Computer auditing - So your client is going to computers

Computer auditing - So your client is going to computers

Reimel, J Christopher Jr. Infotech Update. New York: Winter 1993. Vol. 2, Iss. 2; pg. 2

Abstract (Summary)
Computer auditing still requires an understanding of computer systems and technology, but the advent of the personal computer has made using a computer easier than using a centralized mainframe computer. Thus, using a computer in an audit can be more efficient and effective than using manual audit methods and can save an auditor time and money. Auditing through the computer means that the auditor is performing audit tests using the client data in an automated fashion. Some of an auditor's major concerns include: 1. understanding the computerized internal control structure, 2. performance of substantive audit tests, and 3. management letter recommendations. The client's expectation is that the auditor knows more about automated accounting systems than the client. To remain technically proficient, auditors must obtain the necessary knowledge through continuing professional education courses and hands-on experience.

Over the past year, one of your major clients has completed the process of installing a new computer system that DOES EVERYTHING. The client raves about the increase in efficiency that the system has brought for all aspects of the business. Sales are up and expenses are down. The client then states that the audit should be a lot more efficient, thus generating savings in time and in money (that is, the audit fee should be lower this year.) You were planning on auditing this client the same way as last year. The only way to lower the fee is to take an even bigger discount than last year, and the fee is already at the low end of your fee schedule! There must be a better way of handling this situation.

Recently at a continuing professional education seminar, you learned that automating certain audit procedures and auditing through the computer are ways of saving time. However, you do not yet feel that you have the knowledge or resources to attempt either or both of these. You are also concerned that the audit fee is not large enough to devote the time to attempt something new. Doing things differently takes time and money. However, if you do not adopt new technology, your client may lose confidence in your professional ability and may think that your skills are not current. What should you do?

The decision is a difficult one, but as a professional, you know that you must constantly upgrade your skills. You have used a personal computer to prepare tax returns for the last few years. It took some time to become comfortable with it, but you now know that it was an investment worth making. Mathematical calculations are performed correctly, numbers are Carried correctly from one form to another, and last minute changes are performed quickly. Likewise, you now realize that using a computer during an audit is one of those new skills that you should acquire. The good news is that computer auditing has changed over the last several years and has become more user friendly to the auditor. Computer auditing still requires an understanding of computer systems and technology, but the advent of the personal computer has made using a computer easier than using a centralized mainframe computer. Thus, using a computer in an audit can be more efficient and effective than using manual audit methods, and can save an auditor time and money. Of course, there is still the upfront investment of time that is necessary for performing any new task. However, after a short time, you will become as comfortable with computer auditing as you are with computer tax preparation.

Many clients now have their entire operations on inexpensive personal computers and minicomputers. They are using inexpensive general ledger software to obtain the financial information that they need. The auditor now has personal computer audit software packages such as IDEA and ACL. These packages perform many of the audit functions that were previously only available in large mainframe audit software packages, but are easier and less costly to use.

COMPUTER AUDITING DEMYSTIFIED

There are many aspects to computer auditing, but it is best understood when thought of as "auditing through the computer" or "auditing with the computer." Auditing through the computer means that the auditor is performing audit tests using the client data in an automated fashion. The auditor is writing computer programs and running these programs through the client's computer using the client's data. If the results of the computer programs written by the auditor equal the results of the computer programs written by the client, then the auditor has verified the accuracy of the client's data processing reports for this particular segment of the audit.

The auditor may be sending test data through the client's computer or may be re-performing calculations that the client system has performed. Auditing with the computer means automating audit procedures that were previously performed manually. This includes tasks such as footing a file, making a confirmation selection, recomputing interest earned, or recomputing an inventory valuation.

BASIC AUDIT TASKS

Using a computer during an audit does not change the basic tasks that are performed by the auditor. The auditor obtains sufficient competent evidential matter regarding the following five assertions:

* existence or occurrence

* completeness

* rights and obligations

* valuation or allocation

* presentation and disclosure

The fact that the client is now processing transactions in a computer does not alter the auditor's responsibility to collect the appropriate evidence. It may change the method of obtaining the evidence. It may also alter the format of the evidence. But the basic responsibility remains the same. What are some of the concerns that the auditor will encounter in auditing a computerized accounting system as well as a manual accounting system? Some of the major concerns are:

* understanding the computerized internal control structure

* performance of substantive audit tests

* management letter recommendations.

UNDERSTANDING THE INTERNAL CONTROL STRUCTURE

Statement on Auditing Standards 55 requires the auditor to understand the Internal control structure of the audit client. He or she must do this in order to properly plan the audit, regardless of whether the client is using a computer or not. The auditor must understand the flow of the transactions. In an automated system, a computer program processes the transactions that would normally be processed by hand in a manual system. The difference is that in the automated system, each transaction is processed exactly the same as any other similar transaction. No human intervention for decision making is required at the time of the transaction. The decision making was performed earlier by management. These decisions were then communicated by management to the computer programme The data in each transaction flows through the computer program and the result is a transaction that is stored on a magnetic disk, tape, or cartridge and is printed on reports.

In a manual system, different people may process similar transactions differently. Also, the same person may process similar transactions differently from one day to another. Therefore, internal controls have the potential to be stronger in an automated system than in a manual system. While there is little difference in understanding and documenting the controls in an automated or manual system, the reliability and consistency of the controls may differ. Automated systems with strong controls should be more reliable than manual systems. However, automated systems' strong controls may be less obvious than controls in a manual system. Therefore, an auditor may have a different audit plan for an automated system than for a manual system.

What should an auditor be looking for in an automated system that may not be in a manual system? Since a significant amount of controls that previously resided with the clerical personnel now reside in the computer, the auditor might want to test the following:

* controls over access to the computer and to the data

* controls over the development of new programs

* controls over changes to existing programs

* controls over the retention of data.

PERFORMANCE OF SUBSTANTIVE AUDIT TESTS

The auditor must perform substantive tests to determine that the financial statements are presented fairly. Accounts are analyzed, tested, and confirmed. The method of testing can differ when auditing a manual system as opposed to an automated system. An auditor can use a computer audit software package to perform many of the time-consuming audit tasks such as footing, crossfooting, analyzing, and aging. Some of the software packages that clients are using have their own report generators that the cent can use to obtain critical management information. The auditor may wish to test these report generators to determine the accuracy of the management reports. The auditor can use any computer audit software packages like the ones mentioned above to perform this test. The client may be making important management decisions based on inaccurate reports. This permits the auditor to demonstrate to management that the auditor is thoroughly reviewing the new computer system and to bring added value to the client by discussing this review with management. The client will then realize that this thorough review and test of the new computer system is more than worth the audit fee. Management wants to know what is functioning correctly as well as what is functioning incorrectly.

Some audit tests require the auditor to transcribe information from a series of computer generated reports and then to foot this information to obtain the correct account balance. This is time-consuming and inefficient. For example, payables may consist of salaries, raw materials, office supplies, and miscellaneous. In an automated system, the auditor could use an audit software package to quickly and efficiently collect this information in one report. An audit software package can also be used to select and print a stratified sample or a random sample. Examples would be receivables or payables to be sampled and confirmed. The audit software package could also be used to print the confirmation letter and could even be used to sort the confirmations by zip code in order to receive the lower postal rate for presorted mail.

A program can be written to produce an aging of the accounts receivable. The auditor's aging can then be compared to the client's aging. Also, programs can be written to perform the calculation of interest earned or overtime paid. The auditor's calculations can then be compared to the client's calculations. Differences can be analyzed quickly and discussed with the client. Selecting and sorting information are two of the most powerful tools that an audit software package can provide. These functions permit the auditor to accumulate only the information that is needed for an account balance analysis. The information can then be sorted in ways that enable the auditor to perform analysis efficiently and effectively.

MANAGEMENT LETTER RECOMMENDATIONS

Management letter recommendations can be geared toward items that strengthen the internal control structure and increase efficiency. For example, when you recalculated the interest charged to the client's customers, you determined that the client's program was incorrect and that customers were being undercharged. It is this type of recommendation that gets the immediate attention of top ; management and brings added value to the audit in the client's mind. Recommendations that are implemented will increase client efficiency because once a change is implemented in an automated system, its effects are immediate, pervasive, and consistent. Management letter recommendations will become more of a management consultant's report rather than a list of minor errors discovered during the audit.

CONCLUSION

Automated systems are becoming more far-reaching, sophisticated, and easier to use. As clients become more knowledgeable and comfortable with these systems, they will expect the same from their auditors. Auditors who do not use computer audit software with these clients will find themselves at a competitive disadvantage. Clients who believe that their auditors are not technically proficient in understanding and using their system will change auditors. The client's expectation is that the auditor lows more about automated accounting systems than the client. To remain technically proficient, auditors must obtain the necessary knowledge through continuing professional education courses and hands-on experience.

STEPS IN PERFORMING A COMPUTER AUDIT

1 Flow chart the various systems to document the internal control structure. Inexpensive software flowcharting packages are available.

2 Obtain the record definitions and database structures for all files and data-bases.

3 Write programs or use a database query language to obtain the information needed for the audit.

4 Re-perform calculations that were performed by the client's software, for example, overtime paid, sales discounts given, interest earned, etc.

5 Perform substantive tests using the information obtained directly from the computer.

6 Enter adjusting entries and produce the audited financial statements.

7 Prepare management-letter recommendations. Change the order to place the most important recommendations first. Do not overlook the opportunity to demonstrate to the client your knowledge of the system.