Computer Audit Research Articles

Treasury management systems — security system overview

This is the second of two articles on the security of Treasury Management Systems, the first of which appeared in the February issue of Computer Audit Update. The articles are based on a case study carried out as part of the MARS project, further details of which are available from the author. The first article dealt with the analysis of the system and the second with the development of the security system.

Treasury management systems—Key concepts

The analysis of functions operations and user groups is an important first stage in defining the security requirements of a particular system. This article has set out the concepts and ideas used to identify and evaluate a TMS and produce a risk analysis. In a further article (in the April issue of Computer Audit Update) the security developed for the specific TMS used in the case study is considered in more detail.

Book Reviews

Abstract Abstract Computer Audit, Control, and Security, by Robert Moeller. John Wiley and Sons (605 Third Ave, New York NY 10157–0228), 1989, 598 pp, Includes 5 1/4-inch diskette. Price: $115.

Computer auditing

Computer auditing

Trols

Click to increase image sizeClick to decrease image size Additional informationNotes on contributorsArjan T. SadhwaniArjan T. Sadhwani is professor of accounting and information systemsIll-Woon KimIII-Woon Kim is professor of accounting at the College of Business Administration, University of Akron, Akron OH.John HelmerciJohn Helmaci is manager of the computer audit assistance group, Philip Morris Management Corp, New York.

Quality Audits and Technological Excellence

Auditors of quality assurance systems contribute to technological excellence in many important ways. They gain much insight into modern technology through their various audits and induce managers to make valuable improvements that raise quality and productivity. More specifically, computer‐based technology is transferred and disseminated through auditors. The interrelationship between the computer and quality auditing is analysed. Innovative and integrative auditing of quality assurance systems is shown to be instrumental in attaining technological improvements. The American Society for Quality Control (ASQC) Guideline for Quality System Auditing also has an important role to play in this respect.

Computer audits can help GPs monitor their prescribing habits

Computer audits can help GPs monitor their prescribing habits

The second European conference on computer audit, control and security

The second European conference on computer audit, control and security

Second European Conference on Computer Audit, Control & Security

Second European Conference on Computer Audit, Control & Security

A knowledge-based expert system for auditing advanced computer systems

The complexity of modern computer auditing requires an effective decision support system that should (1) be highly flexible, (2) have the capability for incorporating important qualitative components, (3) be able to utilize a network of decision rules in describing a complex system of internal controls, and (4) be able to converse with the auditor in a meaningful way. The system should help the auditor recall and evaluate evidence about a client's computer system in order to reach well founded conclusions about the system's reliability. This paper introduced the concept of utilizing an ‘expert system’ as a decision support tool for the computer audit specialist. A prototype expert system based on existing technology is illustrated. While this system is still in its early stages of development, important insights are yielded.

A computer auditing course

The computer (or EDP) Audit Course is a critical course in the accounting curriculum. Most authoritative bodies have recommended a separate 3 semester hour course in lieu of incorporating computer audit concepts into an advanced undergraduate auditing course. Consequently, such courses are expected to proliferate in number over the next several years, the main constraint being to find faculty willing and capable of instructing such a complex course. As much hands-on computer work should be integrated into the course as possible, including the development of test disks, an integrated test facility (ITF) case, and a micro terminal audit software package such as AUDITS, distributed for education use by Deloitte Haskins and Sells. Several text books have been written on computer auditing, any one of which would be suitable to use in the course. Many cases and other materials are available from large public accounting firms. Also, numerous PD computer audit courses are offered by a variety of training institutes and professional bodies, lasting from a few days to several weeks in duration. The author has taught a computer auditing course since 1978 and every year new developments necessitate slight to moderate changes in various topics included in the course. Fortunately, new materials are becoming available almost on a daily basis. In conclusion, the author feels that even though the computer audit course is a challenge to teach, all departments of accounting should prepare to offer this course, if at all possible, within the next three to five years.

EDP auditing instruction using an interactive generalized audit software

Most auditing curricula do not provide students with experiential reinforcement of auditing and/or computer auditing concepts. This paper reports on an interactive generalized audit software package that has been designed to fill this educational void. The TREAT package consists of four different modes of operation with four audit eases that enable students to gain hands-on audit experience. The features of the TREAT package are similar to many accounting firms generalized audit software packages. Students using the package and its audit cases have proven TREAT to be an effective and efficient pedagogical tool.

Computer Auditing in the Federal Government

Computer Auditing in the Federal Government

A seminar in computer audit and control systems

This article presents a brief overview of a graduate-level course of computer audit and control systems. I hope it will be of interest to SIGSAC Review readers who are interested in the organization of such a course. Readers are also referred to the Spring 1982 edition of SIGSAC where Bill Neugent outlines in detail a similar course he is teaching at American University in computer security.

Implementing an integrated test facility audit using differential files

Integrated test facility is a computer auditing technique whose value has been attested by auditors and researchers alike. However, this technique has several disadvantages. Two of these are cost of the audit procedure and reduced data base integrity for the users. It is shown how the concept of differential files can be used to facilitate an audit by integrated test facility. This new use of differential files can reduce the cost of an audit and allows the auditor to use a wider variety of audit transactions while not violating data base integrity during the audit.

Expert systems for decision support in EDP auditing

The complexities of computer auditing have created a need for decision support for the EDP auditor. Traditional statistical techniques have proven valuable; however, there are important qualitative components which must be incorporated in the analysis. More importantly, there is a need for decision aids which not only produce analysis and probability estimates-but are able to explain their analysis and conclusions. Recent developments in artificial intelligence have made possible the development of expert systems which provide these capabilities. In this paper we present the motivation, framework, and development strategy for a decision support system for EDP auditing.

An assessment of the accuracy of a home energy analysis system based on a modified TWOZONE computer model

Recently, a number of computer models have been utilized in the analysis of the energy performance of residences. In many cases, input to the computer model is provided by the homeowner. This may introduce significant error into the data inasmuch as the homeowner may not be aware of the sensitivity of the program to the accuracy of the data. This research was directed toward the validation of the class B energy audit program for the State of New Mexico and deals with the accuracy of the TWOZONE computer auditing program when used as a class B auditing tool, i.e. when used with homeowner supplied data. This study reveals a number of significant factors which are not properly dealt with in the TWOZONE model. It also presents a methodology which can be used generally to evaluate the overall accuracy of similar auditing tools.

Current strategies for computer auditing within an organisation

Current strategies for computer auditing within an organisation

Online Computer Auditing through Continuous and Intermittent Simulation

A new computer auditing technique called Continuous and Intermittent Simulation (CIS), is introduced. It has been specifically designed as a compliance auditing technique for timesharing systems that can be used to audit internal controls. CIS is an auditing technique that simulates the instruction execution of the application at the time the application is processing a transaction. All data and input to the application is accessible by and shared with the simulation. This means that the simulation is notified about each transaction that is entered to the application and accesses to database by the DBMS. It is not necessary for all transactions to be audited in order to have the capability of performing online auditing. Before any updates are made to the database, or before any output is returned to the users, the simulation can verify the results by executing the appropriate instructions that evaluate the internal controls of the application about the system's status can be put into the exception log. The simulation can then choose to use the results computed by the application or by the simulation, or choose not to use any of the results, as if there was no transaction.

Program Review: Its Role in Computer Auditing

Program review, or program audit, is becoming an accepted technique in computer auditing. This paper describes the technique and examines whether it has a legitimate role in both external and internal audit work. A program review methodology is suggested and user experience is reported and analysed. It is suggested that internal auditors in particular may value program review and are relatively well placed to exploit it.