Computer-Assisted Audit Tools and Techniques Study Notes

SOX Compliance: Management and auditors must consider IT application controls related to financial reporting.
Input Controls: Programmed procedures (edits/validation) ensuring data integrity before processing.
Processing Controls: Logic-based tests ensuring application accuracy (run-to-run, operator intervention, audit trail).
Output Controls: Procedures protecting system output from loss, misdirection, or privacy violations.

Field Interrogation:
- Check Digit: Detects transcription (addition, truncation, substitution) and transposition (single, multiple) errors. Modulus 11 uses weights (5, 4, 3, 2) to calculate specific digits.
- Missing Data Check: Identifies empty fields.
- Limit/Range Checks: Verify data against authorized upper/lower thresholds.
- Validity Check: Matches values against a list of acceptable codes (e.g., valid vendor list).
Record Interrogation: Examines field interrelationships via Reasonableness Checks, Sign Checks, and Sequence Checks (crucial for sequential master files).
File Interrogation: Uses Header Labels, Version Checks (in GFS systems), and Expiration Date Checks to ensure correct file processing.

Run-to-Run Controls: Use batch control data to reconcile processing stages. Key metrics include record counts, total dollar values (Control Totals), and Hash Totals (sums of non-financial fields like sales invoice numbers).
Error Correction: Includes immediate correction, using a temporary Error File, or rejecting the entire batch.
Operator Intervention Controls: Limits human error by providing parameter values through look-up tables.
Audit Trail Techniques: Preservation through Transaction Logs (recording only successful updates), automatic transaction logs, unique identifiers, and error listings.

Batch Systems: High risk due to physical distribution. Controls include Output Spooling security, print program document counts, Bursting supervision, and shredding Waste.
Real-Time Systems: Primary threats include equipment failure and subversive interception during transmission.
End User Controls: Users perform final accuracy reviews and manage report retention based on statutory requirements.

Black-Box (Around the Computer): Analyzing flowcharts and reconciling production inputs with actual outputs without testing internal application logic.
White-Box (Through the Computer): Testing internal logic through access, validity, accuracy, completeness, and redundancy tests.
Rounding Error Tests: Monitoring for Salami Fraud, where small rounding differences are diverted to unauthorized accounts using an accumulator and rounding algorithms.

Test Data Method: Processing valid and invalid test files through the application to compare results with expectations.
Base Case System Evaluation (BCSE): Comprehensive test data used during development to create a baseline for future maintenance testing.
Tracing: An electronic walkthrough of program instructions executed for specific transactions.
Integrated Test Facility (ITF): Embedded audit modules that process "dummy" master records during normal production without corrupting live data.
Parallel Simulation: The auditor writes a program (using GAS or 4GL) to mimic application logic and reprocesses transactions to verify original production results.