Page 145 - DCOM509_ADVANCED_AUDITING

Advanced Auditing

Notes
Did u know? Record selection criteria may be based on prior audits, but auditors should
continually assess opportunities to improve audit coverage especially if this can be
accomplished at reduced overall cost.

8.5.3 Retrieval and Analysis Software

Information retrieval and analysis tools can present significant technical challenges to auditors
because audit information may reside in diverse and distributed system types with varying
degrees of control and standardization. Data may be stored under the control of various machine
types and operating systems using differing formats; they may move across environments
using different protocols; they may be stored or archived by various database management
systems using fixed or variable length fields or records, and subject to differing database standards;
and lastly, they may even reside in numerous physical locations as in a distributed database or
data environment.
Many auditing departments use technical specialists to locate and evaluate data sources. These
specialists provide the software tools to extract data, converting them into a form that can be
used by audit analytical tools. In some companies, information is stored according to specified
standards that do not change frequently and multiple audits may be performed on information
in a common format. In such cases, libraries of information retrieval routines can be maintained,
called and executed by any auditor. Once information is stored in a form usable by audit analytical
tools, auditors with varying degrees of technical expertise actually perform and review the
results of analysis. Many office software tools such as spreadsheets or databases may be able to
access and analyze information stored in an ODBC format.

8.5.4 Trends in Information Retrieval and Analysis

A trend in auditor information retrieval and analysis is to include greater intelligence in auditing
or monitoring software embedded in business systems and networks. As auditors identify risk
elements and develop software to detect errors or suspicious transactions, it is often a simple
process to embed the tests or monitors into the systems. In such cases, auditors can then be
informed of errors or changes in data patterns soon after they occur. Auditors planning to
deploy embedded system audit features can be identified as users of systems under development.
Rather than acting on the design and development team as control specialists, auditors act as any
other system user or interfacing system representative. They specify the record selection and
data format criteria for embedded monitors, as well as any special features such as the ability to
modify, expand or suspend such monitoring. Case in point, auditors may expect certain systems
to process transactions at expected volumes or within certain monetary ranges.

8.5.5 Audit Reporting

Some audit tools today provide automatic linking between work performed, information
gathered, auditor assessments, and information used in or supporting audit reports. Intelligent
work papers may note answers in internal control questionnaires (ICQ) that indicate actual or
potential weaknesses and automatically prepare a section in the audit report to document the
weakness or resolution of the problem. Audit reporting; too, can automatically provide
information about sections of audits performed by individual auditors as they are completed so
the audit supervisor will know the ongoing status of audit projects. Such reporting will also
allow the supervisor to concentrate on audit processes that indicate problems and/or provide
additional resources in areas falling behind schedule. The audit report can easily contain links to
work papers, worksheets, graphs or other information that will be automatically updated as
data changes.

140 LOVELY PROFESSIONAL UNIVERSITY