Auditing in A CIS Environment
Auditing in A CIS Environment
Auditing in A CIS Environment
by
01 Oct 1998
This article is the third in a series of four, covering the most commonly examined subjects in
paper 6. In the August edition of the ½
, we looked at the audit of
inventories. This month, we look at auditing in a Computer Information Systems (CIS)
environment.
Auditing in a CIS environment is, of course, the rule rather than the exception. The paper 6
examiner states that students should assume that accounting systems in exam questions are
computerised. Auditors all over the world now use computers to a greater or lesser extent, and
the proportion of their clients without a single PC must be very small . So once again, the
subject is important in practice as well as in theory.
There is a substantial body of guidance in this area which includes the following ISAs
(International Standards on Auditing) and IAPSs (International Auditing Practice Statements):
Much of the IAPSs are taken up with descriptions of the various types of system and the issues
involved in auditing them. This article will take a rather more practical approach to exam
questions, as in previous articles. Don½t worry about this area if you are not particularly
computer literate, the examiner does not expect you to have any specialist knowledge and you
can answer questions perfectly well with very little practical experience. Remember that there is
some crossover with the paper 5 syllabus here and you get double benefit from studying the
area!
There are four basic types of question that come up in the exam:
j c ½ what are the particular features and risks involved in auditing in a CIS environment?
j ½ what CIS controls would you expect to find in this particular area?
j ½ how would you use CAATS (Computer½Assisted Audit Techniques) in this area?
The area covered by ISA 402 is one that has not been examined frequently in the past, and it is
unlikely to form the subject matter of a full question.
jc
Type A questions deal with the features and risks involved in auditing in a CIS environment.
The IAPSs noted above deal with the features and risks of different types of system, but there
are elements common to them all. A typical Type A question might read as follows:
j
The suggested answer that follows is split into two parts. Part (a) deals with general CIS factors
which would be applicable to many different types of system. Part (b) deals with the effect of
the change in the system on audit planning.
j pp
(
pp
(i)p p p
pp
p p
ppp
pp
p
p
p
pp
pp
p
p
ppp
p
p
pp
p
p
p
p
p
pppp
pp
p
(viii)p
p
p p p
(b
p
(ii)pp p
j Type B questions are probably the commonest. They require you either to
set out what controls you would expect to see in a particular area, or, they ask you to explain the
weaknesses in a given situation. We dealt with the approach to exam questions, and controls
generally, in a previous article. Here, we will simply revise the basic types of computer control,
in order to familiarise ourselves with the terminology.
(
pp
p
p p
p pppp
p
p
p p
pp"
p pp
p
p
p½
½pp
p
(ii)p+
p
p
p
p
p
p
p
pp
p
pppp
p
pp
p
p
p
pppp
p
p
p
p p
ppp
(v)pp
ppp
ppp p
p
pp
p
p p p
p
p
p
p
p)p
pp%%*p
ppp
pp
pp p½
½p
p pppp p
pp
pp
pp
pp
pp
p
p
ppppp
p
p
p
p
p
(v)pp
p)½pp
p
pp!2p3½*p
p
p
p
p p
pp
pp
pppppp
p
p p
p
ppp
p
(vii)p pp
pp
pp
p pp
pppppp
pp pp
p
p
p p
ppp
pp
p
p pp
j
Type C questions (how do auditors use computers in performing audits?), are not really dealt
with in the ISAs or IAPSs noted above. You can rely on your experience here if you use
computers on a day-to-day basis, and if you do not, remember that anything that can be done
with a pen and paper, can probably be done with a computer! Type D questions (how would you
use CAATS in this area?) are covered by their own IAPS, and unless you work in a specialist
computer audit department, you are unlikely to have any significant experience of their use.
Consider the following question taken from the June 1997 paper:
j !
p
pp
p pp p p
p
pp
p
p
p
p)p
*ppp
pp
p0pp
p
p
p
p
p
p
p p p
p
p
ppp
p
p
p p
ppppp½p
p
(p
6p
(bp
p
6p
(pp
-
p
p!p) *ppp
p
pp
ppp
ppp
6p
(pp
p
p
p
ppp
pp
.p p
p
ppp p
p
pp
p
ppp
p
ppp
p
ppp
p
pp
ppppp
ppp
p
·
"
·
(
(b
#
#(20p
To get maximum marks for a question like this, you need to use a proper memorandum format,
as in the suggested answer below. Every firm has a different layout for memos, so the precise
format is not important. There can be anything up to four marks allocated to style and
presentation in a 20 mark question such as this.
$!%p
(pp p
(p7pp
8 (p%9pp%:;'p
$(pp
(p
p
(bp
p
p
(pp
p
(p p
(p
p
p
p
p½½p
pp
p
pp
p
p p½½p
p
pp
pp
pppp
p
p
p!p
p
ppppp
p
p
pp
p
pp
p
p
p
ppppp p
(p
(i)pp
p
"p!
p
p
p
p
p
p
pp
p
p
p
p p
p pp
p ppp
p
p
p
p p
p
p
p
p
(ii)p pp
(iii)p
p
p
p
p
ppp
p pp
p
pp
p
pp
pp pp
p8
pp
pp
p
p
p
p
p p
pp
p ppp
p p
p
p
p
p p
(p
)*p p p
p p
p ippp
ip p
pp
p
p
pp p pp
p
pp
ppp
p
(&
p
<p
pppp
p
p
p pp
pppp
ppp
p p
p
ppp
p
pp
ppppp p
p
p
ppppppp
pp
p
p
p
p
p- p
p
pppp
p
pp
p
pp
p
p
p
pp
p
pppp
pp
pp p
p
p
ppppppp
pp
pppp
p
p
p
p
ppppp p
p
p p
pp
p
!ppp
pp
(jp
(i)pp! p
p
pp
pp p
p
p p
pp
ppp
½p
pp
p
p p
(p
ipp 6p
Dp
pp-
pp
p p
p6p
upp
p p pp
(ii)pp p
p
p
ppp
pppp
p
pp
pp
p
p
pp
pp
pp
p
p
p
pp- ppp
(
p
Auditing in a CIS environment is a wide area, but it is examined at a fairly basic level.
Familiarise yourself with the terminology and your paper 5 studies will also benefit.
The next and last article in this series will deal with the verification of balance sheet items.
p
p