Domain 1 Information System Auditing Video Notes

What is audit planning

1. Understanding the business

2. Identify risks

3. Setting goals and scope

4. Audit procedures

5. Allocating resources to complete the audit

What are the benefits of audit planning

1. Helps identify high risk areas (Most important idea and benefit)

2. Optimization of audit resources

3. Budget estimation

4. timely completion of the audit

Who should the audit plan be communicated to?

1. Senior Management: helps to gain support for audit procedures and ensures that everyone is aligned

2. Business functions and stakeholders: preplanned audit helps in smooth conduct of audit

3. Internal audit team: Effective resource planning

In audit planning what should be the IS auditor first step to identify

High risk areas so audit resources can be allocated to those areas

What is the primary advantage of risk based audit planning

Optimium use of resources for high risk areas

What is an audit universe

The list of all possible audits that could be performed within an organization covering all auditable areas.

What is an audit charter

Outlines the responsibilities and authority of each member within the internal audit team and outlines the scope of the audit function

Who approves of the audit charter

Senior Management / Audit committee of the board

what an audit charter should be and not be

SHOULD:

• outline the roles and responsibilities of audit function

• Is approved by the highest level of management

• written

SHOULD NOT:

• be dynamic, meaning it should not change often

• Should not include routine audit activities

What had the most influence on an IS auditor’s actions?

Audit Charter

What is the primary reason for the audit function directly reporting to the audit committee

The audit function must be independent of the business function and should have direct access to the audit committee of the board

What is the electronic data interchange (EDI)

The connection of two systems, such as connecting an internal system to your customer’s internal system to make the transfer of data between two systems more efficient

What are the risks of EDI process

1. Legal liability with the absence of a trading partner agreement (Biggest risk when it comes to EDI)

2. Authorization and authentication of trading partner system

3. Data integrity and loss or duplication of EDI Transactions

What are the controls in place to mitigate the risk for inbound transactions?

1. Maintain a log of all transactions

2. Perform a reconciliation of inbound transactions by building segment count totals

3. Implement check digit control to detect transposition and transcription errors

What are the controls in place to mitigate the risk for outbound transactions

1. Maintain log of each outbound transaction

2. Transaction can be compared to trading partners input

3. Proper SODs for high risk transactions

What is the objective of key verification control

Ensure that the data inputted is correct, as key verification requires the data to be entered a second time and is compared with the initial data entry.

What is the objective of nonrepudiation

Ensures that the transaction is enforceable and that the sender cannot later deny generating and sending the message.

What are internal controls and what is the purpose of them

1. Internal controls are mechanisms and procedures in place to ensure the integrity of an organization’s processes and systems as they help mitigate potential risks in a company

2. The main objective of internal controls is to provide reasonable assurance to management about risks being mitigated and achievement of business objectives

What are the 4 types of controls?

1. Preventive - Tries to prevent a negative to occur

2. Detective - Objective is to detect the negative event

3. Corrective - Objective is to correct the detected negative event

4. Deterrent - objective is to give a warning signal to deter an event

What is risk

Risk is the product of Probability * Impact

When is risk owner identification most important

During the risk analysis phase because risks are evaluated and treatment decisions are made at this stage.

What is the most important factor for mitigation of risk?

Risk Ranking and Prioritization as resources are scarce and focusing on the high risk areas should be prioritized.

What is the difference between threat and vulnerability

Threat is something that can cause harm. Threat cannot be controlled and cannot be fixed or mitigated with controls

Vulnerability is internal weakness that causes you to have a higher likelihood of being hurt. Vulnerabilities can be mitigated by having controls in place.

What are the 5 types of risk

1. Inherent Risk: Risks that an organization is exposed to before they have controls in place

2. Residual Risks: Risks that an organization if faced with after they have implemented controls to mitigate a risk

3. Control Risk: Risk that the controls that are in place do not do an effective job in mitigating risk. AKA Ineffective controls

4. Detection Risk: Risk that the auditor’s testing does not identify the errors. AKA Ineffective audit

5. Audit risk: Audit risk is the risk that an auditor will issue an incorrect audit opinion because of material errors, weakness, or misstatements exists but is not identified during the audit. Audit risk is the sum of inherent risk, control risk, and detection risk

What are the risk response options?

1. Mitigation - Objective is to reduce the risk to acceptable level and to reduce probability of impact of risk event by implementing appropraite controls. This is the most used risk response.

2. Acceptance - Accept risk when the cost of using controls will cost more then the cost of the risk. This has the highest liability involved

3. Avoidance - This is last choice option when no other response is adequate. Avoid projects that have a high chance of failure

4. Transfer - Transfer risk that have low probability of occurring but have high impact like home insurance

What is the most important step in a risk assessment is to identify:

Threats and Vulnerabilities

What is the advantage of risk based audit planning

Resources can be used in high risk areas

What does the level of protection of information assets depend on

Criticality of the asset

What is the advantage of the bottom up approach for the development of organizational policies

Policies are considered on the basis of risk assessment

What are the 6 steps of risk assessment

1. Understand the business environment

2. Identify the critical assets

3. Identify all potential risks for critical assets

4. Prioritize the risk in order of criticality

5. Evaluate various control mechanisms available

6. Apply relevant controls

What are the steps of the audit process

1. Determine Audit subject

2. Define audit objective

3. Set audit scope

4. Pre-audit planning

5. Determine audit procedures

6. Field work and documentation

7. reporting phase

What is the next step once audit findings have been identified

Discuss it with auditee management to find agreement on findings

What is the first step in developing an annual internal IS audit plan

Determine the audit universe, as this identifies the list of all of the processes that are in scope of the audit

What is the prime consideration in determining the objective and scope of an audit

The statutory requirements applicable to the organization

What is the prime reason for performing a risk assessment before conduct of an audit

To provide reasonable assurance about the audit coverage of material items

What is the first step in the planning phase of an audit

Conducting a risk assessment to determine the high risk areas to allocate more resources to that area

What occurs during the pre-planning audit planning phase

The auditor conducts risk assessment to identify high risk areas to allocate resources efficiently and acquire business knowledge of the audit subject

What is the main purpose of the reporting phase

To meet with the audit subject to discuss findings and recommendations with management, issuing the formal audit report that documetes the audit work and suggested corrective actions and performing follow up audits to verify whether the agreed upon recommendations have been implemented.

If audit findings are discovered, what is the next step

Have a discussion with auditee management to obtain agreement on the findings before reporting to senior management on it

What is the most reliable source of information when designing a risk based Audit plan

Input from senior management as they can identify critical and high risk areas.

What is the differences between statistical and non-statistical sampling

Statistical Sampling is objective and known as non-judgemental sampling. The probability of error can be quantified and each item has an equal chance of being selected.

Non-Statistical Sampling is subjective and is known as judgmental sampling. The probability of error cannot be quantified and sampling depends upon the judgement of the auditor. Very similar to haphazard sample selection.

What is attribute sampling

Simplest kind of sampling, where we sample some number of items and classify each item as either having some attribute

Generally is used in compliance testing and is expressed in percentages

What is variable sampling

Variable sampling is more detailed then attribute sampling as it allows us to understand ‘how much’ or ‘how bad’ rather then yes or no.

Generally is used in substantive testing

Variable sampling is usually expressed in monetary values, weight or some other measure

what is stop or go sampling

It is used when the auditor believes that very few errors will be found and it prevents excessive sampling by allowing an audit test to be stopped at the earliest possible moment.

What is discovery samplign

Discovery sampling is used when objective of audit is to discover fraud or other regularities

What is confidence co-efficient

Confidence coefficient is a probability that sample are true represention of the population. to have high confidence coefficient, you need to select a high sample size

If there are strong internal controls - Confidence co-relation / sample size can be lower

If weak internal controls - confidence co-relation / sample size needs to be increased

What is the difference between compliance testing and Substantive Testing

Compliance testing is a test of controls and checks for presence of controls. We gather evidence with the objective of testing an organization’s compliance with control procedures. Compliance testing is done to check whether controls are properly configured, implemented, and operating as intended

Substantive testing is a test of transaction to evaluate the integrity of data.

Note: Compliance testing will be performed first before substantive testing. The outcome of compliance testing will form the basis for planning of substantive testing. For compliance testing, we always use Attribute sampling.

What determines the reliability of audit evidence

1. Independence of the evidence provider. Note that evidence from external parties are more reliable than evidence within the organization

2. Qualifications of the evidence provider (Same as reviewer comp and auth)

3. Objectivity of the evidence: Objective audit evidence is most reliable

4. Timing of evidence: Documents that are updated on a frequent basis should be considered based on relevant timing.

Evidence gathering techniques

1. Review of the organization structure: Review of the organization governance model helps an auditor understand the control environment of the enterprise.

2. Review of IS policies, processes, and standards: the audit team should review the IS policies, procedures, and standards to determine the effectiveness of the controls implemented

3. Observations

4. Interview Techniques

5. Reperformacne: Reperformce is when an IS auditop performs the activity that is originally performed by management to complete their review.

6. Process Walkthrough

What is Computer assisted audit techniques (CAATS)

CAATs are the most effective auditing tools for computerized environments and ensures the reliability of audit evidence as data is directly collected, processed, and analyzed by the IS auditor

What is the best evidence for the existence of SOD

Observation and Interview

What are the 5 continuous auditing techniques

1. System Control audit review file (SCARF) / Embedded Audit Module (EAM)

2. Snapshots

3. ITF

4. Audit hooks

5. Continous intermittent simulation

What is SCARF auditing technique

Online / continuous auditing technique where audit routines are embedded directly into an application system to continuously monitor transactions and identify exceptions as they occur. Used when regular processing cannot be interrupted

• SCARF files records only those transactions which are of special audit significance such as transactions above specified limit or transactions related to deviation/exception

What is Snapshots

Continous auditing technique that takes pictures of the process live and is used when an Audit trail is required as it takes snapshots of the transaction as transaction moves through various stages in the application system

• Captures before processing and after processing images of the transactions

What is ITF (Integrated Test Facility) continuous auditing technique

It is the use of creating dummy entities in live production environment to test the application functionality

• Benefit of ITF is that since the production environment is used, there is no need to create a separate test envinroment, but need to isolate test data from actual production data

• Other benefit of ITF is that it verifies system processing as it checks the logic of the system with the use of dummy data.

what is audit hooks

Continous auditing technique that is used when selected transactions need to be examined and helps in early detection of error / fraud. Uses audit software that captures suspicious transactions

• Audit hooks are used for simple transactions

• Criteria for suspicious transactions are designed by auditors as per their requirement

What is continuous intermittent simulation (CIS)

It is used within DBMS and best used when transactions meeting certain criteria needs to be examined.

DBMS reads the transaction which is passed to CIS, and if the transaction is as per selected criteria, CIS checks the transaction for correctness

CIS determines whether any discrepancies exist between the results it produces and those the application system produces, simulating the application system processing

• CIS used for complex transactions

• CIS is also best used when transactions meeting certain criteria needs to be examined.

What is the first step of conducting data analytics

Determine the objective and scope of analytics

What is the objective of an audit closure meeting

To ensure that there have been no misunderstandings or misinterpretation of facts

What is the objective of conducting a follow up audit

To validate the corrective/remediation action

what is the best course of action for an audit team if they find prior audit reoports without workpapers is:

To inform audit management and suggest retesting the controls

What is Control Self assessment

The involvement of line managers and business teams in identifying risks and evaluating controls within their own processes. Since employees and business teams understand the process best, they can help detect weaknesses early, improve control ownership and strengthen risk management

1. Understand their processes

2. Identify risk

3. Identify controls to address risk

   1. Assess how effectively controls are working

Note: CSA does not replace the audit function and only enhances it and this is usually the main disadvantage of CSA is when people have this notion.

What are the main objectives of CSA

1. Concentrate on high risk areas

2. Enhance audit responsibility

What is the role of the IS Auditor in CSA

To act as the facilitator that supports and guides. But ultimately, the responsibility for identifying risks and evaluating controls still falls to the business teams.

What is the most important requirement for successful CSA implementaion

Involvement of line management in control monitoring as this provides continuous oversight, early identification of risks and timely corrective actions.