67 terms

Audit Sampling & IT Auditing

STUDY
PLAY

Terms in this set (...)

List the two general approaches to audit sampling.
1.) Statistical
2.) Nonstatistical
Define "Type 2 Error."
The risk of over-reliance on controls (that is, the risk of assessing control risk too low); or incorrect acceptance of the fairness of an account balance. (The AICPA considers this an error related to effectiveness.)
List the two types of statistical sampling.
1.) Attributes sampling (regarding internal controls)
2.) Variables sampling (regarding substantive tests)
Define "sampling risk."
The risk that the sample may not be truly representative of the population.
Define "sampling."
Application of an audit procedure to less than 100% of the items within an account balance or class of transactions for the purpose of evaluating some characteristic of the balance or class.
Define "nonsampling risk."
Any mistake by the auditor other than sampling risk that is not a direct consequence of using a sampling approach.
Define "Type 1 Error."
The risk of under-reliance on controls (that is, the risk of assessing control risk too high); or incorrect rejection of the fairness of an account balance. (The AICPA considers this an error related to efficiency.)
List the factors that directly relate to sample size.
1.) Expected error rate
2.) Population size-not explicitly considered in attributes sampling.
List the two sampling approaches normally associated with judgmental (nonstatistical) sampling applications.
1.) Block
2.) Haphazard
Define "systematic sampling."
Sampling methodology whereby every nth item in the population is chosen as part of the sample (usually with a random starting point).
Define "haphazard sampling."
Sampling methodology where items are selected arbitrarily with no conscious biases.
List the two sampling approaches acceptable for statistical sampling applications.
1.) Random
2.) Systematic
What is the formula for the observed deviation rate for the sample?
(# errors in the sample)/sample size
Define "random sampling."
Sampling methodology where each item in the population has the same probability of being selected.
List the three factors, as indicated by AICPA tables, that determine sample size for an attributes sampling application.
1.) Expected error rate (related to the variation in population);
2.) Tolerable error rate (related to precision); and
3.) Risk of over-reliance (Type II error rate).
List the factors that are inversely related to sample size.
1.) Tolerable error rate
2.) Risk of over-reliance-Type II error
3.) Risk of under-reliance
Define "block sampling."
Sampling methodology where a group of contiguous items are selected; (e.g., selecting all transaction for the month of June).
List the eight steps in attributes sampling plan.
1.) Identify Sampling Objective
2.) Define what Constitutes an Occurrence
3.) Identify Relevant Population
4.) Determine Sampling Method
5.) Determine Sample Size
6.) Select the Sample
7.) Evaluate Results
8.) Document Sampling Procedures.
What is the basic sample size formula?
Sample Size = (Estimated population standard deviation x coefficient of reliability x population size / allowance for sampling risk) squared
List the items that are inversely related to sample size in variables sampling.
1.) Allowance for sampling risk
2.) Risk of incorrect acceptance (Type II error)
3.) Risk of incorrect rejection (Type I error).
List the various types of classical variables sampling techniques.
1.) Difference estimation
2.) Ratio estimation
3.) Mean-per-unit estimation
List the eight basic steps in variables sampling.
1.) Identify sampling objectives
2.) Identify relevant population
3.) Select specific sampling technique
4.) Calculate the sample size
5.) Determine selection method
6.) Conduct the sample
7.) Evaluate sample and project to population
8.) Document the sampling procedures
List the two parameters of a normal distribution.
1.) Mean
2.) Variance
List the items that are directly related to sample size in variables sampling.
1.) Estimated population standard deviation
2.) Population size-considered explicitly in variables sampling
What is the purpose of stratification?
To reduce the overall variability within a population.
What is the formula to obtain the sample size for Probability Proportionate to Size (PPS) sampling?
n = reliability factor (from PPS tables) x Book Value / tolerable error
Formula for calculating sample size for PPS sampling
n = "Reliability factor" × Book value /
Tolerable misstatement
(net of expected misstatements)
What is the primary advantage of PPS sampling?
Efficiency—If there are few differences between audit and book values, PPS sampling may result in smaller sample sizes than other sampling methods.
Projected misstatement for accounts having a book value less than the sample interval
The projected misstatement is based on the "tainting percentage " applied to the sample interval.
Projected misstatement for accounts having a book value greater than or equal to the sample interval
The projected misstatement is the "actual " misstatement identified.
Formula for calculating "sampling interval " for PPS sampling
Sampling interval = tolerable misstatement (net of expected misstatements)/reliability factor; or alternatively
Sample interval = Population book value/sample size
What is the relevant "sampling unit " in PPS sampling?
An individual dollar associated with the financial statement element involved.
What is the primary disadvantage of PPS sampling?
PPS sampling does not work very well in dealing with understatements or zero (unrecorded) balances.
List the types of physical safeguards used to protect the data files.
1.) File labels
2.) File protection rings
3.) File protection plans
List some controls that can be put in place/built in hardware and systems software.
1.) Parity check
2.) Echo check
3.) Diagnostic routines
4.) Boundary protection
List some internal control implications associated with an IT environment.
1.) Segregation of duties may be undermined (a disadvantage)
2.) Audit trail may be lacking (a disadvantage)
3.) Computer processing is uniform (an advantage)
List the IT duties that should be segregated (in connection with "organization and operation").
1.) Systems analyst
2.) Programmer
3.) Operator
4.) Librarian
5.) Security
Define "general controls."
Controls that have pervasive effects on all the specific computer processing applications.
List the five categories of general controls.
1.) Organization and operation
2.) Systems development and documentation
3.) Hardware and systems software
4.) Access
5.) Data and procedures
Define "check digit."
An arithmetic manipulation of a numeric field that captures the information content of that field and then gets "tacked" onto the end of that numeric field.
What is the purpose of limit tests?
To determine whether the data under review are all within some predetermined range.
Define "hash totals."
An arbitrary total that has no meaningful interpretation outside the context in which it was created. It is used only to validate the integrity of that data that is being examined.
What is the objective of input application controls?
To ensure that the input of data is accurate and as authorized.
List the three types of control totals.
1.) Batch totals
2.) Hash totals
3.) Record count
What is the purpose of validity checks?
To determine whether the data under review are recognized as legitimate possibilities.
Define "batch totals."
The sum of a particular field in a collection of items used as a control total to ensure that all data has been entered into a system.
Define "application controls."
Information processing controls that apply to the processing of specific computer applications (controls around input, processing, and output).
What is the purpose of output application controls?
To ensure the output data (and the distribution of any related reports) is accurate and as authorized.
What is the purpose of missing data checks?
To determine whether there are any omissions from fields in which data should have been present.
Define "record count."
A counting mechanism in an IT system that keeps track of the number of records processed to determine that the appropriate number was accounted for.
What is the purpose of processing application controls?
To ensure the processing of data is accurate and as authorized.
List some examples of logic checks.
1.) Limit tests
2.) Validity tests
3.) Missing data checks
4.) Check digits
Define "customized audit software."
Programs specifically written to access the files of a particular client. The cost might be modest, but the benefits are limited to the specific client for whom the software was written.
What is the purpose of test data procedures?
To process known errors to see if the client's system catches them. The auditor only needs to include those errors that are important to the auditor (that is, the auditor need not include every possible type of error). There may be a danger of contaminating the client's database with the test data.
Define "Integrated Test Facility (ITF)."
A fictitious division or department within the client created for the purpose of processing the "dummy" (test) data along with the client's "live" data.
What is Data Mining Software?
Commercially available software (such as ACL or Idea) used to access a client's electronic data and perform a broad range of audit tasks (such as performing analytical procedures and sampling for confirmation work, etc.).
Define "generalized audit software."
Audit software designed to access and test data files of many audit clients. Such audit software is not unique to a specific audit client.The cost is usually expensive to develop, but that cost can be spread over many audit clients. The cost per client may justify that large initial cost of development.
Define "tagging transactions."
The process of adding an electronic tagging to specific client transactions and tracing them through the client's system.
Define "parallel simulation."
The processing of the client's actual data using the auditor's software and then comparing the auditor's output to the client's output for agreement.
Define "Electronic Data Interchange (EDI)."
Direct computer-to-computer communication between a buyer and seller designed to achieve greater efficiency and less paperwork (a paper audit trail may not even exist).
Define "Value Added Network (VAN)."
A network maintained by an independent company that facilitates Electronic Data Interchange (EDI) transactions between the buying and selling companies.
Define "database system."
A set of interconnected files that eliminates the redundancy associated with maintaining separate files for different subsets of the organization.
Define "Real Time Processing."
The processing of data whereby the data files are immediately updated.
Define "local area network (LAN)."
A network of hardware and software interconnected throughout a building or campus.
Define "On-line Processing."
The processing of data whereby the user is in direct communication with the computer's central processing unit.
Define "Service Organization."
Independent organizations to whom an entity may outsource the processing of its transactional data.
Define "Distributed Systems."
A network of remote computers connected to the main system, allowing simple processing functions to be delegated to the employees at the remote sites.