Auditing with Computers and CISA

Study Notes

Using computers as an audit tool is virtually mandatory due to data being stored on computer media and manual access being impossible.
Automated Workpaper software handles accounts for multiple organizations in a flexible manner, automating footing, cross footing, and reconciliation to schedules.

Certified Information Systems Auditor (CISA) is the gold standard for IT auditors, emphasizing a risk-based approach to audit engagements.
Control Objectives for Information and Related Technology (COBIT) provides guidance for managing and controlling business risks associated with IT environments.
Electronic Systems Assurance and Control (eSAC) provides a framework for evaluating e-business controls.
XBRL (eXtensible Business Reporting Language) is a standardized language used for electronic communication of business and financial data.

Computer-assisted audit techniques (CAATs) involve the audit team performing audit testing through the computer rather than around it.
Continuous auditing provides real-time assurance, increasingly important for real-time financial reporting.
Parallel simulation involves using live input data, rather than test data, in a program written or controlled by the auditor.
Integrated Test Facility (ITF) audits an AIS in an operational setting.

Generalized Audit Software (GAS) enables auditors to review computer files without continually rewriting processing programs.
Audit Command Language and Interactive Data Extraction and Analysis are general-use software productivity tools.
Structured Query Language (SQL) is a valuable tool for retrieving and manipulating data.

Information systems risk assessment is a method to evaluate the desirability of IT-related controls for a particular aspect of business risks.
IT governance involves using IT resources effectively to meet organizational objectives, ensuring effective management and control of IT-related risks.
Program Change control is a set of internal control procedures developed to protect against unauthorized program changes.
Systems Auditability and Control (SAC) report identifies important information technologies and the specific risks related to these technologies.