e - Audit

e-Auditing, Electronic Data Processing

1. `

2. Dr.R.MOHANRAJ M.Com., M.Phil., Ph.D., SET Vivekananda College Tiruvedakam West Tamil Nadu Acharya

3. E-AUDIT Auditing in Electronic Data Processing

4. Auditing-MEANING The word audit is derived from Latin word audire which means ‘to hear’. Auditing is a critical examination of the records and books of account of a business by an independent qualified person for ascertaining the authenticity and the accuracy of entries appearing in the books of account and financial statement.

5. Definition - Auditing Spicer and Pegler have defined audit as “ such an examination of the books , accounts and vouchers of a business as will enable the auditor to satisfy himself that the Balance Sheet is properly drawn up, so as to give a true and fair view of the state of affairs of the business and whether the profit and loss account gives a true and fair view of the profit or loss for the financial period , according to the best of his information and explanation given to him and is shown by the books and if not in what respect he is not satisfied.”

6. Objectives of Auditing The objective of an audit may be classified as (1) Primary Objective (2) Subsidiary Objective (3) Specific Objective

7. (1) Primary Objective To ensure that the primary objective of audit is achieved, an auditor must: (a) Examine the Internal Control and Internal Check. (b) Verify whether all the books of accounts as required by law are kept. (c) Verify whether proper accounting principles and procedures are followed. (d) Check the arithmetical accuracy of the books of accounts. (e) Verify the authenticity and validity of the transactions. (f) Confirm the existence and the values of the assets and liabilities by physical verification. (g) Find out whether the financial statement is properly drawn up. (h) Report whether the profit and loss gives a true and fair view of the profit or loss for the year and Balance sheet gives a true and f

8. 2. Subsidiary or Ancillary objectives: - Subsidiary objectives of auditing are (1) Detection and prevention of errors. ( Errors of Omission, Commission, Compensating and Duplication ) (2) Detection and prevention of frauds. (Misappropriation of Cash, Goods and Accounts )

9. 3. Specific objectives There will be specific objective in respect of each type of specific audits. For example, in operational audit, the aim of audit is to evaluate the existing operations of the entity in order to give expert advice to improve their efficiency. The cost audit is to check the cost records of the entity in order to make a report on the proper ascertainment of cost of production of goods or services. Depending upon the nature of specific audit, there may be different objective in respect of each specific audit.

10. Qualification and Qualities of an Auditor To be an efficient auditor, an auditor must possess certain professional qualifications and professional and personal qualities. Professional qualification: - An auditor is a professional accountant. So he must possess certain professional qualifications. Under the Companies Act, an auditor of a joint stock Company must be a Chartered accountant within the meaning of the Chartered Accountants Act of 1949. To be a Chartered accountant, he must pass the C.A examination conducted by the Institute of Chartered Accountants of India. He must also obtain a certificate from the institute from the Institute of Chartered Accountants of India to take up public practice of accountancy .

11. Professional Qualities: - To perform his work efficiently, an auditor must possess certain professional qualities. They are : 1. Knowledge of principles and practice of general accounting. 2. Knowledge of Cost accounting 3. Knowledge of Management accounting 4. Thorough knowledge of techniques of auditing 5. Knowledge of provisions relating to income tax , wealth tax, GST etc. 6. Knowledge of business laws. 7. Knowledge of economics. 8. Knowledge of Mathematics and Statistics 9. Knowledge of Business Management and Organization and financial administration 10. Knowledge of report writing. 11. Knowledge of the accounts of the business under audit. 12. Attitude, Skills and Knowledge, of technical details of the business under audit.

12. Introduction Technology has continued to advance and businesses have become more sophisticated. Many business processes which were done manually are now automated and processed using computers. Accounting has not been left behind as many organizations now process their accounting information electronically, consequently auditing in such organizations has to be done electronically. Hence, this hour identifies to what extent the electronic audit contributes to achieve the competitive advantage of audit’s office and the strategy of audit. Auditors must audit through and with the computer instead of merely auditing around the computer. The objectives of the auditor in an EDP audit remains the same as in a manual audit but there is a need for specialization as the auditor's ability to audit in an electronic data processing environment is a function of his technical-know-how.

13. Electronic data processing audits, also called “e-audits”, EDP audit is the process of auditing in a computerised environment. The prime objective of EDP audit is to determine whether computer systems……. (1) Safeguard assets (2) Maintain data integrity (3) Achieve organizational goals effectively (4) Consume resources efficiently Objective of EDP

14. The overall objective and scope of an audit does not change in an EDP environment. However, the use of a computer changes the processing and storage of financial information and may effect the organization and procedures employed by the entity to achieve adequate internal control. The EDP environment affects all aspects of Audit including: (a) The consideration of inherent audit risks and control risks (b) The procedures followed by auditor to obtain a sufficient understanding of the internal control (c) The design and performance of audit procedures by the auditor Objective of EDP…

15. Skills and Competence of an Auditor The auditor should have an understanding of computer hardware, software and processing system sufficient to plan the engagement and to understand how EDP affects the study and evaluation of internal control and application of auditing procedures including CAAT. Specialised skills and competence may be required to:

16. Planning The auditor should gather the information about the EDP environment that is relevant to an audit plan. He should obtain the information in respect of the following: (a) The computer hardware and software used by the organisation. (b) The significance and complexity of computer processing in each significant accounting application. (c) Planning how, where and when an EDP function will be reviewed including scheduling the works of EDP experts, as applicable. (d) Planning auditing procedures using CAAT. (e) Determining the degree of reliance to place on the EDP controls in his overall evaluation of internal control. (f) The way in which EDP function is organised and the extent of concentration or distribution of computer processing throughout the entity. (g) The availability of data, source documents, computer files and other evidences.

17. Audit evidence An EDP environment may affect the application of compliance and substantive procedures in several ways. The use of CAAT may be required because of the following: (a) The absence of input documents. (b) Generation of accounting transactions by computer programs automatically. (c) The lack of visible audit trail. (d) The lack of visible output. The effectiveness and efficiency of auditing procedures may be improved through the use of CAAT in obtaining and evaluating audit evidence e.g. in applying analytical review procedures, transactions or balance details may be reviewed and reports printed of unusual items more efficiently by using the computer than by manual methods.

18. Computerized information system environment or electronic data processing environment means an environment where computers are extensively used in an enterprise for the processing of significant financial information. In other words, data processing done with the help of electronic computers is popularly known as electronic data processing or computerized information system (CIS) environment. AUDITING IN ELECTRONIC DATA PROCESSING ENVIRONMENT (EDP)

19. USES OR BENEFIT OF COMPUTERIZED AUDIT 1) Speed : the work of recording of transactions , preparation of books , accounts can be done with greater speed. 2) Greater accuracy : the chances of arithmetical errors and human errors are reduced to minimum. 3) Greater economy: under the mechanized accounting system, work can be done with minimum staff, with minimum cost. 4) Better records: records prepared by machines are neat and clean. It is more legible, systematic and uniform. 5) Greater information : various types of information and statistical data regarding the operation of the business can be easily collected.

20. USES OR BENEFIT OF COMPUTERIZED AUDIT 6) Interim accounts : interim accounts can be prepared without delay. This will help the management to declare interim dividend. 7) Analysis of data : once the basic information is feed into the computers, it can be sorted in many different ways to provide analysis of statement . 8) Avoid overtime : the work of accounts are done quickly , the accounts can be prepared without any loss of time. 9) Reduction in audit fee: the work load of audit works is reduced by the computers. Hence the computerized audit reduces audit cost. 10) Computerized audit reduces the monotony of audit work: 11) Computersised audit enhances the reliability of audit 12) Computersied audit ensures flexibility in the audit programme. 13) Computersied audit is helpful for the smooth functioning of auditing.

21. PROBLEMS OR DISADVANTAGES 1) It is not suitable for small business forms. 2) Difficulties to detect the errors and frauds. 3) Absence of supporting vouchers. 4) Storage problem 5) Computer frauds and computer virus. 6) Easy to make alterations 7) It creates unemployment. 8) Absence of input documents. 9) Lack of visible output 10) Coding problem.

22. AUDIT APPROACHES IN AN EDP ENVIRONMENT There are three approaches to auditing in an EDP environment . They are 1) Auditing around the computer 2) Auditing with the computer 3) Auditing through the computer

23. AUDITING AROUND THE COMPUTER Auditing around the computer is an audit approach under which an auditor carries out the audit in the same way as in a traditional or Manual system except that, instead of examining hand written books, he examines computer printouts.

24. Auditing around the computer. Under this approach the computer is treated as a Black Box and only input and output documents are reviewed. The controls and procedures used in processing the data are not considered important and the auditor ignores the programs that causes the transformation of the input data into output data. Instead, the auditor selects and test inputs against appropriate outputs and vice versa.

25. AUDITING AROUND THE COMPUTER If they matched and proved to be accurate and valid, then it is assumed that the system of control is operating properly.

26. Advantages. i . Simple and straight forward approach which can be easily understood by anyone. ii. Extensive knowledge of the computer and data processing is not required for the auditor iii. Cost of audit resources is generally low.

27. Disadvantages. i . Ignores the system of controls and hence fails to recognize potential errors or weakness with the system ii. Represents the after-fact rather than preventive auditing iii. Amounts of auditing in nature of post mortem rather than preventive auditing. iv. The auditor fails to utilize the full potential of the computer to assist him. v. Increasing of printing expenses because of enormous print-out requirements (lot of data) of the auditor.

28. Auditing through the computer Auditing through the computer means making use of computer in auditing. Under this approach the auditor evaluates the internal control relating to EDP and on the basis of evaluation , he determines the nature , timing , and extent of his sustentative procedures.

29. Auditing through the computer. In this approach computer is treated as a white box. Auditing through the computer implies that the auditor makes use of the computer in carrying out his audit. Under this approach, auditor can test the processing and control systems. This technique requires two basic tasks: • The review and verification of source documents and • The actual testing of the computer program logic and program controls.

30. Advantages. Utilizes the computer as a tool for performing auditing functions. ii. Forces the auditor to get more involved in the system, there by increasing his ability to perform more complex audit. iii. Test results are readily identifiable and can be used as measures of internal processing reliability iv. Increases service to clients because controls and operations are checked by the auditor v. Provide effective test processing logic and program controls.

31. Disadvantages. i . Requires more computer time. ii. It is very expensive. iii. It requires extensive knowledge of computer and data processing by the auditor.

32. Auditing with computers: - under this approach, the auditor does the audit work with the help of computers that is general software. Under this approach, audit work is carried on in an traditional manner, but the computer software is used for certain operations.

33. INTERNAL CONTROL UNDER AN EDP ENVIRONMENT For the control of various problems connected with the installation and operation of computers in accounting and auditing, there should exist an adequate and satisfactory internal control system in the undertaking . The internal control system should be reliable , effective, and should provide timely , authorized and required data from the system. The various internal controls required to be enforced under an EDP environment may be broadly classified into two categories. They are, 1) General EDP controls 2) EDP application controls.

34. Computer assisted Audit Techniques (CAATs) CAATs are any automated audit techniques and they are important tools for the auditor in performing audits in computer environment. There are two main types: 1.Audit software 2.Test packs

35. 1.Audit software. This consist of a set of instructions or programs that an audit uses to extract and examine client’s file. There are two categories • Generalized programs (by manufacturer) • Specialized/Purpose-written programs (by auditor or outside programmer)

36. 2.Test packs. They consist of test data which is processed in the same manner as actual data. The auditor in this case prepares a test data and submits it for processing by the client computer program. The data include both valid and invalid transactions. They are designed to represent realistic operating conditions.

37. The main aim of test packs is to test whether the clients system will be able to detect errors, or invalid transactions included. The resulting of computer processing are compared with predetermined results. It is very important to ensure that the program being tested is the one which the client is using and has been in use throughout the year.

38. Uses of CAATs. 1.In Substantive testing. Test of details of transactions and balances 2.Analytical review procedures to identify unusual fluctuations or items 3.Compliance test of Electronic data processing- e.g the use of test data to test the functioning of a programme.

39. Considerations in the use of CAATs . 1.Computer knowledge, expertise and experience of the auditor. 2.Availability of CAATs and suitable computer facilities. 3.Timing 4.Impracticability of manual tests.

40. Recent trend in auditing or current issues: There are several current issues in auditing. Some of the important current issues or recent trends in auditing are: 1. Audit committees 2. Social audit 3. Inflation audit 4. Human resource accounting and auditing 5. Energy audit 6. Reporting on financial sickness 7. Financial forecast and their audit.

41. Conclusion. Considering the complexity of today’s businesses, there is a need for the auditor who is an accountant to specialize in more specific areas such that Electronic Data Processing Audit becomes a special field and the auditor becomes an expert in this field. The auditor hence not only qualifies as a professional accountant but also as a computer expert. If the auditor is a computer expert, it would become much easier to unravel fraudulent acts by computer operators in an EDP environment as the auditor would be able to reach areas previously limited by his technical knowledge. In extreme cases where the auditor faces limitation due to his technical knowledge, it is important that a computer expert be engaged alongside the auditor as the use of this expert would be essential for the auditor to form an opinion.