香港注册会计师考师审计笔记6

Lecture Topic – IT environments – Computer systems

Lecture References

Auditing, HKIAAT 2006 edition Ch. 24-27

Modern Auditing & Assurance Service, 2nd Edition Ch

HKICPA Member’s Handbook: PN1001/1002

______________________________________________________________________________ 1Introduction

This topic describes the effects of an on-line computer system and stand alone PC on the accounting system and related internal controls and on audit procedures.

2On-Line Computer Systems

On-line computer systems are computer systems that enable users to access data and programs directly through terminal devices. Such systems may comprise mainframe computers, minicomputers or a network of connected PCs. When the entity uses an on-line computer system, the technology is likely to be complex and linked with the entity's strategic business plans. The audit team may require special IT skills to make enquiries and to understand the implications of the responses obtained.1 The auditors may need to consider using the work of an expert (see SAS 520 "Using the work of an expert").

On-line systems allow users to directly initiate various functions such as:

(a)entering transactions (for example, sales transactions in a retail store, cash

withdrawals in a bank and shipment of goods in a plant);

(b)making enquiries (for example, current customer account status or balance

information);

(c)requesting reports (for example, a list of inventory items with negative "on hand"

quantities);

(d)updating master-files (for example, setting up new customer accounts and

changing general ledger codes); and

(e)electronic commerce activities (for example, placing orders and paying for goods

over the Internet).

On-line computer systems use many different types of terminal devices. The functions they perform vary widely, and depend on their logic, transmission, storage and basic processing capabilities. Types of terminal devices are:

(a)general purpose terminals, such as:

basic keyboard and screen - used for entering data without any validation within the terminal and for displaying data from the computer system on the

screen. For example, in entering a sales order, the main computer validates

the product code and the terminal screen displays the result of the validation;

intelligent terminal - used for the functions of the basic keyboard and screen with the additional functions of validating data within the terminal,

maintaining transaction logs and performing other local processing. In the

above sales order example, the intelligent terminal verifies the correct

number of characters in the product code and the main computer verifies the

existence of the product code in the master-file;

PCs - used for all of the functions of an intelligent terminal with additional local processing and storage capabilities. Continuing the above example, the

PC may perform all the verifications of the product code;

(b)special purpose terminals, such as:

point-of-sale devices - used to record sales transactions as they occur and to transmit them to the main computer. On-line cash registers and optical

scanners used in the retail trade are typical point-of-sale devices;

automated teller machines - used to initiate, validate, record, transmit and complete various banking transactions. Depending on the design of the

system, certain of these functions are performed by the automated teller

machine and others are performed on-line by the main computer;

hand-held wireless devices for entering data from remote locations;

voice response systems - used to allow user interaction with the computer over a telecommunications network based on verbal instructions issued by

the computer. The customer communicates using a tone-generating device,

which is often the keypad on the customer's telephone. Common applications

include telephone banking and bill payment systems.

Terminal devices may be found either locally or at remote sites. Local terminal devices are connected directly to the computer through cables, whereas remote terminal devices require the use of telecommunications to link them to the computer. In some cases, however, even local terminals may be connected using telecommunications links or wireless communication links. Terminal devices may be accessed by many users, for different purposes, in different locations, all at the same time. Users such as customers or suppliers may be within the entity or outside. In such cases, application software and data are kept on-line to meet users' needs. These systems also require other software, such as access control software and software that monitors on-line terminal devices.

Increased sharing of system resources through LANs and WANs has led to the growth of distributed online processing. Client/Server systems have resulted in applications being split, so that processing can be performed across several machines. In a client/server environment, the processing of data takes place on the server and the desktop computer (client).

Employees, business partners, customers and other third parties may obtain access to an organization's on-line applications by using the Internet or other remote access services.

External parties may access the organization's applications through electronic data interchange (EDI) or other electronic commerce applications.

In addition to the users of these systems, programmers may use the on-line capabilities to develop new programs and maintain existing programs. Computer supplier personnel may also have on-line access to provide maintenance and support services.

2.1Types of On-Line Computer Systems

On-line computer systems may be classified according to how information is entered into the system, how it is processed and when the results are available to the user. On-line computer systems functions are classified as follows:

(a)on-line/real-time processing;

(b)on-line/batch processing;

(c)on-line/memo update (and subsequent processing);

(d)on-line/inquiry; and

(e)on-line downloading/uploading processing.

On-Line/Real-Time Processing

In an on-line/real-time processing system, individual transactions are entered at terminal devices, validated and used to update related computer files immediately.

An example is the application of cash receipts directly to customers' accounts. The

results of such processing are then available immediately for inquiries or reports.

On-Line/Batch Processing

In a system with on-line input and batch processing, individual transactions are entered at a terminal device, subjected to certain validation checks and added to a

transaction file that contains other transactions entered during the period. Later,

during a subsequent processing cycle, the transaction file may be validated further

and then used to update the relevant master-file. For example, journal entries may

be entered and validated on-line and kept on a transaction file, with the general

ledger master-file being updated on a monthly basis. Inquiries of, or reports

generated from, the master-file will not include transactions entered after the last

master-file update.

On-Line/Memo Update (and Subsequent Processing)

On-line input with memo update processing, also known as shadow update, combines on-line/real time processing and on-line/batch processing. Individual

transactions immediately update a memo file containing information that has been

extracted from the most recent version of the master-file. Inquiries are made from

this memo file. These same transactions are added to a transaction file for

subsequent validation and updating of the master-file on a batch basis. For example,

the withdrawal of cash through an automated teller machine is checked against the

customer's balance on the memo file, and is then immediately posted to the

customer's account on that file to reduce the balance by the amount of the

withdrawal. From the user's perspective, this system will seem no different from

on-line/real time processing since the results of data entered are available

immediately. However, the transactions have not been subjected to complete

validation before the master-file update.

On-Line/Inquiry

On-line inquiry restricts users at terminal devices to making inquiries of master-files. In such systems, the master-files are updated by other systems, usually

on a batch basis. For example, the user may inquire of the credit status of a

particular customer before accepting an order from that customer.

On-Line Downloading/Uploading Processing

On-line downloading refers to the transfer of data from a master-file to an intelligent terminal device for further processing by the user. For example, data at

the head office representing transactions of a branch may be downloaded to a

terminal device at the branch for further processing and preparation of branch

financial reports. The results of this processing and other locally processed data

may then be uploaded to the head office computer.

2.2Characteristics of On-Line Computer Systems

The characteristics of on-line computer systems may apply to many of the types of on-line systems discussed in the previous section. The most significant characteristics relate to on-line data entry and validation, on-line access to the system by users, possible lack of visible transaction trail and potential access to the system by non-users, including programmers and other third parties (for example, through e-mail and the Internet). The particular characteristics of a specific on-line system will depend on the design of that system.

When data are entered on-line, they are usually subject to immediate validation checks.

Data failing this validation are not accepted and a message may be displayed on the terminal screen, providing the user with the ability to correct the data and re-enter the valid data immediately. For example, if the user enters an invalid inventory part number, an error message is displayed, allowing the user to re-enter a valid part number.

Users may have on-line access to the system that enables them to perform various functions (for example, to enter transactions and to read, change or delete programs and data files through the terminal devices). Unlimited access to all of these functions in a particular application is undesirable because it provides the user with the potential ability to make unauthorized changes to the data and programs. Unlimited access precludes segregation of duties and allows users access to all stages of processing and recording a transaction. The extent of this access depends on things such as the design of the particular application and the implementation of software designed to control access to the system.

An on-line computer system may be designed not to provide supporting documents for all transactions entered into the system. Such a system must be able to provide details of the transactions on request or by transaction logs or other means. Examples of these types of systems include orders received by a telephone operator who enters them on-line without written purchase orders, and cash withdrawals from automated teller machines.

Programmers may have on-line access to the system that enables them to develop new programs and modify existing programs. Unrestricted access provides the programmer with the potential to make unauthorized changes to programs and obtain unauthorized access to other parts of the system and would represent a serious control weakness. The extent of this access depends on the requirements of the system. For example, in some systems, programmers ordinarily have access only to programs maintained in a separate program development and maintenance library. Programmers may, however, be authorized to change the operational programs in emergencies that require changes to programs kept online. In such cases, formal control procedures would be followed after the emergency to ensure appropriate authorization and documentation of the changes.

2.3Internal Control in an On-Line Computer System

Applications in an on-line environment may have greater exposure to unauthorized access and update. An entity's security infrastructure plays an important part in ensuring the integrity of the information produced. The auditors, therefore, consider the security infrastructure before examining the general and application controls. The entity may need to establish suitable general controls to mitigate the risks of viruses, unauthorized access and the potential destruction of audit trails. Hence access controls are particularly important to on-line processing.

These controls may include the use of passwords and specialized access control software, such as on-line monitors, that maintains control over the menus, authorization tables, passwords, files and programs that users are permitted to access. They may also include physical controls such as the use of key locks on terminal devices, locked computer rooms and inactivity timeouts.

Other important aspects of control in an on-line computer system include:

(a)controls over passwords: procedures for the assignment and maintenance of

passwords to restrict access to authorized users;

(b)system development and maintenance controls: additional procedures to ensure that

controls essential to on-line applications, such as passwords, access controls, on-line

data validation and recovery procedures, are included in the system during its

development and maintenance; the controls are also designed to ensure that changes

to systems operate as expected and are made in the correct manner;

(c)programming controls;

(d)transaction logs; and

(e)firewalls.

Certain application controls are particularly important to on-line processing. These include the following:

(a)Pre-processing authorization. Authorization to initiate a transaction, for example, by

using a bank card together with a personal identification number before being able to

make a cash withdrawal through an automated teller machine.

(b)Terminal device edit, reasonableness and other validation tests. Programmed routines

that check the input data and processing results for completeness, accuracy and

reasonableness. These routines include sequence, limit, range and reasonableness

checks and may be performed on an intelligent terminal device or on the central

computer.

(c)Input error reporting and handling. Procedures to ensure that all input errors are

properly reported, identified and rejected from further processing, corrected and

resubmitted for processing in a timely manner. These procedures will generally

comprise a mix of both manual and automated routines.

(d)Cut-off procedures. Procedures that ensure transactions are processed in the proper

accounting period. These are particularly necessary in systems that have a continuous

flow of transactions. For example, in on-line systems where terminal devices in

various locations record sales orders and shipments, there is a need to coordinate the

actual shipment of goods, inventory release and invoice processing.

(e)File controls. Procedures that ensure the correct data files are used for on-line

processing.

(f)Master file controls. Changes to master-files are controlled by procedures similar to

those used for controlling other input transaction data. More stringent enforcement of

these control procedures may be necessary because master file data may have a

pervasive effect on processing results.

(g)Balancing. The process of establishing control totals over data being submitted for

processing through the on-line terminal devices and comparing the control totals

during and after processing to ensure that complete and accurate data are transferred

to each processing phase. These balancing controls are important to monitoring

completeness and accuracy controls in a real-time processing environment. They

should be included in the automated program routines whenever possible.

(h)Control may be established by an independent function that generally:

i.receives all data for processing;

ii.ensures that all data are authorized and recorded;

iii.follows up all errors detected during processing;

iv.verifies the proper distribution of output; and

v.restricts physical access to application programs and data.

Separate controls are ordinarily required over master file and transaction data.

2.4Effect of On-Line Computer Systems on the Accounting System and Related Internal

Controls

The effect of an on-line computer system on the accounting system and the associated risks will generally depend on:

(a)the extent to which the on-line system is being used to process accounting

applications;

(b)the type and significance of financial transactions being processed; and

(c)the nature of files and programs the applications use.

The entity's security infrastructure plays an important part in controlling the effect of the risks created by the entity's use of an on-line environment.

Factors such as the following may reduce the risk of errors occurring because of the entity's use of online systems:

a)Performing data entry at or near the point where transactions originate reduces the

risk that the transactions will not be recorded.

b)Immediate correction and re-entering of invalid transactions reduces the risk that

such transactions will not be corrected and resubmitted quickly.

c)Data entry performed by individuals who understand the nature of the transactions

involved may be less prone to error than when performed by individuals unfamiliar

with the nature of the transactions.

d)Processing transactions immediately reduces the risk that they will be processed in

the wrong accounting period.

e)Authentication and authorization carried out at or near the point where transactions

originate reduces the risk of impersonation or other unauthorized access to or

manipulation of data.

The risk of errors in on-line computer systems may be increased for the following reasons:

(a)Locating terminal devices throughout the entity increases the opportunity for

unauthorized use of a terminal device and the entry of unauthorized transactions.

(b)On-line terminal devices may provide easier opportunity for unauthorized uses

such as:

i.Modification of previously entered transactions or balances;

ii.Modification of computer programs; or

iii.Access to data and programs from remote locations.

(c)If on-line processing is interrupted for any reason, for example, due to faulty

telecommunications, there may be a greater chance that transactions or files may

be lost and that the recovery may not be accurate and complete.

(d)On-line access to data and programs from remote sites through

telecommunications may provide greater opportunity for access to data and

programs by unauthorized persons. Organizations that have links to the Internet

require greater controls, such as firewalls, to manage the risk of unauthorized

access to data and programs.

(e)The use of electronic commerce and EDI for the exchange of documents between

two organizations results in the loss of traditional paper audit trails, including

invoices and purchase orders.

The characteristics of on-line computer systems illustrate some of the considerations influencing the effectiveness of controls in on-line computer systems. Such characteristics may have the following consequences:

(a)there may not be printed source documents for every input transaction;

(b)results of processing may be highly summarized; for example, only totals from

individual on-line data entry devices can be traced to subsequent processing;

(c)the on-line computer system may not be designed to provide printed reports; for

example, edit reports may be replaced by edit messages displayed on a terminal

device screen;

(d)on-line computer systems running real-time processes pose particular difficulties

for auditors as it can be difficult to achieve a clear cut-off of data. It can also be

difficult in some IT environments to stop real-time processing long enough to

obtain copies of data files or to run important reports for audit purposes at period

end; and

(e)in the event that real time systems have to be restored, it is difficult to ensure that

all of the data is properly reinstated and, importantly, that all systems integration

interfaces and data feeds are reset to the date and time of the back-up data.

2.5Effect of On-Line Computer Systems on Audit Procedures

If those controls are deemed satisfactory, the auditors will place greater reliance on internal controls in the system when determining the nature timing and extent of audit procedures. The characteristics of on-line computer systems may make it more effective for the auditors to perform a pre-implementation review of new on-line accounting applications rather than to review the applications after installation. To be fully effective, the review may need to extend to other applications that provide data for those accounting applications; the auditors may also test that the new system operates and is implemented as designed. The pre-implementation review may provide the auditors with an opportunity to request additional functions, such as detailed transaction listings, or controls within the application design. It may also provide the auditors with sufficient time to develop and test audit procedures in advance of the system's use. In contrast, when the entity adopts a policy of continuous systems' upgrading, the change management procedures adopted may be critical to the on-going effectiveness of the controls in place. The auditors may therefore examine the change management procedures rather than perform pre-implementation reviews.

The following matters are of particular importance to the auditors in an on-line computer system:

authorization, completeness and accuracy of on-line transactions through the implementation of appropriate controls at the time when the transaction is accepted

for processing;

integrity of records and processing, due to many users and programmers having on-line access to the system; and

necessary changes in the performance of audit procedures, including the use of CAATs, due to matters such as:

(a)the need for audit teams with technical skills in on-line computer systems;

(b)the effect of the on-line computer system on the timing of audit procedures;

(c)the lack of visible transaction trails;

(d)procedures carried out during the audit planning stage;

(e)audit procedures performed concurrently with on-line processing; and

(f)procedures performed after processing has taken place.

Procedures carried out during the planning stage may include the following: the participation on the audit team of individuals with technical proficiency in on-line computer systems and related controls;

identification of any new remote access facilities; and

preliminary determination, during the risk assessment process, of the impact of the system on the audit procedures.

Audit procedures performed concurrently with on-line processing may include tests of the controls over the on-line applications. For example, this may be by means of entering test transactions through the online terminal devices or by the use of audit software. These tests may be used either to confirm the auditors'understanding of the system or to test controls such as passwords and other access controls. Where the entity permits access through the Internet, audit procedures can include tests of firewalls and other authorization and access controls, as well as tests of transaction processing. To avoid the inadvertent corruption of client records, the auditors review concurrent procedures with appropriate client personnel and obtains approval before conducting the tests.

Procedures performed after processing has taken place may include the following:

tests of controls over transactions logged by the on-line system for authorization, completeness and accuracy;

substantive procedures covering transactions and processing results rather than tests of control, where the former may be more cost-effective or where the system is not

well-designed or controlled; and

reprocessing transactions as either a test of control or a substantive procedure.

3Stand-Alone PCs

PCs can be used to process accounting transactions and produce reports that are essential to the preparation of financial statements. The PC may constitute the entire computer-based accounting system or merely a part of it.

Generally, information technology (IT) environments in which stand-alone PCs are used are somewhat different from other IT environments. Certain controls and security measures that are used for large computer systems may not be practicable for PCs. In contrast, certain types of internal controls become more important because of the characteristics of stand-alone PCs and the environments in which they are used.

Stand-alone PCs can be operated by a single user or many users at different times accessing the same or different programs on the same computer. The user of a stand-alone PC that processes accounting applications performs many functions (for example, entering data and operating application programs). While typically not knowledgeable about programming, users may often use third-party or off-the-shelf software packages such as electronic spreadsheets or database applications.

The organizational structure within which a stand-alone PC is used is important in assessing risks and the extent of the controls required to mitigate those risks. For example monitoring controls employed by management may be the only effective controls for a purchased software package used by a small business on a stand-alone PC apart from whatever controls are incorporated in the package itself. In contrast, the effectiveness of controls relating to a stand-alone PC used within a larger organization may depend on an organizational structure that clearly segregates responsibilities and restricts the use of the stand-alone PC to specific functions.

The control considerations and the characteristics of the hardware and software are different when a PC is linked to other computers. Such situations often lead to increased risks. This PN does not address the auditors'consideration of network security and controls. This PN is however relevant for PCs that are linked to another computer, but can also be used as stand-alone workstations. Many PCs may be used interchangeably as part of a network or in stand-alone mode. When dealing with such PCs, the auditors consider the additional risks encountered by access through a network as well as the guidance in this

3.1Internal Control in Stand-Alone PC Environments

PCs are oriented to individual end-users. The degree of accuracy and reliability of financial information they produce will depend, in part, on the internal controls that the user adopts either voluntarily or because management has prescribed them. The control procedures implemented relate to the complexity of the business environment in which the PC operates. Ordinarily, the stand-alone PC environment is less structured than a centrally controlled IT environment. In the former, users with only basic data processing skills can implement application programs relatively quickly, triggering issues such as the adequacy of systems'documentation or access control procedures. Such users may not regard controls over the application implementation process (for example, adequate

documentation) and operations (for example, access control procedures) as important or cost-effective. In such circumstances, because the financial information is processed on a computer, users may tend to place unwarranted reliance on it.

In a typical stand-alone PC environment, the level of general controls is lower than what would be found in a large-scale computing environment. Nevertheless, selected security and control procedures can help improve the overall level of internal control.

Organizational Policies and Procedures

As part of the acquisition of an understanding of the control environment, and hence the IT environment for stand-alone PCs, the auditors consider the

organizational structure of the entity and, in particular, the allocation of

responsibilities for data processing. Effective policies and procedures for the

acquisition, implementation, operation and maintenance of stand-alone PCs can

enhance the overall control environment. A failure to implement such policies may

lead to the entity using out of date programs and to errors in the data and the

information derived from them, and may lead to an increased risk of fraud. Such

policies and procedures include the following:

acquisition, implementation and documentation standards;

user training;

security, back-up and storage guidelines;

password management;

personal usage policies;

software acquisition and usage standards;

data protection standards;

program maintenance and technical support;

an appropriate level of segregation of duties and responsibilities; and

virus protection.

Physical Protection – Equipment

Because of their physical characteristics, stand-alone PCs and their storage media are susceptible to theft, physical damage, unauthorized access or misuse. They can

be physically protected by:

locking them in a protective room, cabinet or shell;

using an alarm system that is activated if the PC is disconnected or moved from its location;

fastening the PC to a table;

policies outlining the proper procedures to follow when traveling with a laptop or using it off premises;

encryption of key files;

installing a locking mechanism to control access to the on/off switch. This may not prevent PC theft, but may be effective in controlling unauthorized

use; and

implementing environmental controls to prevent damages from natural disasters, such as fire, floods, etc.

Physical Protection - Removable and Non-Removable Media

PC programs and data can be stored on removable or non-removable storage media.

For example, diskettes and CDs can be removed physically from the stand-alone

PC, while hard disks are normally contained in the PC or in a stand-alone unit

attached to it. In addition, the interior components (including the hard drive) of

many PCs, in particular laptops, are easily accessible. When many individuals use a

particular PC, storage media are more likely to be misplaced, altered without

authorization or destroyed.

It is the user's responsibility to protect removable storage media by, for example, keeping current backups of such media in a fireproof container, either on site, off

site, or both. This applies equally to operating systems, application programs and

data.

Program and Data Security

When PCs are accessible to many users, there is a risk that the operating system, programs and data may be altered without authorization, or that users may install

their own versions of programs giving rise to potential software licensing liabilities.

The degree of control and security features present in a PC operating system vary.

Although some operating systems contain sophisticated built-in security features,

those used on stand-alone PCs generally do not. Nevertheless, there are techniques

to help ensure data are processed and read as authorized and that accidental

destruction of data is minimized. The following techniques can limit access to

programs and data to authorized personnel:

using passwords;

implementing an access control package;

using of removable storage media;

using hidden directories and files; and

using encryption.

An effective control technique is to use profiles and passwords, which control the level of access granted to a user. For example, a user may be given a profile

protected by a password that allows data entry only, and a stand-alone PC might be

configured to require a password before it can be "bootedup."

In some instances an access control package can provide effective control over the access to and use of operating systems, programs and data. For example, only a

specific user may have access to the password file or be allowed to install programs.

Such packages can also regularly examine programs on the PC to detect whether

unauthorized programs or versions of programs are being used.

The use of removable storage media for critical and sensitive programs and data can provide enhanced protection by being kept off-line and under independent control

until required. For example, salary data in a payroll system may be kept off-line and

used only when required for payroll processing.

Removing programs and data from PCs with removable storage media (for example, diskettes, CDs and cartridges) is one effective way to keep them secure. The media

are then placed in the custody of the file librarians or the users responsible for the

data or programs.

Encryption is a technique that is generally used when sensitive data are transmitted over communication lines, but it can also be used on data stored on a stand-alone

PC.

Continuity of Operations

In a PC environment, management typically relies on the user to ensure the continued availability of the systems in the event of a failure, loss or destruction of

the equipment, operating system, programs or data. This will entail:

the user retaining copies of the operating systems, programs and data, with at least one copy stored at a secure location away from the PC; and

access being available to alternative equipment within a reasonable time given the use and importance of the underlying system.

3.2The Effect of Stand-Alone PCs on the Accounting System and Related Internal Controls

The effect of PCs on the accounting system and the associated risks will generally depend on:

the extent to which the PC is being used to process accounting applications;

the type and significance of financial transactions being processed; and

the nature of programs and data used in the applications.

Below is a summary of some of the key considerations and their effects on both general and application controls.

General Controls - Segregation of Duties

In a PC environment, users can generally perform two or more of the following functions in the accounting system:

initiating source documents;

authorizing source documents;

entering data into the system;

processing data that have been entered;

changing programs and data;

using or distributing output; and

modifying the operating systems.

In other IT environments, such functions would generally be segregated through appropriate general controls. This lack of segregation of functions in a PC

environment may allow errors to go undetected and permit the perpetration and

concealment of fraud.

Application Controls

The existence and use of appropriate access controls over programs and data, combined with controls over input, processing and output of data may, in

coordination with management policies, compensate for some of the weaknesses in

general controls in PC environments. Effective controls include the following:

programmed control procedures, such as limit checks;

a system of transaction logs and batch balancing, including follow up and

resolution of any exceptions;

direct supervision, for example, a review of reports; and

a reconciliation of record counts or hash totals.

Control may be established by an independent function that generally:

receives all data for processing;

ensures that all data are authorized and recorded;

follows up all errors detected during processing;

verifies the proper distribution of output; and

restricts physical access to application programs and data.

Separate controls are ordinarily required over master file and transaction data.

3.3The Effect of a Stand-Alone PC Environment on Audit Procedures

In a stand-alone PC environment, it may not be practicable or cost-effective for management to implement sufficient controls to reduce the risks of undetected errors to a minimum level. In this situation, after obtaining the understanding of the accounting system and control environment required by SAS 300 "Audit risk assessments and accounting and internal control systems", the auditors may find it more cost-effective not to make a further review of general controls or application controls, but to concentrate audit efforts on substantive procedures. This may entail more extensive physical examination and confirmation of assets, more tests of transactions, larger sample sizes and greater use of computer-assisted audit techniques (see PN 1009 "Computer-assisted audit techniques").

Where the level of general controls appears adequate, the auditors may decide to adopt a different approach. For example, an entity processing a large number of sales transactions on a stand-alone PC may establish control procedures that reduce control risk.

Stand-alone PCs are frequently encountered in small entities. Based on a preliminary review of controls, the audit plan might include testing the controls the auditors intend to rely on.

3.4Possible problems associated with using a stand-alone PCs in small entity

1.The reduction in the cost of small computers in recent years may lead the company to

believe that controls are not needed or may be implemented at low cost. The auditor must encourage his client to appreciate that it is the value of the data not the cost of the computer that should dictate the time and money spent implementing control.

2.There is normally only a limited division of duties in a stand-alone PCs. The same person

may be responsible for preparation of input data, computer operations and distribution of output. It is important to implement clerical application controls outside the computer department to counter the limited segregation of duties with it.

3.The client may be a first-time computer user and may not implement a wide range of

application controls. In any case the system may not be fully documented and the supplier of

a package may not be prepared to release full details. The auditor may need to rely largely

on substantive testing to obtain adequate audit evidence.

4.There may be unrestricted access to terminals of data. This should be controlled by (i)

nominating specified personnel to use terminals; (ii) physical access restrictions; (iii) password protection; (iv) proper supervision by senior officials; and (v) user logs to record the use of terminals and attempts to gain unauthorized access.

5.Many small systems operate on a real-time basis. Controls may include detailed editing of

transactions, the maintenance of transaction logs and control accounts and full review of output by officials outside the computer department. The auditor should check that editing and authorization extend to changes in standing data as well as routine transactions.

6.There are dangers of errors or loss of data on the conversion to a new small computer system.

The conversion process should be fully documented and controls such as maintaining record counts and control totals should be used. If possible the auditor should become involved prior to and during the conversion process.

7.There are dangers that program changes are made that are unauthorized or badly designed

by the client’s staff. In addition the client’s staff may neglect other managerial duties in spending time attempting to program the computer. The client should attempt to segregate operations staff from programmers. It is often cost-effective for the client to employ a consultant to design and amend programs. The existing software can be protected by being etched onto silicon chips to form ‘read-only memory’. The object programs may be held in machine code only and so are much more difficult for staff to amend. Back-up versions of programs should be maintained.

8.There is finally a general problem that such systems may not provide visible audit trail. The

auditor may wish to use audit interrogation packages but these were traditionally designed for mainframe and may not function on some small systems. The writing of a one-off program may not be cost-effective. The use of a manufacturer’s own enquiry programs may not cost-effective unless the portfolio of clients using that type of equipment is large. The result is that a substantive-based approach is likely to dominate this type of audit until computer-assisted techniques which are reasonable priced and which can be applied to a wide range of small systems become available.