IS audit and CAATs

Information Systems audit

An Information Systems (IS) audit is an independent, systematic examination of an organization's IS infrastructure, applications, data, operations and controls to decide whether they safeguard assets, maintain data integrity, achieve organizational goals efficiently, and comply with laws and policies.

Objectives:

• Check that assets (hardware, software, data) are protected.
• Check data integrity, accuracy and completeness.
• Check the system's effectiveness and efficiency.
• Verify compliance and the adequacy of internal controls.

Types: audit of general controls (access, operations, change management, backup), application controls (input, processing, output), network and security audit, and system development audit. Audit may be around the computer (ignoring processing), through the computer (testing the logic) or with the computer (using tools).

Computer Assisted Audit Techniques and Tools (CAATTs)

CAATTs are software tools and methods that auditors use to examine large volumes of electronic data and test system controls instead of manual sampling.

Purposes of the main techniques:

1. Generalised audit software (GAS) - e.g. ACL, IDEA. Reads and analyses data files: sampling, totalling, duplicate and gap detection, recalculation, comparison, stratification.
2. Test data (test deck) - fictitious valid and invalid transactions are processed to see that the application accepts or rejects them correctly.
3. Integrated Test Facility (ITF) - a dummy entity is built into the live system; test transactions are processed with real ones and the results are checked.
4. Parallel simulation - the auditor builds a program that imitates the application and compares its results with the real output.
5. Embedded audit module / SCARF - audit code inside the application continuously records exceptional or sample transactions.
6. Snapshot - captures a transaction's path through the program for review.
7. Program tracing and mapping - shows which program instructions are executed or not executed.
8. Utilities and query tools - SQL, spreadsheets, data mining and log analysers for data extraction and checking.
9. Security tools - vulnerability scanners and network analysers.

Advantages: whole population can be tested, higher accuracy and speed, lower audit cost over time, detection of fraud patterns, and repeatable work. The auditor must ensure the tool itself is reliable and data extracted is complete.