o Advisory services- professional services

offered by public accounting firms to

improve their client organizations’
operational efficiency and
• External (Financial) Audits effectiveness.
o independent attestation performed by o IT risk management- The advisory
an expert the auditor who expresses an services units of public accounting firms
opinion regarding the presentation of responsible for providing IT control-
financial statements. related client support have different
o Attest service- performed by Certified names in different firms, but they all
Public Accountants (CPA) who work for engage in tasks known collectively as IT
public accounting firms that are risk management.
independent of the client organization ▪ they provide non-audit clients
being audited with IT advisory services
o The Securities and Exchange ▪ Work with their firm’s
Commission (SEC) requires all publicly financial audit staff to perform
traded companies be subject to a IT-related tests of controls as
financial audit annually. part of the attestation
o CPAs conducting such audits represent function
the interests of outsiders: stockholders, o the purpose of the task, rather than the
creditors, government agencies, and task itself, defines the service being
the general public. rendered
o The CPA’s role is similar in concept to a • Internal Audits
judge who collects and evaluates o Institute of Internal Auditors (IIA)- an
evidence and renders an opinion. independent appraisal function
▪ A key concept in this process is established within an organization to
independence examine and evaluate its activities as a
o The external auditor must follow strict service to the organization.
rules in conducting financial audits. o An internal audit is typically conducted
• Attest Service versus Advisory Services by auditors who work for the
o Attest service- an engagement in which organization, but this task may be
a practitioner is engaged to issue, or outsourced to other organizations
does issue, a written communication o Certified Internal Auditor (CIA) or a
that expresses a conclusion about the Certified Information Systems Auditor
reliability of a written assertion that is (CISA)
the responsibility of another party. o they represent the interests of the
o The following requirements apply to organization
attestation services: o governed mostly by the Institute of
▪ written assertions and a Internal Auditors (IIA) and, to a lesser
practitioner’s written report. degree, by the Information Systems
▪ formal establishment of Audit and Control Association (ISACA).
measurement criteria or their • External versus Internal Auditors
description in the o respective constituencies
presentation. ▪ external auditors represent
▪ The levels of service in outsiders
attestation engagements are ▪ internal auditors represent the
limited to examination, interests of the organization.
review, and application of
agreed-upon procedures
 o internal auditors often cooperate with on Auditing Standards (SASs) as
and assist external auditors in authoritative interpretations of GAAS.
performing aspects of financial audits. SASs are often referred to as auditing
o The independence and competence of standards, or GAAS, although they are
the internal audit staff determine the not the ten generally accepted auditing
extent to which external auditors may standards.
cooperate with and rely on work o Statements on Auditing Standard-
performed by internal auditors. authoritative pronouncements because
o A truly independent internal audit staff every member of the profession must
adds value to the audit process follow their recommendations or be
• Fraud Audits able to show why a SAS does not apply
o investigate anomalies and gather in a given situation. The burden of
evidence of fraud that may lead to justifying departures from the SASs falls
criminal conviction. upon the individual auditor.
o Sometimes fraud audits are initiated by • Systematic Process
corporate management who suspect o Conducting an audit is a systematic and
employee fraud. logical process that applies to all forms
o boards of directors may hire fraud of information systems.’
auditors to look into their own o systematic approach is particularly
executives if theft of assets or financial important in the IT environment. The
fraud is suspected. lack of physical procedures that can be
o Certified Fraud Examiner (CFE) visually verified and evaluated injects a
certification, which is governed by the high degree of complexity into the IT
Association of Certified Fraud audit (e.g., the audit trail may be purely
Examiners (ACFE). electronic, in a digital form, and thus
invisible to those attempting to verify
FINANCIAL AUDIT COMPONENTS
it)
• Auditing Standards o a logical framework for conducting an
audit in the IT environment is critical
to help the auditor identify all-
important processes and data files.
• Management Assertions and
Audit Objectives
1. Existence or Occurrence- all assets
and equities contained in the balance
sheet exist and that all transactions in
the income statement actually
occurred.
o divided into three classes: general 2. Completeness- no material assets, equities, or
qualification standards, field work transactions have been omitted from the
standards, and reporting standards financial statements.
o GAAS establishes a framework for 3. Rights and Obligations- assets appearing on the
prescribing auditor performance, but it balance sheet are owned by the entity and that
is not sufficiently detailed to provide the liabilities reported are obligations
meaningful guidance in specific 4. Valuation or allocation- assets and equities are
circumstances. valued in accordance with GAAP and that
o American Institute of Certified Public allocated amounts such as depreciation expense
Accountants (AICPA) issues Statements
 are calculated on a systematic and rational
basis.
5. Presentation and Disclosure- assertion alleges
that financial statement items are correctly
classified (e.g., long-term liabilities will not
mature within one year) and that footnote
disclosures are adequate to avoid misleading
the users of financial statements • Communicating Results
o Auditors must communicate the results
of their tests to interested users.
o Audit opinion- distributed along with
the financial report to interested
parties both internal and external to
the organization.
o Audit risk- probability that the auditor
will render an unqualified (clean)
opinion on financial statements that
are, in fact, materially misstated.
o Errors are unintentional mistakes.
o Irregularities are intentional
misrepresentations associated with the
commission of a fraud such as the
• Obtaining Evidence
misappropriation of physical assets or
o Auditors seek evidential matter that
the deception of financial statement
corroborates management assertions.
users
o In the IT environment, this process
• Audit Risk Components
involves gathering evidence relating to
o Acceptable audit risk (AR) is estimated
the reliability of computer controls as
based on the ex-ante value of the
well as the contents of databases that
components of the audit risk model.
have been processed by computer
These are inherent risk, control risk,
programs.
and detection risk.
o tests of controls- which establish
• Inherent Risk
whether internal controls are
o associated with the unique
functioning properly.
characteristics of the business or
o substantive tests- determine whether
industry of the client
accounting databases fairly reflect the
o Firms in declining industries have
organization’s transactions and account
greater inherent risk than firms in
balances.
stable or thriving industries.
• Ascertaining Materiality
o Industries that have a heavy volume of
o The auditor must determine whether
cash transactions have a higher level of
weaknesses in internal controls and
inherent risk than those that do not.
misstatements found in transactions
o Placing a value on inventory when the
and account balances are material.
inventory value is difficult to assess due
to its nature is associated with higher
inherent risk than in situations where
inventory values are more objective.
o Auditors cannot reduce the level of
inherent risk.
 o Control risk- likelihood that the control
structure is flawed because controls
are either absent or inadequate to
prevent or detect errors in the
accounts
o Auditors assess the level of control risk
by performing tests of internal
controls.
• Detection Risk
o risk that auditors are willing to take
that errors not detected or prevented
by the control structure will also not be
detected by the auditor.
o Auditors set an acceptable level of
detection risk (planned detection risk)
that influences the level of substantive
tests that they perform
• Audit Risk Model
o to determine the scope, nature, and
timing of substantive tests (NTE)
o AR IR × CR × DR
• The Relationship Between Tests of Controls
and Substantive Tests
o Tests of controls and substantive tests
are auditing techniques used for
reducing audit risk to an acceptable
level.
o The stronger the internal control
structure, as determined through tests
of controls, the lower the control risk
and the less substantive testing the
auditor must do.
o Evidence of weak controls forces the
auditor to extend substantive testing to
search for misstatements.
o the more reliable the internal controls,
the lower the CR probability, that leads
to a lower DR, which will lead to fewer
substantive tests being required
o substantive tests are labor intensive
and time-consuming, they drive up
audit costs and exacerbate the
disruptive effects of an audit