AUI3701_Study_Guide And Exam summary. AUI3701 - The Internal Audit Process: Planning The Engagement.

AUI3701_Study_Guide And Exam summary. AUI3701 - The Internal Audit Process: Planning The Engagement. Incorporating information technology in the planning of an internal auditLearningunit8 Contents 8.1 THE NATURE AND LEVEL OF INFORMATION TECHNOLOGY INCORPORATED INTO THE CLIENT’S SYSTEMS AND BUSINESS PROCESSES 50 8.2 USING INFORMATION TECHNOLOGY IN INTERNAL AUDIT ENGAGEMENTS 51 It is highly unlikely that the internal auditor will be able to provide value-adding services to their organisation without having the skills and knowledge to provide the services in a computerised environment. Most systems and processes within the business environment has had to change to that of a computerised environment. The internal audit activity will need to be proficient in its knowledge of IT risks and controls as well as how to apply technology-based audit techniques. Information technology (IT) can influence the planning of an internal audit in two significant ways: Firstly, the nature and level of information technology incorporated into the audit client’s systems and business processes will have an influence on the audit approach followed by the internal auditors. The typical three different approaches in the computerised environment is the following: ● auditing around the computer ● auditing with the computer ● auditing through the computer STUDY Study section 7.10 in Internal Auditing: An Introduction, chapter 7. Secondly, internal auditors will use information technology in conducting the audit, for purposes of planning, executing audit tasks, gathering of evidence and reporting. 8.1 THE NATURE AND LEVEL OF INFORMATION TECHNOLOGY INCORPORATED INTO THE CLIENT’S SYSTEMS AND BUSINESS PROCESSES IT has affected organisations. It has changed the manner in which organisations formulate strategies, conduct day-to-day operations, and make decisions. These 50 AUI3701/1 51 changes have generated new risks and forced organisations to modify their governance, risk management and control processes. All internal auditors require a sound understanding of the fundamental IT concepts and especially the basic components of their organisation’s information systems, IT risks, IT governance, risk management and control processes. STUDY Study the following sections in Performing Internal Audit Engagements, chapter 2: ● 2.1 ● 2.2 The effect of an information technology environment on the system of internal control The impact of IT on organisations has compelled internal auditors to upgrade their IT knowledge and skills and adjust how they perform their work. STUDY Study section 2.3 in Performing Internal Audit Engagements, chapter 2. Study section 2.4 in Performing Internal Audit Engagements, chapter 2. Study section 2.5 in Performing Internal Audit Engagements, chapter 2. Study Principle 12 in the King IV Code on Corporate Governance found at the following link: https://c. ymcdn. com/sites/www. iodsa. co. za/resource/resmgr/king_iv/King_IV_Report/ IoDSA_King_IV_Report_-_WebV Study section 2.6 in Performing Internal Audit Engagements, chapter 2. 8.2 USING INFORMATION TECHNOLOGY IN INTERNAL AUDIT ENGAGEMENTS Advances in both computer software and hardware have greatly increased the nature of the audit tasks that can be performed using a computer. Internal auditors can use a computer in all stages of the audit and for a variety of procedures. Computers can be used during the planning phase to perform initial risk analysis and to create engagement schedules and time budgets. New advanced software can, for example, be used to prepare internal control flow charts and to download client data for preliminary analytical testing. Computer-assisted audit tools/techniques (CAATTs) are used to increase the efficiency and effectiveness of the audit process. There are three major types of CAATTs: systembased, transaction-based and automated tools. System-based CAATTs are used in the planning phase of the audit to get an overview of the auditee’s operations. CAATTs can be used to provide historical perspective on the audit client, provide summary information and examine trends. CAATTs can also be used to evaluate risk areas. Audit-related databases containing working papers from previous audits can reduce the time required to develop an audit programme. Incorporating information technology in the planning of an internal audit Learning unit 8 52 Transaction-based CAATTs are used during the preliminary stage to determine risk and materiality issues, and during the fieldwork stages to provide more detailed information about the audit client’s operations. Transaction-based CAATTs can also be used for statistical sampling purposes. Automated tools CAATTs consist of several types of software packages designed to assist auditors in the performance and reporting of an audit by providing more attractive, and better understood documents. The use of CAATTs in an audit engagement will have an effect on many aspects that are considered during the planning of an audit engagement. These include, for example, the time that needs to be allocated to certain audit tasks; the total duration of the audit; the way in which working papers and evidence will be kept; the skills that will be required of audit staff; the way stakeholders will be informed with regard to the progress of the audit and interim reporting. Should the auditors plan to use CAATTs to gather evidence, previous consultation with the auditee is also essential. Auditors should therefore carefully consider the extent to which computers will be used in the performance of the audit engagement and the effect it will have on the engagement process. Besides making auditing easier, CAATTs can enhance the effectiveness and credibility of the internal audit activity. STUDY Study chapter 8 in Assurance: An Auditing Perspective. ACTIVITY 8.1 Access myUnisa AUI3701– S1/S2, then click on the Self-Assessment tool and do the multiple choice question for Information Technology considerations. This activity is for your own enrichment and does not contribute towards your year mark. FEEDBACK Feedback on activity 8.1: Information Technology considerations is provided after completion of the multiple-choice questions on the Self-Assessments link ACTIVITY 8.2 1. List the system-orientated CAATTs and the data-orientated CAATTs commonly used by auditors. 2. Discuss the factors which may influence an auditor’s decision to use CAATTs. TOPIC 4 INFORMATION TECHNOLOGY CONSIDERATIONS AUI3701/1 53 FEEDBACK System-orientated CAATTs Data- orientated CAATTs ● Test data ● Integrated test facility (ITF) ● Parallel simulation ● Embedded audit facility ● Generalised/customised audit software ● System utilities and report writers Source: Jackson & Stent, pp 8/43–8/45 1. Factors that may influence an auditor’s decision to use CAATTs ● complexity of the client’s system ● volume of transactions/output ● the form data is stored in ● availability of skills in the audit team ● potential loss of independence ● the attitude of the auditee ● compatibility of the auditor’s hardware and software with the auditee’s hardware and software ● utilities available in the auditee’s systems which can assist ● cost associated with obtaining the relevant data Source: Jackson & Stent, p 8/46 TOPIC SUMMARY This topic discussed the relevant aspects of information technology to consider when planning an internal audit engagement. Firstly, consideration was given to the nature and level of information technology incorporated into the audit client’s systems and business processes that will have an influence on the audit approach followed by the internal auditors and secondly, how internal auditors may use information technology in conducting the audit, for purposes of planning, executing audit tasks, gathering of evidence and reporting. Now that you have worked through this topic, are you able to ● identify and address or give advice regarding the relevant aspect of information technology to incorporate in the planning of an internal audit? ● apply and give advice on the computer-related skills and techniques required to plan and conduct an internal audit? Incorporating information technology in the planning of an internal audit Learning unit 8 PART C Planning the internal audit engagement Contents TOPIC 5: Preliminary survey 57 LEARNING UNIT 9: Planning skills and techniques 58 LEARNING UNIT 10: Requirements for information/data gathering 61 LEARNING UNIT 11: Techniques for information gathering and analysis 64 TOPIC 6: Documenting business cycles and processes 103 LEARNING UNIT 12: Documenting business cycles and processes 104 TOPIC 7: Determining the scope and objectives of the engagement 107 LEARNING UNIT 13: Determining the scope of the engagement 108 LEARNING UNIT 14: Determining the engagement objectives 109 AUI3701/1 55 AUI3701/1 57 TOPIC 5 Preliminary survey Contents LEARNING UNIT 9: Planning skills and techniques 58 LEARNING UNIT 10: Requirements for information/data gathering 61 LEARNING UNIT 11: Techniques for information gathering and analysis 64 INTRODUCTION AND PURPOSE OF THE TOPIC Internal auditors gather information to obtain sufficient knowledge of the activity under audit to enable them to plan the actual audit engagement properly. This process is more critical for all first-time audits, but it is also an aspect that should not be neglected in repeat audits. During the preliminary survey of repeat audits, the internal auditor must identify any changes in the operations or business of the specific activity under audit that could impact on the business and the audit. The purpose of this topic is to guide you in learning how to conduct a preliminary survey of the area to be audited, according to the Standards and generally acceptable internal auditing practice.