AUDIT PROCEDURES ARE SYSTEMS
Several steps are required to perform an audit. The systems auditor must assess the overall
risks and then develop an audit program that consists of control objectives and audit
procedures that must meet those objectives.
The audit process requires the systems auditor to gather:
AUDIT PLANNING
Proper planning is the first step necessary to perform effective system audits. The systems
auditor must understand the business environment in which the audit is to be performed as
well as the business risks and associated control.
AREAS THAT MUST BE COVERED DURING THE PLANNING OF THE AUDIT:
to. Understanding of the business and its environment.
The systems auditor must have a sufficient understanding of the total environment being
reviewed. It should include a general understanding of the various business practices and
functions related to the subject of the audit, as well as the types of systems used. The systems
auditor must also understand the regulatory environment in which the business operates. For
example, a bank will be required to have integrity requirements for information and control
systems that are not present in a manufacturing company. The steps that a systems auditor
can carry out to obtain an understanding of the business are: Go through the facilities of the
entity. Reading of background material that includes publications on that industry, reports and
financial reports. Interviews with key managers to understand essential business issues. Study
of reports on norms or regulations. Review of long-term strategic plans. Review of previous
audit reports.
b. Risk and audit materiality.
Audit risks can be defined as those risks that the information may have material errors or that
the systems auditor cannot detect an error that has occurred. Audit risks can be classified as
follows: Inherent risk: When a material error cannot be prevented from happening because
there are no related compensatory controls that can be established. Control Risk: When a
material error cannot be avoided or detected in a timely manner by the internal control
system. Detection risk: It is the risk of the auditor performing successful tests based on an
inappropriate procedure. The auditor can conclude that there are no material errors when
there really are. The word "material" used with each of these components or risks, refers to an
error that should be considered significant when an audit is carried out. In an information
systems audit, the definition of material risks depends on the size or importance of the audited
entity as well as other factors. The systems auditor should have a thorough understanding of
these audit risks when planning. An audit may not detect each of the potential errors in a
universe. But, if the sample size is large enough, or adequate statistical procedures are used,
the probability of detection risk is minimized. Similarly, when evaluating internal controls, the
systems auditor should perceive that in a given system a minimum error can be detected, but
that error, combined with others, may turn into a material error for the entire system. The
materiality in the systems audit must be considered in terms of the total potential impact for
the entity rather than some monetary-based measure.
c. Risk assessment techniques.
In determining which functional areas or audit issues to be audited, the systems auditor may
face a wide variety of audit candidate issues, the systems auditor should assess those risks and
determine which of those high-risk areas should be audited. . There are four reasons why risk
assessment is used, these are: Allow management to allocate necessary resources for the
audit. Ensure that relevant information has been obtained from all management levels, and
ensures that the activities of the audit function are correctly directed to high-risk areas and
constitute an added value for management. Establish the basis for the organization of the
audit in order to effectively manage the department. Provide a summary that describes how
the individual audit issue relates to the overall organization of the company as well as the
business plans.
d. Control objectives and audit objectives.
The objective of a control is to cancel a risk following some methodology, the audit objective is
to verify the existence of these controls and that they are functioning efficiently, respecting
the company's policies and objectives.
0
