p. 382 · PDF 389

(2) System audit implementation (preliminary audit, main audit, evaluation, and conclusion)

System audit implementation is done in the sequence of preliminary audit, main audit, and evaluation and conclusion on the basis of individual plans. Here, the system auditor appropriately conducts the audit procedures, collects adequate audit evidence required for supporting the audit results in terms of given assurance or advice, and evaluates them. Audit evidence refers to the facts that are required for substantiating the audit opinion of the system auditor. Audit evidence is broadly classified into the following four types.

• Physical evidence This refers to physical objects (e.g., configuration devices of the information system) that are verified personally by the system auditor. • Documentary evidence This refers to documents and electromagnetic records (e.g., design documents, specifications, minutes of meetings, review sheets, system operation records, logs, output forms) that are personally verified by the system auditor. • Verbal evidence This refers to documented evidence, such as testimonies, explanations, verbal statements, and responses to interview or questions, which the system auditor has found as potential audit evidence. • Situational evidence This refers to situations (e.g., actions and behavior of employees outside regulations) that are personally observed by the system auditor.

View original source box · p. 382

Enlarge original source box

The original bordered list describes physical, documentary, verbal and situational audit evidence.

The system auditor uses an appropriate audit procedure for obtaining audit evidence. Audit procedures are procedures of selecting and operating appropriate system audit techniques for collecting adequate audit evidence required for rational evaluation and conclusion of the audit items.

[Main system audit techniques] • View or collection of materials or documents • Use of lists of questions or questionnaires • Field investigation • Interview-based investigation (interview/hearing)

View original source box · p. 382

Enlarge original source box

The box begins the main system audit techniques list: materials or documents, questions or questionnaires, field investigation, and interview-based investigation. Its last item continues on printed page 383.

p. 383 · PDF 390

• Use of audit tools

View original source box · p. 383

Enlarge original source box

The continued box completes the list with use of audit tools, on printed page 383. The original upper border remains open at this page continuation.

The system auditor consolidates the results of audit procedures and related documents as an audit working paper. An audit working paper is a record of a system audit that is conducted by the system auditor, and it forms the basis of the audit opinion. Therefore, audit evidence and related documents must be recorded in a very orderly manner and appropriately stored so that the background for arriving at the audit opinion (i.e., conclusion of audit) is clear. In related documents, apart from the items collected and organized by the system auditor, documents submitted by the audited department are also included. In addition, it is necessary to preserve the audit working paper for a reasonable period even after the completion of the system audit. Furthermore, careful attention is required in specifying the storage place and the person responsible for storage, because the audit working paper contains confidential matters of the audited department. Here, in the case of an external audit, please keep in mind that the audit working paper may also remain with the external system auditor. Preliminary audit, main audit, and evaluation and conclusion are conducted in the following manner. · 6 questions

1) Preliminary audit

It is conducted for clearly understanding the actual state of the audit target. In a preliminary audit, the auditor collects and views questionnaires and material, and conducts interview-based investigation (i.e., interviews/hearings) with the concerned persons. In this way, the auditor understands things such as whether or not risks of the information system to be audited have been appropriately identified, and whether or not controls based risk assessment have been appropriately maintained.

2) Main audit

The main audit actually investigates, analyzes, and verifies the audit target according to the purpose of the audit, and it verifies whether or not risk control is done appropriately. It uses field investigations, interviews, and other system audit techniques, and checks the actual state of the audit target and possible problems identified in the preliminary audit. It also collects documents and records for supporting the information. When audits using information systems (i.e. computers) are conducted, Computer Assisted Audit Techniques (CAATs) are used.

[Main Computer Assisted Audit Techniques] • Utility software method It uses the utility software supplied by the manufacturer. • Test data method

View original source box · p. 383

Enlarge original source box

The main Computer Assisted Audit Techniques box begins with the utility software method and its description, then the test data method heading. The latter description continues on printed page 384.

p. 384 · PDF 391

It runs the program to be audited by using test data that is created with a generator or such other tool, and checks whether or not the expected results are obtained. • Audit software method It uses software with the functions, such as search and extraction of the files to be audited, which are very frequently used in system audits. • Audit module method It embeds a module in the system, where this module extracts and exports the data that satisfies the specified conditions, from the file to be audited into the audit file. • ITF (Integrated Test Facility) method / integrated test method It creates a record for the system auditor in the files to be audited, and checks the accuracy of the process by performing various operations on this record. • Parallel simulation method The system auditor prepares a program for verifying a specific audit purpose, enters the same data in both this program and the program to be audited, and compares the processing results of both programs. • Code comparison method This method compares the program verified beforehand by the system auditor and the program to be audited, on a line by line basis at the source code level.

View original source box · p. 384

Enlarge original source box

The continued box completes the test data method description, followed by audit software, audit module, ITF or integrated test, parallel simulation and code comparison methods, each with its original description.

3) Evaluation and conclusion

From the results of the preliminary audit and main audit, compatibility (whether appropriate or not) is evaluated by matching the actual state of the audit target with the purpose of the audit. Concerning evaluation and conclusion, the system auditor confirms accuracy by exchanging opinions with the audited department.