Auditing with Computers and CISA

Auditing with Computers

• Using computers as an audit tool is virtually mandatory due to data being stored on computer media and manual access being impossible.
• Automated Workpaper software handles accounts for multiple organizations in a flexible manner, automating footing, cross footing, and reconciliation to schedules.

Certifications and Standards

• Certified Information Systems Auditor (CISA) is the gold standard for IT auditors, emphasizing a risk-based approach to audit engagements.
• Control Objectives for Information and Related Technology (COBIT) provides guidance for managing and controlling business risks associated with IT environments.
• Electronic Systems Assurance and Control (eSAC) provides a framework for evaluating e-business controls.
• XBRL (eXtensible Business Reporting Language) is a standardized language used for electronic communication of business and financial data.

Auditing Techniques

• Computer-assisted audit techniques (CAATs) involve the audit team performing audit testing through the computer rather than around it.
• Continuous auditing provides real-time assurance, increasingly important for real-time financial reporting.
• Parallel simulation involves using live input data, rather than test data, in a program written or controlled by the auditor.
• Integrated Test Facility (ITF) audits an AIS in an operational setting.

Data Analysis and Manipulation

• Generalized Audit Software (GAS) enables auditors to review computer files without continually rewriting processing programs.
• Audit Command Language and Interactive Data Extraction and Analysis are general-use software productivity tools.
• Structured Query Language (SQL) is a valuable tool for retrieving and manipulating data.

Risk Assessment and Governance

• Information systems risk assessment is a method to evaluate the desirability of IT-related controls for a particular aspect of business risks.
• IT governance involves using IT resources effectively to meet organizational objectives, ensuring effective management and control of IT-related risks.
• Program Change control is a set of internal control procedures developed to protect against unauthorized program changes.
• Systems Auditability and Control (SAC) report identifies important information technologies and the specific risks related to these technologies.