The depth of coverage for issues should normally reflect the significance of the findings. Situations representing a high degree of risk or indicating shortcomings that are serious enough to justify a recommendation should be treated extensively. Specific initiatives that the auditors wish to mention as examples should be described in detail, while issues where the department meets the expectations and there is nothing specific to mention should be dealt with briefly. Commentary Where a recommendation and a compliment are made under the same issue, they should be in separate paragraphs, otherwise, they may confuse the reader and reduce the impact of one or the other. Statistics need to be used consistently throughout the report. Sample size and error rate mean more when they are given in context. The size of the population, the number of transactions and the period of time provide that context. AUDIT TESTS OF GENERAL AND AUTOMATED CONTROLS Chapter 10 – Testing – General and Automated Controls : Introduction : Audit Planning for Testing : Testing of Controls : Reporting : Concurrent Audit/ Continuous Audit and Embedded Audit Modules INTRODUCTION Testing is a scientific process performed to determine whether the controls ensure the system design effectiveness as well as the implemented system controls operational effectiveness. It involves, understanding a process and the expected results. Testing of large amounts of transactions or data is usually not possible due to time and cost constraints. Hence, sampling is done on the population (system resource) and ensures a sufficient quality and quantity to extrapolate the results of the testing into a reliable conclusion on the entire population (system resource). The Information System (IS) controls audit involves the following three phases: Planning: The auditor determines an effective and efficient way to obtain the evidential matter necessary to achieve the objectives of the IS controls audit and the audit report. For financial audits, the auditor develops an audit strategy and an audit plan. For performance audits, the auditor develops an audit plan. Testing: The auditor tests the effectiveness of IS controls that are relevant to the audit objectives. Reporting: The auditor concludes on the effect of any identified IS control weaknesses with respect to the audit objectives and reports the results of the audit, including any material weaknesses and other significant deficiencies.
The depth of coverage for issues should normally reflect the significance of the findings. Situations representing a high degree of risk or indicating shortcomings that are serious enough to justify a recommendation should be treated extensively. Specific initiatives that the auditors wish to mention as examples should be described in detail, while issues where the department meets the expectations and there is nothing specific to mention should be dealt with briefly. Commentary Where a recommendation and a compliment are made under the same issue, they should be in separate paragraphs, otherwise, they may confuse the reader and reduce the impact of one or the other. Statistics need to be used consistently throughout the report. Sample size and error rate mean more when they are given in context. The size of the population, the number of transactions and the period of time provide that context. AUDIT TESTS OF GENERAL AND AUTOMATED CONTROLS Chapter 10 – Testing – General and Automated Controls : Introduction : Audit Planning for Testing : Testing of Controls : Reporting : Concurrent Audit/ Continuous Audit and Embedded Audit Modules INTRODUCTION Testing is a scientific process performed to determine whether the controls ensure the system design effectiveness as well as the implemented system controls operational effectiveness. It involves, understanding a process and the expected results. Testing of large amounts of transactions or data is usually not possible due to time and cost constraints. Hence, sampling is done on the population (system resource) and ensures a sufficient quality and quantity to extrapolate the results of the testing into a reliable conclusion on the entire population (system resource). The Information System (IS) controls audit involves the following three phases: Planning: The auditor determines an effective and efficient way to obtain the evidential matter necessary to achieve the objectives of the IS controls audit and the audit report. For financial audits, the auditor develops an audit strategy and an audit plan. For performance audits, the auditor develops an audit plan. Testing: The auditor tests the effectiveness of IS controls that are relevant to the audit objectives. Reporting: The auditor concludes on the effect of any identified IS control weaknesses with respect to the audit objectives and reports the results of the audit, including any material weaknesses and other significant deficiencies.
1311494623ISCA%20Notes.docx