IT Applications & Environment

• Business organizations are operating in a fast-evolving digital era due to the internet and digitization.
• Businesses are adapting to this period's challenges, which often requires reinventing business models and structures.
• Accounting processes are streamlined through computers' ability to handle large transaction volumes instantly.
• Investors' and stakeholders' financial reporting needs change during this constant transformation period.
• Transformations in audit execution are necessary as improvements emerge.

The Information Technology (IT) Environment

• The IT environment includes IT applications, supporting infrastructure, IT processes, and personnel that support business operations and strategies.
• IT application: A program or set of programs used to initiate, process, record, and report transactions or information, including data warehouses and report writers.
• IT infrastructure: comprises the network, operating systems, databases, and related hardware and software.
• IT processes: processes to manage access, program changes, IT environment changes, and IT operations.
• The information technology environment is also referred to as the "Electronic Data Processing (EDP) environment" or "Computer Information Systems (CIS) Environment".
• IT enables online product sales and inventory tracking.
• IT use exposes the entity to business risks that could lead to material misstatement (RoMM) of financial statements, which auditors must consider.

IT Infrastructure

• IT infrastructure is the foundation, which includes all the hardware, software, networks, and facilities necessary to perform the IT services.
• Major components include Database Systems, Operating Systems, and Networks.
• Database System: An organized data collection stored and accessed electronically, enabling data synchronization by maintaining a single copy of important records.
• Current systems assign database maintenance and control responsibilities to a database administrator.
• Operating system: The software that controls computer hardware and supports its basic functions, loading from data storage upon computer startup.
• Networks: Two or more linked computers facilitate sharing of devices, software, files, and transmissions via cables, satellites, and telephone lines.
• Types of networks (classified by geographical scope) include Local Area Network (LAN), Wide Area Network (WAN), National Area Network (NAN), and the Internet.
• Distributed Data Processing: Information and program sharing increases the risk of unwanted access and calls for computer security.
• Electronic Data Interchange: Exchanging business data via telecommunication links reduces the audit trail.

Computer and its components

• IT infrastructure uses a computer; a programmable electronic device for storing, retrieving, and processing data
• Computers are comprised of Hardware and Software components.

Computer hardware

• Hardware consists of the physical devices or equipment used for data processing functions including the Central Processing Unit (CPU), Input devices, Output devices and Data Storage.
• CPU: Serves as the brain of the computer and processes programs of instructions for manipulating data.
  • Control unit: Interpreter of program codes that will manipulate the data
  • Storage unit: Data retention unit
  • Arithmetic and Logic Unit (ALU): Performs arithmetic and logic functions
• Secondary storage devices are storage support to the CPU.
  • Method of Access include Random or Sequential
    • Random: Data can be easily accessed directly regardless of how it is physically stored (e.g. magnetic disk)
    • Sequential: Data must be processed in the order in which it is physically stored (e.g. magnetic tape, cartridges)
  • Type of Storage Device includes:
    • Magnetic tape: Primary medium for backing up random-access disk files and considered to be the cheapest type of storage available
    • Magnetic disks: Include CDs (mainframe) and hard disks or (microcomputers) drives
    • Redundant array of independent disks (RAID): A way of storing the same data redundantly on multiple magnetic disks to minimize the likelihood of loss of data
    • Compact disks, floppy disks, and zip disks
    • Optical disks: Use laser technology to store and read data
• Input devices: Serve as an entry channel to transmit data to the CPU for processing, functioning as converters of information into a machine-readable form.
  • Examples of input devices:
    • Keying data: Key to tape and key to disk in which data can be entered directly on tapes and disks respectively through a cathode ray tube (CRT), and then read into a computer.
    • Online entry
      • Visual display terminal (uses the keyboard to directly enter data into the computer)
      • Input interface: a program that controls the display for the user (usually on a computer monitor) and that allows the user to interact with the system
    • Graphical user interface - uses icons, pictures, and menus instead of text inputs (e.g. Windows)
    • Command line interface - uses text-type commands
    • Mouse, joystick, light pens
    • Touch-sensitive screens - allow users to enter data from a menu of items by touching the surface of the monitor
• Turnaround documents (e.g. Utility Bills) are documents that are sent to customers and returned as inputs.
• Automated source data input devices:
  • Magnetic tape reader: A device capable of sensing information recorded as magnetic spots on magnetic tape.
  • Magnetic ink character reader (MICR): A device that temporarily reads magnetized characters using magnetic ink (e.g. bank check readers)
  • Optical character recognition (scanner): A device to read characters directly from documents based on their shapes and positions.
  • Automated teller machines (ATM): A machine used to execute and record transactions with financial institutions
  • Point-of-sale (POS) recorders: A terminal connected to a computer connected.
  • Voice recognition: - A system that understands spoken words and transmits them into a computer
• Output devices translate processed data into forms understandable by users (e.g. monitors, printers, etc.).
• Data Storage serves as a warehouse of data processed by the computer, such as a hard disk, and can either be fixed or removable.

Computer Software

• Software consists of sets of instructions (programs) that direct, control, and coordinate the operation of hardware components.
  • Systems software
    • Operating system: Monitors and controls all the input, output, processing, and storage devices and operations of a computer (e.g. DOS, Windows, Linux, Mac, etc.).
    • Utility (user) programs: Handle common file, data manipulation, and "housekeeping" tasks, such as sorting and merging.
    • Communication Software: Controls and supports transmission between computers, computers, and monitors, and accesses various databases
  • Application software (also known as 'apps') is written by programming languages such as Turbo C, Assembly, Java, Visual Basic, and COBOL, that are designed for specific uses such as payroll preparation, word processing, graphics, database systems, and accounting software
  • Database management system (DBMS): software package for the purpose of creating, accessing, and maintaining a database
  • Source program: written code that are translated into machine language.
  • Object program: a converted source program that was changed using a compiler to create a set of machine-readable instructions
  • Compiler: A converts human-readable code into machine language object program from a source program language
  • Interpreter: Converts each source code instruction to object code each time it is executed
  • Virtual memory (storage): Online secondary memory is used as an extension of primary memory

Types of Computers

• Supercomputers are extremely powerful, high-speed computers for extremely high volume and/or complex processing needs
• Mainframe computers: Large, powerful, high-speed computers
• Minicomputers: Large and powerful, but not as large or as powerful as mainframe computers
• Microcomputers: Small computers, such as personal computers and laptops
• Personal digital assistants: Mobile, handheld computers
• "Computer systems" refers to the configuration of hardware and software that is intended for a specific purpose.
• Two commonly considered relevant systems are:
  • Management reporting system is designed to help with the decision-making process by providing access to computer data
    • Decision support system: Computer-based information systems that combine models and data to resolve non-structured problems
    • Executive information system: Computerized systems specifically designed to support executive work
    • Expert systemcomputer systems that apply reasoning methods to data in a specific relatively structured area
    • Management information systemystems designed to provide past, present, and future information for planning, organizing, and controlling the operations of the organization
  • Transaction processing system involves the daily processing of transactions

IT Applications

• IT Applications or software applications are programs designed for specific end-user purposes. Emphasis is placed on financial accounting applications for use in the initiation, processing, recording, and reporting of transactions or information which are relevant for decision-making Depending on the need and size of an entity they may include:
  • Small and medium-sized business accounting applications: Basic bookkeeping functions and financial reporting
  • Enterprise accounting applicationesigned for larger organizations that allow for more extensive accounting processes, often part of a larger ERP system.
  • Cloud/online accounting application: An accounting application system that is hosted online.
• Entities may also use emerging technologies (e.g., blockchain, robotics or artificial intelligence)

IT Processes

• IT processes are the entity's processes to manage access to the IT environment, program changes, and IT operations.
• Processes include general IT controls.

Information Technology (IT) Controls

• The entity's use of IT applications or other aspects in the IT environment may give rise to risks arising from the use of IT (RAIT).
• RAIT refers to the susceptibility of information processing controls to ineffective design or operation, or risks to the integrity of information
• To address RAITs, management designs and incorporates IT controls including (S2PARTA):
  • Strategies and plans
  • Segregation of incompatible duties
  • Policies and procedures
  • Quality Assurance
  • Risk assessment activities
  • Training
  • Internal Audit and Monitoring
• General IT Controls (GITCs) are controls over the entity's IT processes that include (COA):
  • Controls over IT Changes
  • IT Operations controls
  • Access controls
• Application Controlsare controls that help the entity achieve its financial reporting objectives as to the completeness, accuracy, existence/authorization, and presentation of data including (IPO):
  • Input Controls
  • Processing Controls
  • Output Controls
• Entity-level IT Controlsalso known as the IT organizational controls which set the overall tone.
• Listed below are the various responsibilities and functions within an IT department include:
  • Information System Management
  • System Analysis
  • Application programming
  • Database Administration
  • Data Entry
  • Computer Operation
  • Program and File Library
  • Data Control
  • Telecommunications
  • Systems Programming
  • Quality Assurance
• Another important aspect of this type of control is monitoring:
  • Continuous monitoring
  • Defect identification and management
  • Security monitoring
• Separate evaluations

General Information Technology Controls (GITCS)

• Embedded within IT services and support the effective functioning of application controls and that of the whole IT environment.
• GITCs include:
  • Access controls provide reasonable assurance that access to equipment, files, and programs is limited only to authorized personnel.
    • Authentication
    • Authorization
    • Provisioning
    • Deprovisioning
    • Privileged access
    • User access reviews
    • Security configuration
    • Physical access
  • IT Operations Controls provide reasonable assurance that database operations and data processing are functioning effectively as intended.
    • Job scheduling
    • Job monitoring
    • Backup and recovery
    • Intrusion detection
  • Controls over IT Changes These controls serve as an oversight function
    • Change management process
    • Segregation of duties over change migration
    • Systems development or acquisition or implementation
    • Data conversion

IT Application Controls

• Prevent or detect unauthorized/erroneous transactions within software programs which support proper authorization, completeness, accuracy, and validity of input, processing, and output.
  • Controls over input are designed to provide reasonable assurance
  • Controls over processing is designed to provide reasonable assurance
  • Controls over output is designed to provide reasonable assurance

Explore the role and components of IT applications within an IT environment. Understand how organizations adopt IT and manage access. Learn about input controls and hash totals.