Auditing and Electronic Data Processing (EDP)

1. Identify major changes that have occurred in computer hardware and how they have
affected auditing.

 Manual systems – source dos are posted by hand to journals.

o Auditor can visually inspect the documents, journals, ledgers; transactions can be traced
from source docs to journal, ledger and reports and vice versa; visual observation of the
accounting process

 Mechanical systems – utilizes data processing equipment/ unit record equipment; reports are
manually prepared from the machine –maintained records
o The audit process becomes slightly more complex; the arithmetic operations are under
the control of a machine. Auditor must understand the machine control to determine
whether posting procedures are performed correctly.
o Tracing and visual observation are more difficult because of the speed with which the
equipment operates

 EDP Systems

Generation Characteristics Major auditing problem

First Vacuum tubes; computers
were enormous; rooms for
hardware
Second and  2nd generation – transistors
third in place of vacuum tube
 3rd generation – use of solid-
state technology and
integrated circuits
4th and fifth  4th - Focus is on increasing
speed and storage capacity;
used of large and very large
scale integrated circuits
 5th – artificial intelligence –
system that is constantly
learning and modifying itself
 Use of electronics for data processing; physical
observation of the accounting process is
insurmountable
 Internal storage of both data and program;
processing of data cannot be observed; lost of
tracing procedure
 Procedures for processing the data and
program can be changed without the auditor’s
knowledge
 Partial elimination or disappearance of audit
trail; the auditor may not able to trace around
the computer
 The computer – auditing specialist must study
constantly to be able to operate new computers
and old or new computers with new software
and to communicate with data processing
personnel as new technology emerges.
 Multiprogramming; a program and a set of files
can be modified during data processing by
another program (unauthorized)
 Teleprocessing; changes to programs and files
can be made from miles away.

  Teleprocessing and real time systems
- Teleprocessing - processing of accounting data by transmitting those data over
communications channel
- Permits data to be submitted to a computer from a terminal in one location and to be
posted to accounts on file in another location with the result being printed in another
location
- Major problem: potential loss of assets from unauthorized access to programs and files; the
auditor must evaluate the ability of teleprocessing systems to resist such authorized access
to ensure that losses have not occurred.

- Real – time system – the input, processing and output devices are separated by
considerable distance.
- Update account balances immediate upon entering the data into the system

 Minicomputers and Microcomputers

Problems caused by these systems
- Hardware does not contain error – checking and correcting – routines built into the
physically large systems. The auditor does not have the same level of assurance that result
of processing are accurate.
- The programs supplied with the systems for payroll, A/R and other applications may not
contain the controls for error detection that the auditor has come to expect with the
programs for physically larger systems
- Clients acquired computers and programs that they were not able to make them work which
resulted to a chaos in the accounting system and loss of relevant data.

2. Understand the major changes that have occurred in computer software and how they have
affected auditing.

- Languages
o Machine – language programs
o Assembler and higher – level languages – instructions are being converted into
machine language by programs called assemblers or compilers (source code to
object code)
 Advantage: programs can be written faster with few errors
 Disadvantage:
 the source code listing provided to the auditor may not agree with the
object code used by the computer for processing
 numerous languages with multiple versions place extraordinary
burdens on the auditor who has to understand and work with them
- Applications
o Application software – set of programs for performing the processing; involves
instructing the computer on what to do.
o Determining whether all of the tasks are performed accurately on a system that
runs around the clock, switching automatically to a back – up system for preventive
maintenance, will challenge even the most astute computer auditor.
- Operating systems
o Programs that manage to supervise all the activities associated with a computer
system. Other names include supervisors, monitors or executive programs.
 o Example; supervision of the movement of application programs and data into
internal storage within the computer; schedules jobs on a priority basis, handle all
input to and output from reading and writing devices, and perfom specialized
function as sorting.
o Relieve application programs of many functions
o Advantage: auditor’s job is easier
o Problem: individual with access to OS and the knowledge to change it can modify the
processing of application programs or the content of files without changing the
application program

- Data-base management systems (DBMS)

o Data base – collection of data files containing and organization’s records
 Each employee, all employees, payroll
o DBMS – is the software used to control input to the files, changes in the files, and
abstraction of information from the files. Linking together of various files
o Benefit:
 reduce redundancy in the submission of data and managing input to the files,
changes in them and output from them can be contrasted with the problem
such a system creates for the auditor.
 The storage area freed by eliminating redundancies which can be used for
additional files
o Problems
 The redundancies on which the auditor relied in the past to verify the
accuracy of recorded data are eliminated
 Auditor can no longer compare the contents of 2 files to determine whether
one of them contains an error
 Additional education and knowledge requires of auditor
 Difficulty in tracing transactions forward and backward
 Auditor must focus on determining the system’s reliability.

3. Know the major changes that have occurred in computer location and how they have
affected auditing.

Computers were originally used in the processing primarily of accounting data. To serve
those need, they were located within and under the control of the accounting department. The
responsibility for computers has in many companies been taken away from accounting and given to
a separate information system group.

 Information system group – this group is expected to have a broader perspective on how
the computer can serve additional functions, management purposes, and operations along
with accounting.
o Benefit – enhance control (separation of function)
o Problem
 The new applications may tie in with and affect the basic accounting
applications. The auditor may therefore have to extend the scope of the audit
to include components of these non-accounting applications.
  The auditor may have to travel extensively to collect evidence because the
source documents no longer flow to the accounting department (retained in
the originating operating department)

 Service bureaus and time sharing – are organizations separate from the companies whose
data they process. May be cheaper than in – house installation or may be the company does
not want to devote space and management energy to an in – house installation.

Time – sharing system Service bureau

 Receive data that have been entered
on the terminal in the customer’s
office and transmitted via a data
communication system. The data are
processed and the results are
transmitted back over the data
communication system to be printed
on the client’s terminal
 Pick up source documents from
clients, convert them to machine –
readable form, process the data,
print the results, and then deliver the
output back to the customer’s office

 Problem
o Inaccessibility of programs, files and data processing personnel; might refuse
admission to the auditor for testing programs and files
o Potential for changes in the data sent to the computer and output received from it
o Additional testing is required to determine the likelihood of such changes and their
potential effect.

4. Identify major changes that have occurred in the way that auditors have approached the
audit of the computer

The increasing sophistication of computers and auditors, however has since led to computers being
used in two ways:
o As a tool of the auditor aiding in the performance of the audit (printing confirmation
request)
o As a target of the audit where data are submitted to the computer and the results
are analysed for processing reliability and accuracy of the computer program.

 Auditing around the computer – the first computers are ignored by the auditors. They were
treated as a black box that accepted input and produced output. Auditors traced
transactions to the black box and then picked up the trail on the other side by examining
print outs. This is one of the several methods that auditors can use to evaluate client’s
computer controls. It involves picking source documents at random and verifying the
corresponding outputs with the inputs.

 Auditing with the computer – using the computer as a tool of the auditor in performing such
tasks as printing confirmations, footing, calculating depreciation, comparing contents of two
files, examining files for missing amounts.
o This facilitate the development of generalized audit software

 Auditing thru the computer – treat the computer as the target of the audit and audit thru it;
requires the auditor submit data to the computer for processing. The results are then
 analysed for the processing reliability and accuracy of the computer program. This is due to
the technological development such as
o On line data entry
o Elimination or reduction of print outs
o Real time file updating
 Some auditors decide to audit thru the system for the following reasons:
o Inability to locate the source docs because of the filing system used
o Apprehension that the amounts shown on the computer print outs might not agree
with the balances actually contained in the computer files

Interesting website/s:
https://www.auditingauditors.com/auditing-through-the-computer-and-auditing-around-the-computer-
explained/

5. Understand the response of auditing profession has made to the increasing sophistication of
computers and the demand for auditing skills placed on the auditor.
 Level of knowledge required of an EDP auditor; specified some of the procedures that the
auditor should follow in performing the audit. The auditor was not expected to rely on EDP
technicians as specilaist.
 EDP control evaluation is required to be an integral part of the audit
 Auditor as data processing technician – mastering computer concepts
 Data processing technicians as auditors – technicians are trained of the rudiments of
auditing
 Combine the skills of auditor and EDP technicians – develop teams of auditors and
technicians; develop excellent working relationships; DRAWBACK – difficulty in
communication
 Skills required of the computer auditor
 EDP auditors mus understand EDP concepts such as
 Systems concepts (hardware, software, functions of personnel, who operate
computer system, procedures used in the operations
 File structures and organization concepts, ways in which data can be
organized, stored and retrieved from a computer system
 Techniques for depicting the flow of data thru a computer system which
include system and program flowcharts and decision tables
 EDP Controls
 The profession’s response to the proliferation of computers and the skills of the
auditor to audit them has been the issuance of the auditing standards (TIP – PIE –
GCDO)
 Development of specific controls to ensure reliable and accurate data processing.
 Broad categories
 User controls – established by depts. whose processing is performed by the
computer. Example, payroll department
 EDP accounting controls
o General controls
 controls on the organization and operation of the EDP
department
 controls in the development and implementation of computer
programs and changes to them
  controls built into the equipment and software by the vendor to
ensure processing accuracy
 controls to prevent unauthorized access to equipment and other
data
 procedural controls such as plans to restructure damaged files
o Applications controls
 Input controls to ensure accuracy of data submitted
 Processing controls to ensure that no errors are made in
processing data
 Output controls to ensure that output reconciles to the input
and is distributed to authorized personnel