ACCG340 Study Guide - Final Guide: Internal Control, Data Integrity, Business Process

116 views6 pages

scarletsquirrel639

19 Jun 2018

School

Macquarie University

Department

Accounting and Corporate Governance

Course

ACCG340

Professor

Fiona Froster

For unlimited access to Study Guides, a Grade+ subscription is required.

WK 9

IT systems: Internal control

1. The IT environment

a. A computer information (IT) system encompasses automated means of originating,

processing, storing and communicating information, and is an integral part of the IT

environment of a business.

b. Key elements of IT System

i. Technology (e.g. hardware, software)

ii. People (e.g. database administrators, data entry operators)

iii. Procedures (e.g. policies and guidelines, training)

iv. Data

2. Auditing IT systems

a. Auditing in an IT system is similar to auditing in a manual environment

b. The main

differences

are:

i. additional issues need to be considered in relation to an IT system with respect

business risks

and

internal control evaluation

and,

ii. auditors may need to utilise computer assisted audit techniques (CAATs) for audit

testing.

c. Planning:

i. level of IT dependence / IT business related risks

ii. IT related IC strengths and weaknesses

d. Audit Evidence:

i. use of CAATs for

1. tests of controls

2. substantive testing

3. Examples of IT risks relevant to the auditor

a. Planning and organisation

i. IT strategy not aligned with the business strategy è unable to support business

information needs / accounting processes and increasing risk of errors

b. Acquisition, implementation and maintenance

i. implementation of new accounting application under time pressure è e.g. inadequate

testing may lead to operation problems and processing errors

ii. unauthorised changes to programs è increase risk of processing and reporting errors

iii. interface problems è loss, duplication or corruption of data

c. Delivery and support

i. unauthorised access to application, operating systems and data è improper initiation,

approval or execution of transactions

ii. inadequate

backup and recovery

procedures è loss of data

d. Monitoring

i. access

violations

not monitored è difficult to enforce responsibility and

accountability

4. Specific internal control risks posed by IT processing (ASA 315.A63)

a. Programs processing data inaccurately and/or processing inaccurate data

b. Destruction of data, improper changes to data, recording non-existent transactions

c. User privileges not limited to assigned duties

d. Unauthorised changes to master files and/or systems or programs

e. Failure to make necessary changes to systems or programs

f. Inappropriate manual intervention

g. Loss or inability to access data as required

5. Internal controls in an IT system

a. Controls in a IT environment can be divided into general and application controls. They

must be reviewed by the auditor in order to assess the level of risk in relation to IT

systems and internal control.

General controls

are

manual

and computer controls surrounding the environment in which

Unlock document

This preview shows pages 1-2 of the document.
Unlock all 6 pages and 3 million more documents.

Already have an account? Log in

computer systems operate and relate to

all or many computerised accounting applications

Application controls

relate to

individual computerised accounting applications

e.g.

sales, inventory. They may be

programmed = automated (means it’s inside the computer)

or manual

and are located in the user or IT departments.

e. IT control should be processed by IT Auditors

6. Categories of IT general controls

Segregation of duties

i. Separation between IT and user department functions e.g. users are not programmers

ii. Separation of incompatible functions within the IT department i.e. those who develop

and understand the systems (programmers) aren’t responsible for its access and

operation e.g. operators are not programmers.

System implementation/change controls

i. Ensure that systems acquisition (authorisation), development and modification

processes are properly managed

Physical hardware controls

i. Ensure continuity of processing in the event of hardware malfunction or breakdown

ii.

Prevent unauthorised access to physical hardware (e.g. lock the laptop in the draw )

Software controls

i. prevent unauthorised changes to computer programs(log in and password (or fingerprint)

should be implemented to all applications)

ii. ensure reliability of system software

Data and network security controls

i. prevent unauthorised access or changes to data

ii. data is not lost, integrity is maintained

7. Testing of IT general controls

a. There is no change in the approach to testing as many of these controls are generally

manual. Test procedures include:

Inquiry

in conjunction with the following 3.

ii.

Inspection

(inspect a sample of initial temporary password to ensure companies do

have the initial control)

iii.

Observation

(observe an employee do have typed its log in and password)

iv.

re-performance

(typing log in and password to an computer to see whether the access

has been granted)

8. Categories of IT application controls

a. Application controls (ASA 315.A105) are manual or automated/programmed procedures that

operate at a business process level and therefore apply to the processing of individual

applications.

b. The reliance that can be placed on application controls often depends on the reliability

of the general controls.

c. Categories:

Unlock document

This preview shows pages 1-2 of the document.
Unlock all 6 pages and 3 million more documents.

Already have an account? Log in

Document Summary

It related ic strengths and weaknesses use of caats for: tests of controls, substantive testing, examples of it risks relevant to the auditor, planning and organisation. They may be programmed = automated (means it"s inside the computer) or manual and are located in the user or it departments: it control should be processed by it auditors, categories of it general controls, segregation of duties. Separation between it and user department functions e. g. users are not programmers. Separation of incompatible functions within the it department i. e. those who develop and understand the systems (programmers) aren"t responsible for its access and operation e. g. operators are not programmers: system implementation/change controls. Ensure that systems acquisition (authorisation), development and modification processes are properly managed: physical hardware controls, software controls. Ensure continuity of processing in the event of hardware malfunction or breakdown. Inspection (inspect a sample of initial temporary password to ensure companies do have the initial control)

Related Questions

13-35 (Objectives 13-3, 13-4) McClain Plastics has been an auditclient of Belcor, Rich, Smith & Barnes, CPAs (BRS&B), forseveral years. McClain Plastics was started by Evers McClain, whoowns 51% of the companyâs stock. The balance is owned by about 20stockholders, who are investors with no operationalresponsibilities. McClain Plastics makes products that have plasticas their primary material. Some are made to order, but mostproducts are made for inventory. An example of aMcClain-manufactured product is a plastic chair pad that is used ina carpeted office. Another is a plastic bushing that is used withcertain fastener systems.

McClain has grown from a small, two-product company, when theyfirst engaged BRS&B, to a successful, diverse company. At thetime Randall Sessions of BRS&B became manager of the audit,annual sales had grown to $200 million and profits to $10.9million. Historically, the company presented no unusual auditproblems, and BRS&B had issued an unmodified opinion everyyear.

The audit approach BRS&B always used on the audit of McClainPlastics was a âsubstantiveâ audit approach. Under this approach,the in-charge auditor obtained an understanding of internal controlas part of the risk assessment procedures, but control risk wasassessed at the maximum (100%). Extensive analytical procedureswere done on the income statement, and unusual fluctuations wereinvestigated. Detailed audit procedures emphasized balance sheetaccounts. The theory was that if the balance sheet accounts werecorrect at year-end and had been audited as of the beginning of theyear, then retained earnings and the income statement must becorrect.

Part I

In evaluating the audit approach for McClain for the currentyearâs audit, Sessions believed that a substantive approach wasreally only appropriate for the audits of small nonpubliccompanies. In his judgment, McClain Plastics, with sales of $200million and 146 employees, had reached the size where it was noteconomical, and probably not wise, to concentrate all the tests onthe balance sheet. Furthermore, although McClain is not a publiccompany, Sessions recognized that similar public companies arerequired by Section 404 of the SarbanesâOxley Act and related PCAOBstandards to have an integrated audit of the financial statementsand internal control over financial reporting. Therefore, hedesigned an audit program that emphasized identifying internalcontrols in all major transaction cycles and included tests ofcontrols. The intended economic benefit of this âreducing controlriskâ approach was that the time spent testing controls would bemore than offset by reduced tests of details of the balance sheetaccounts.

In planning tests of inventories, Sessions used the audit riskmodel included in auditing standards to determine the number ofinventory items BRS&B would test at year-end. Because of thenumber of different products, features, sizes, and colors,McClainâs inventory consisted of 2,450 different items. These weremaintained on a perpetual inventory management system that used arelational database.

In using the audit risk model for inventories, Sessions believedthat an audit risk of 5% was acceptable. He assessed inherent riskas high (100%) because inventory, by its nature, is subject to manytypes of misstatements. Based on his understanding of the relevanttransaction cycles, Sessions believed that internal controls wereeffective. He therefore assessed control risk as low (50%) beforeperforming tests of controls. Sessions also planned to usesubstantive analytical procedures for tests of inventory. Theseplanned tests included comparing gross profit margins by month andreviewing for slow-moving items. Sessions believed that these testswould provide assurance of 40%. Substantive tests of details wouldinclude tests of inventory quantities, costs, and net realizablevalues at an interim date two months before year-end. Cutoff testswould be done at year-end. Inquiries and substantive analyticalprocedures would be relied on for assurance about events betweenthe interim audit date and fiscal year-end.

Required

Decide which of the following will likely be done under both areducing control risk approach and a substantive approach:

Assess inherent risk.

Obtain an understanding of internal control.

Perform tests of controls.

Perform substantive analytical procedures.

Assess planned detection risk.

What advantages does the reducing control risk approach Sessionsplanned to use have over the substantive approach previously usedin the audit of McClain Plastics?

What advantages did the substantive approach have over thereducing control risk approach?

Part II

The engagement partner agreed with Sessionsâs recommendedapproach. In planning the audit evidence for detailed inventorytests, the audit risk model was applied with the followingresults:

PDR=AATIRÃCRÃAPR

where:

PDR=PlanneddetectionriskAAR=acceptableauditriskIR=inherentriskCR=controlriskAPR=analyticalproceduresrisk

Therefore, using Sessionsâs assessments and judgments asdescribed previously,

PDR=.051.0Ã.5Ã.6PDR=.17

Required

Explain what .17 means in this audit.

Calculate PDR assuming that Sessions had assessedcontrol risk at 100% and all other risks as they are stated.

Explain the effect of your answer in requirement b. on theplanned audit procedures and sample size in the audit of inventorycompared with the .17 calculated by Sessions.

Part III

Although the planning went well, the actual testing yielded somesurprises. When conducting tests of controls over acquisitions andadditions to the perpetual inventory, the staff person performingthe tests found that the deviation rates for several key controlswere significantly higher than expected. As a result, the staffperson considered internal control to be operating lesseffectively, supporting an 80% control risk rather than the 50%level used. Accordingly, the staff person âreworkedâ the audit riskmodel as follows:

PDR=.051.0Ã.8Ã.6PDR=.10

A 10% test of details risk still seemed to the staff person tobe in the âmoderateâ range, so he recommended no increase inplanned sample size for substantive tests.

Required

Do you agree with the staff personâs revised judgments about theeffect of tests of controls on planned substantive tests? Explainthe nature and basis of any disagreement. If BRS&B was alsoissuing a report on internal control over financial reporting,describe the implications of these results on the auditorâsinternal control report.

Robatelli's Pizzeria Case StudyIntroduction On the morning of October 31st, Elaine Black, Chief Information Officer at Robatelli's Pizzeria, was waiting for both Jim Saxton, database administrator, and Peter Greyton, operations manager, to come to her office for a meeting. While waiting, Elaine was thinking about the surge of telephone and Internet orders expected to be received through the company's customer order center within the next 12 hours. Halloween had always been the most popular day of the year for people in the greater Pittsburgh area to order pizza from Robatelli's. There were 53 restaurant locations to serve these customers, but only one location to receive all of the orders and forward them to the right restaurant. Elaine's thoughts were interrupted as Jim and Peter entered her office. The following conversation took place: ELAINE Well, guys, it's here again, our biggest day of the year. Not only is Halloween a busy day, but we have the upcoming day after Thanksgiving, the week before Christmas, and Super Bowl Sunday. Can our current computer system's infrastructure and people keep pace with the orders we expect? JIM I think our systems are all running at peak performance. We shouldn't have any computer concerns for today or those other busy days. PETER Everyone in the customer order center is focused on making sure that our customers get their pizzas as ordered. We have plenty of people scheduled to work tonight, so we're good to go. ELAINE Terrific. But every time we face one of these peak sales days, I start wondering about the long-term capacity and effectiveness of our computer systems. Jim, we need to think long term about our computer system. I was just reading an article that I'd like you to take a look at. It's about Anheuser-Busch Companies and their use of data mining. JIM I do agree with you, Elaine; we should always be thinking about how newer IT systems can help us. Could you e-mail me the link to the article? ELAINE Sure, and I would like you to think about how we might use the same approach in our business. Peter, your order center people are doing a great job, but again there's something I'd like us to think about in the long run. As you know, we now have to manually enter all customer order center sales and store sales into our general ledger (GL). I think we could improve a lot of things if those sales are automatically fed into our GL software. Why don't you think about any advantages you see for an automatic interface, and we'll look at the costs compared to those advantages. How's that sound? PETER I'll do that. I'll give it some thought and work on a report about an automatic interface between our GL software and the point of sale systems in our restaurants as well as the phone and Internet sales. How soon do you want to meet again to look at these issues? ELAINE Let's say, in two weeks at the same time. As Jim and Peter left her office, Elaine continued to think about the features of the company's accounting information systems and whether or not data extracted from these systems could facilitate the multiple needs of the company. The focus had always been on providing accurate financial accounting information from the various locations; however, the company's aggressive growth strategies meant increased emphasis on the system's ability to analyze detailed customer information that could be translated into increased sales opportunities. Elaine knew the challenges they faced could very well affect the company's ability to maintain its competitive advantage. She realized that her department must continually improve the company's information systems to help it achieve growth strategies. Operating state-of-the-art systems was imperative to position the company to execute those growth plans. However, she was concerned about the possibility that restrictions of the current information systems could actually prevent the company from doing what it wanted to do. Allowing restrictive systems to prevent them from achieving business strategies was a risk that Elaine would not tolerate!

Review the Robatelli's Pizzeria Case Study.

Develop an internal controls system in Robatelli's Pizzeria sales and cash business areas.

Prepare a 12- to 16-slide presentation describing the typical activities and outlining an effective system of internal controls for the Sales, Sales Returns, and Cash Collections business areas. Include any associated risks in these areas.

Describe specific internal controls that include authorization of transactions, segregation of duties, adequate records and documentation, security of assets, and independent checks and reconciliation for each business area.

ACCG340 Study Guide - Final Guide: Internal Control, Data Integrity, Business Process

Document Summary

Get access

Related Documents

ACCG340 Study Guide - Final Guide: Audit Evidence, Direct Bank, Audit Risk

ACCG340 Study Guide - Final Guide: Audit Evidence, Audit Risk, Financial Statement

ACCG340 Study Guide - Final Guide: Audit Risk, Audit Evidence, Clent

Related Questions