Ch. 11: Auditing Computer-Based Information Systems
Inventory transactions input control matrix:
RECORD
NAME:
Parts inventory
transactions
FIELD NAMES
Item
number
Description
Transaction
date
Transaction
type
Document
number
Unit
cost
Comments
Hash totals
Record counts
Yes
Cross-footing
balance
No
Visual
inspection
X
X
X
X
X
X
All fields
Check digit
verification
X
Field check
X
X
X
Sign check
X
Also for balance
on hand
Validity check
X
X
X
Limit check
Other:
Accounting Information Systems
11-15
11.8 As an internal auditor for the state auditor’s office, you are assigned to review the implementation of a
new computer system in the state welfare agency. The agency is installing an online computer system to
maintain the state’s database of welfare recipients. Under the old system, applicants for welfare
assistance completed a form giving their name, address, and other personal data, plus details about
their income, assets, dependents, and other data needed to establish eligibility. The data are checked by
welfare examiners to verify their authenticity, certify the applicant’s eligibility for assistance, and
determine the form and amount of aid.
a. Describe how to employ concurrent audit techniques to reduce the risks of fraud and
abuse.
Audits should be concerned about a dishonest welfare examiner or unauthorized person
submitting fictitious transactions into the system. Fictitious transactions could cause
excessive welfare benefits to be paid to a valid welfare recipient, or payments made to an
ineligible or fictitious recipient.
The concurrent audit techniques needed most deal with submitting changes in record status
from “pending” to “approved” and modifying welfare records to reflect changes in the
recipient’s circumstances. The auditor should verify that the system is set up to:
• check the password of every person who uses the system
Ch. 11: Auditing Computer-Based Information Systems
11-16
• Any welfare record status change or modification that is entered into the system by
someone other than one of the authorized welfare examiners.
• Assuming that it takes a minimum of n days for a welfare examiner to verify the
• Any attempt to access the system by someone not able to supply a valid welfare clerk or
welfare examiner password.
• Any record entered into the system at a time of day other than during the agency’s normal
business hours, or one that is entered during a weekend or holiday period.
Undoubtedly, other useful audit hooks could be identified. The audit staff should
Accounting Information Systems
11-17
b. Describe how to use computer audit software to review the work welfare examiners do to
verify applicant eligibility data. Assume that the state auditor’s office has access to other
state and local government agency databases.
Computer audit software can process the welfare recipient database against other databases that
contain data about welfare recipients, identify any discrepancies in the data items used to determine
eligibility for benefits and/or calculate the amount of benefits, and report these discrepancies to the
audit staff. Other possible databases that might be used for this purpose would include:
• State income tax records, which contain data on the income and dependents of welfare
recipients.
• Property tax records, which might contain data about valuable assets owned.
• Death records, which would reflect changes in eligibility for benefits. The reason it is
important to review these is that a very common fraud scheme involves failure to enter a death
record, followed by the diversion of subsequent benefit checks.
If a welfare recipient does not appear in any of the first four databases listed above, it would raise
the issue of whether the person exists at all (e.g., is the welfare recipient a fictitious person?). To
investigate this, driver license registration records and voter registration records could also be
checked. If the recipient does not show up there, the audit staff should probably insist that a
Ch. 11: Auditing Computer-Based Information Systems
11-18
11.9 Melinda Robinson, the director of internal auditing at Sachem Manufacturing Company,
believes the company should purchase software to assist in the financial and procedural
audits her department conducts. Robinson is considering the following software packages:
• A generalized audit software package to assist in basic audit work, such as the retrieval of
live data from large computer files. The department would review this information using
conventional audit investigation techniques. The department could perform criteria
selection, sampling, basic computations for quantitative analysis, record handling,
graphical analysis, and print output (i.e., confirmations).
a. Without regard to any specific computer audit software, identify the general advantages
of using computer audit software to assist with audits.
• Audits can be more efficient, saving labor time spent on routine calculations. The routine
operations of footing extensions, transcription between reports, report generation, etc., are
performed by the computer.
b. Describe the audit purpose facilitated and the procedural steps to be followed by the
internal auditor in using the following:
Generalized audit software package. The purpose of generalized audit software programs
is to perform a variety of auditing operations on the computer files used to store the
information. The steps to be followed by the internal auditor to use generalized computer
audit software would include things such as planning and designing the audit application.
Accounting Information Systems
Flowcharting package The purpose of a control flowcharting package is to interpret the
program source code and generate a program flowchart corresponding to it in order to
facilitate the review of internal controls. To use a control flowcharting package, the internal
auditor should:
Parallel simulation and modeling package The purpose of a parallel simulation package is
to ensure that organizational objectives are being met, ensure compliance to technical
standards, and detect unauthorized program changes. To use a parallel simulation package:
• Run the same data used in the company’s current application program using the
“simulated” application program.
Ch. 11: Auditing Computer-Based Information Systems
11-20
11.10 The fixed-asset master file at Thermo-Bond includes the following data items:
Asset number
Date of retirement (99/99/2099 for assets still in service)
Description
Depreciation method code
Explain several ways auditors can use computer audit software in performing a financial
audit of Thermo-Bond’s fixed assets.
• Edit the file for obvious errors or inconsistencies such as:
o Retired assets that have a non-zero net value.
• Recalculate year-to-date depreciation for each asset record, compare to the amount in the
record, and list all asset records for which a discrepancy exists.
• Prepare a list of all assets retired during the current year for comparison to supporting
documents.
Type code
Depreciation rate
Location code
Useful life (years)
Date of acquisition
Accumulated depreciation at beginning of year
Accounting Information Systems
11-21
11.11 You are auditing the financial statements of a cosmetics distributor that sells thousands of
individual items. The distributor keeps its inventory in its distribution center and in two
public warehouses. At the end of each business day, it updates its inventory file, whose
records contain the following data:
Item number
Cost per item
You will use audit software to examine inventory data as of the date of the distributor’s
physical inventory count. You will perform the following audit procedures:
1. Observe the distributor’s physical inventory count at year-end and test a sample for
accuracy.
2. Compare the auditor’s test counts with the inventory records.
3. Compare the company’s physical count data with the inventory records.
Describe how the use of the audit software package and a copy of the inventory file data
might be helpful to the auditor in performing each of these auditing procedures.
(CPA Examination, adapted)
Item description
Date of last purchase
Date of last sale
Item location
Quantity sold during year
Ch. 11: Auditing Computer-Based Information Systems
11-22
Audit Procedure
How Audit Software Can Help
1. Observe the distributor’s physical count
of inventories as of a given date, and
test a sample of the distributor’s
inventory counts for accuracy.
Determine which items are to be test counted by
taking a random sample of a representative
number of items from the inventory file as of the
date of the physical count.
4. Test the mathematical accuracy of the
distributors’ final inventory valuation.
Calculate the dollar value of each inventory item
counted by multiplying the quantity on hand by
the cost per unit, and then verify the addition of
the extended dollar values.
5. Test the pricing of the inventory by
obtaining a list of costs per item from
7. Ascertain the propriety of items of
inventory located in public warehouses.
Prepare a list of items located in public
warehouses.
8. Analyze inventory for evidence of
possible obsolescence.
Prepare a list of items on the inventory file for
which the date of last sale indicates a lack of
recent transactions.
9. Analyze inventory for evidence of
possible overstocking or slow-moving
items.
Prepare a list of items on the inventory file for
which the quantity on hand is excessive in
relation to the quantity sold during the year.
of each inventory item counted, to the inventory
Accounting Information Systems
11–23
11.12 Which of the following should have the primary responsibility to detect and correct data
processing errors? Explain why that function should have primary responsibility and why
the others should not. (CPA Examination, adapted)
a. The data processing manager – The data processing manager should have primary
responsibility to detect and correct data processing errors. The data processing manager has
b. The computer operator – Although the computer operator is responsible for the operation of the
hardware and software of the organization, he is not responsible for detecting and correcting data
c. The corporate controller – The corporate controller has overall responsibility for the operation
of the accounting function, but would not have primary responsibility to detect and correct data
processing errors.
d. The independent public accountant – The independent auditor has no responsibility to detect
Ch. 11: Auditing Computer-Based Information Systems
11-24
SUGGESTED SOLUTIONS TO THE CASES
11.1 You are performing a financial audit of the general ledger accounts of Preston
Manufacturing. As transactions are processed, summary journal entries are added to the
general ledger file at the end of the day. At the end of each day, the general journal file is
processed against the general ledger control file to compute a new current balance for each
account and to print a trial balance.
The following resources are available as you complete the audit:
• Your firm’s generalized computer audit software
Create an audit program for Preston Manufacturing. For each audit step, list the audit
objectives and the procedures you would use to accomplish the audit program step.
General Journal
Field Name
Field Type
Account number
Numeric
Amount
Monetary
Debit/credit code
Alphanumeric
Date (MM/DD/YY)
Date
Reference document type
Alphanumeric
Numeric
General Ledger
Control
Field Name
Field Type
Account number
Numeric
Account name
Alphanumeric
Beginning balance/year
Monetary
Beg-bal-debit/credit code
Alphanumeric
Current balance
Monetary
Cur-bal-debit/credit code
Alphanumeric
Accounting Information Systems
AUDIT PROGRAM
AUDIT OBJECTIVES AND PROCEDURES
a. Edit the general journal file for errors and
inconsistencies such as:
• Invalid debit/credit code or document type.
amount, or document number fields.
Objective: Evaluate the quality of the file data.
Procedures: Review error listing for common
error patterns; initiate correction of the errors;
b. Edit the general ledger file for errors and
exceptions such as:
• Invalid debit/credit codes.
Objective: Evaluate the quality of the file data
Procedures: Review errors listing for common
error patterns; initiate error correction; trace
c. Select a sample of general journal
transactions, stratified by dollar value. Sort
and list by document type.
files by account number, and list all
unmatched general journal entries. (or look
them up in the appropriate tables)
Procedures: Compare unmatched transaction
data values to source documents; initiate errors
Objective: Test the transaction data entry
accuracy.
Procedures: Compare transaction data values to
source documents and identify discrepancies.
e. Recalculate each ledger account’s current
balance from the beginning balance and the
general journal amounts, and list any
discrepancies between the recalculated
balance and the file balance.
Objective: Test current ledger balance
accuracy.
Procedures: Review discrepancies to see if the
transaction amounts or ledger balances are
erroneous; initiate appropriate corrections.
f. Prepare comparative financial statements for
the current and prior year, including
selected liquidity, profitability, and capital
structure ratios.
Objective: Identify accounts to be investigated
in detail.
Procedures: Analytical review of ratios and
trends to search for unusual account balances.