential data

Front 21

IT Auditing – Objective 2: Software Dvlp. & Acq. Threats include

Back 21

Errors due to misunderstanding AIS specifications
Careless programming
Unauthorized instruction codes inserted into legitimate programs

Front 22

IT Auditing – Objective 3: Software Modification Threats include

Back 22

Careless programming
Unauthorized program codes
Unauthorized access to programming codes

Front 23

IT Auditing – Objective 4: Computer Processing Threats include

Back 23

Inability to flag bad data during processing
Inability to correct bad data after identification
The updating of programs introduces errors into data
Improper distribution of processed data

Front 24

IT Auditing – Objective 5: Source Data
Threats include

Back 24

Inaccurate source data
Unauthorized source data (e.g., ghost employees and vendors)

Front 25

IT Auditing – Objective 6: Data Files
Threats include

Back 25

Data loss due to hardware or software malfunction
Data loss due to accidental deletion
Data loss due to intentional acts

Front 26

P =

Back 26

Time it takes an attacker to break through the organization’s preventive controls.

Front 27

D =

Back 27

Time it takes to detect that an attack is in progress.

Front 28

C =

Back 28

Time to respond to the attack.

Front 29

Effective segregation of accounting duties is achieved when the following functions are separated:

Back 29

Authorization
Recording
Custody

Front 30

segregation of accounting duties
Authorization

Back 30

Approving transactions and decisions.

Front 31

Recording

Back 31

Preparing source documents; maintaining journals, ledgers, or other files; preparing reconciliations; and preparing performance reports.

Front 32

Custody

Back 32

Handling cash, maintaining an inventory storeroom, receiving incoming customer checks, writing checks on the organization’s bank account.

Front 33

CUSTODIAL FUNCTIONS

Back 33

Handling cash
Handling inventories, tools, or fixed assets
Writing checks
Receiving checks in mail

Front 34

RECORDING FUNCTIONS

Back 34

Preparing source documents
Maintaining journals, ledgers, or other files
Preparing reconciliations
Preparing performance reports

Front 35

EXAMPLE OF PROBLEM: A person who has custody of cash receipts and the recording for those receipts can steal some of the cash and falsify accounts to conceal the theft.

Back 35

SOLUTION: The pink fence (segregation of custody and recording) prevents employees from falsifying records to conceal theft of assets entrusted to them.

Front 36

EXAMPLE OF PROBLEM: A person who has custody of checks for transactions that he has authorized can authorize fictitious transactions and then steal the payments.

Back 36

SOLUTION: The green fence (segregation of custody and authorization) prevents employees from authorizing fictitious or inaccurate transactions as a means of concealing a theft.

Front 37

AUTHORIZATION FUNCTIONS

Back 37

Authorization of transactions