Preface
Acknowledgments
Chapter 1 Why Is IT Auditing Important to the Financial Auditor and the Financial Statement Audit?
Management’s Assertions and the IT Audit
Objectives of Data Processing for Small- and Medium-Sized Enterprises (SMEs)
Special Challenges Facing SMEs
Research Confirming the Risks Associated with SMEs
A Framework for Evaluating Risks and Controls, Compensatory Controls, and Reporting Deficiencies
In Summary: The Road Ahead
Chapter 2 General Controls for the SME
General Controls: Scope and Outcomes
The “COSO Process” - Putting It All Together: Financial Statements, Assertions, Risks, Control Objectives, and Controls
The Vasa: Governance and General Control Failures
In Summary
Chapter 3 Application-Level Security
Key Considerations
Initial Security Setup
Security Role Design
Password Configuration
Segregation of Duties
Personnel, Roles and Tasks
Access Reviews
Human Error
In Summary
Chapter 4 General Ledger and the IT Audit
The General Ledger: A Clearinghouse of Financial Information
Chart of Accounts for QuickBooks
SME Risks Specific to the General Ledger and the Chart of Accounts
Assertions Underlying the Financial Statements and General Ledger Controls
IT Controls, the Transaction Level, and the General Ledger
Analytical Reviews Using the General and Subsidiary Ledger Data
In Summary
Chapter 5 The Revenue Cycle
General Process Description
Risk Exposures and Sub Processes
Application Controls, Revenue Cycle Risks and Related Audit Procedures
In Summary
Chapter 6 The Expenditure Cycle
General Process Description
Risk Exposures and Sub Processes
Application Controls, Expenditure Cycle Risks and Related Audit Procedures
In Summary
Chapter 7 The Inventory Cycle
General Process Description
Risk Exposures and Sub Processes
Application Controls, Inventory Cycle Risks and Related Audit Procedures
In Summary
Chapter 8 The Payroll Cycle
General Process Description
Risk Exposures and Sub Processes
Application Controls, Payroll Cycle Risks and Related Audit Procedures
In Summary
Chapter 9 Risk, Controls, Financial Reporting, and an Overlay of COSO on COBIT
PCAOB Warnings: Insufficient Evidence to Support Opinions
How We Got Here: A Historical Perspective
Risk
Risk and Fraud
Controls
Financial Reporting
PCAOB Guidance on IT Controls
Integrating COSO, COBIT, and the PCAOB
In Summary
Chapter 10 Integrating the IT Audit into the Financial Audit
Risks, Maturity, and Assessments
Cross Referencing COBIT to the PCAOB and COSO
Plan and Organize
Program Development and Change
Computer Operations and Access to Programs and Data
Monitor and Evaluate
In Summary
Chapter 11 Spreadsheet and Desktop Tool Risk Exposures
Specific Types of Risks and Exposures
Research on Errors in Spreadsheets
Compliance Dimensions of Spreadsheet Risk Exposures
Spreadsheet Auditing Tools
Governance of Spreadsheets and Desktop Tools
Control Considerations
Auditing Controls and Creating a Baseline
Life After the Baseline: Maintaining Spreadsheets and Desktop Tools
In Summary
Chapter 12 Key Reports and Report Writers Risk Exposures
How Reports Are Used
Original Reports within the Application
C Modified or Customized Reports Within the Application
Reports Using Third-Party Packages
Analyzing and Validating Reports
In Summary
Chapter 13 IT Audit Deficiencies
Defining and Evaluating IT Audit Deficiencies
A Framework for Audit Deficiencies
Types of IT Audit Failures and Illustrative Cases
Use of Compensatory Controls
Ideas for Addressing Segregation of Duties Issues
In Summary
References
About the Authors
Index
