信息系统审计讲lecture 1

Informationsystemsauditing2015YingQianShanghaiUniversity2YingQianAboutmeYingQIAN1999.7FudanUniversity,SchoolofManagement1999.8-2001.7KPMGShanghaiAuditor2001.8-2002.7HPShanghaiFinancialAnalyst2002.8-2004.6Master,UniversityofBergen,Norway2004.9-2005.2UnileverShanghaiBrandCommercial2005.3-2010.6Ph.D.UniversityofBergen,Norway2010.7-nowAssociateprofessorinShanghaiUniversityShanghaiUniversity3YingQianAboutthecourseTarget:GraspthebasicconceptoftheinformationsystemsauditingUnderstandthemethodandpracticeofinformationsystemsauditingPersonalskilldevelopment:EnglishTheabilitytothinkPresentationskillCommunicationskill上海大学管理学院4Myoffice：Managementschoolroom215Mycontactinformation：IaminofficeMondayafternoonCoursematialsCoursearrangement

IntroductiontoITAuditingPlanningthatgoesintoanITAuditAuditingstandardsandframeworkITGovernanceITBasicsTheInternetGeneralControlsApplicationControlsDatabaseControlsITinfrastructurecontrols上海大学管理学院6GradingClassperformance（30%）Attendance:15%Grouppresentation15%Finalexam（70%）上海大学管理学院7Grouppresentation4persons,5groups“REPORTOFINFORMATIONTECHNOLOGYAUDITFINDINGS”SecuritymanagementAccesscontrol1-9Accesscontrol10-18ApplicationLevelGeneralControlsandBusinessProcessControlsOtherminor:Configurationmanagement,SeparationofDuties,ContingencyPlanning,InterfaceControls,DataManagementSystemControlsTheconceptofAuditWhatdoisaudit?Auditingisanevaluationofaperson,organization,system,process,enterprise,projectorproduct,performedtoascertainthevalidityandreliabilityofinformation;andalsotoprovideanassessmentofasystem’sinternalcontrols.AuditingWhydoweneedaudit?Thegoalofanauditistoexpressanopinionbasedontheworkdoneandsinceduetopracticalconstraints,anauditprovidesonlyreasonableassurancethatthestatementarefreefrommaterialerrorandtypicallyrelyonstatisticalsampling.TypesofauditFinancialauditsOperationalauditsIntegratedauditsAdministrativeauditsITauditsSpecializedauditsForensicauditsThehistoryoffinancialauditBeginningperiod16’scenturyDevelopingperiodAftertheindustrialrevolution,theemergeofthelistedcompanyBusinessLawFormingtheprofessionThedevelopmentoffinancialauditingTheobjectofauditingAuditingaccountingentriesAuditingbalancesheetAuditingfinancialstatementThedevelopmentofauditingFinancialstatementorientedauditingInternalcontrolorientedauditingRiskorientedauditingFinancialstatementauditingWhetherthefinancialstatementaremadeinaccordancewiththeaccountingprinciple;Whetherthefinancialstatementfairlystatedthecompany’sfinancialstatus.ThefinancialstatementAccountingtreatmentSingleentryDoubleentryAccountingprinciple：CashbasisaccountingAccrualbasisaccountingBalancesheetBalancesheetProfit/(Loss)statementAuditingworkCashandcashequilibriumAccountsreceivablesInventoryFixedAssetsShort-termloanAccountspayablesLong-termloanCapitalAuditingworkRevenuecostSalesexpenditureManagementexpenditureFinancialexpenditureThemajoractivitiesinfinancialauditPostingcheckingTestingtheexistenceandeffectivenessofmanagementcontrolsthatpreventfinancialstatementmisstatementCastingcheckingPhysicalexaminationandcountConfirmationInquiryObservationinspectionYear-endscrutinyputationTracinginsubsequentperiodBankreconciliationVouchingVerificationofexistence,ownership,titleandvalueofassetsanddeterminationoftheextentandnatureofliabilities21ProfessionalorganizationAmerica:AICPACanada:CICAAustralia:ASCPA

andICAAInternational:IFACChina:CICPATheconceptofinformationsystemsauditingInformationSystem(IS)auditingistheprocessofcollectingandevaluatingevidencetodeterminewhetheraninformationsystem:(Pathak,1999)safeguardsassetsmaintainsdataintegrityachievesorganizationalgoalseffectivelyandConsumesresourcesefficiently ThepurposeofITaudittoprovideanopiniononthecontrolswhichareinplacetoprovideconfidentiality,integrityandavailabilityfortheorganization’sITinfrastructureanddatawhichsupportstheorganization’sbusinessprocessesThedeterminationofauditareaRiskAssessment/BusinessImpactAnalysis(BIA)EnablesmanagementtoeffectivelyallocatelimitedauditresourcesEnsuresthatrelevantinformationhasbeenobtainedfromalllevelsofmanagementEstablishesabasisforeffectivelymanagingtheITauditdepartment/functionProvidesasummaryofhowtheindividualauditsubjectareaisrelatedtotheoverallorganizationaswellastothebusinessplansRisksAuditrisk–theriskthatinformationmaycontainamaterialerrorthatmaygoundetectedduringthecourseoftheaudit.Inherentrisk–theriskthatanerrorexiststhatcouldbematerialorsignificantwhencombinedwithothererrorsencounteredduringtheaudit,assumingthattherearenorelatedcompensatingcontrols.Inherentrisksexistindependentofanauditandcanoccurbecauseofthenatureofthebusiness.(e.g.ifyoubuildyourdatacenterinthebasementofthebuilding,andthebuildingislocatedinafloodplain,thereisaninherentriskthatyourdatacenterwillgetflooded.)Iknowbadexample;whowoulddothat,butithelpsexplaintheidea.RisksControlrisk–theriskthatamaterialerrorexiststhatwillnotbepreventedordetectedinatimelymannerbytheinternalcontrolsystems.Ifforexample,theinternalcontrolisamanualreviewofcomputerlogs,errorsmightnotbedetectedinatimelymannersimplyduetothevolumeofdatainthecomputerlogs.Detectionrisk–theriskthatanITauditorusesaninadequatetestprocedureandconcludesthatmaterialerrorsdonotexistwhen,infact,theydo.Forexample,let’ssayyou’reusingtheFREEversionofatestingtoolwhichdoesnotcontainallthevulnerabilitydatabaseentriesandyouconcludetherearenoerrorsinaparticulardatabase,wheninfact,thereare,whichyouwouldhavefoundifyouhadbeenusinganadequatetestprocedure.Inthiscase,thefullblownversionofatestingtoolandnotademoversion.AuditobjectivesSubstantiatethattheinternalcontrolsexisttominimizebusinessrisks,andthattheyfunctionasexpectedInternalcontrolInternalcontrolsarenormallycomposedofpolicies,procedures,practicesandorganizationalstructureswhichareimplementedtoreduceriskstotheorganization.whatshouldbeachievedwhatshouldbeavoidedInternalcontrolsPreventivecontrols:detectproblemsbeforetheyariseDetectivecontrols:identifymisdoingsCorrectivecontrols:correcttheproblemInternalControlsandITAuditInternalcontrolsareofincreasingimportanceintheITenvironmenttoensuretheaccuracyandcompletenessofdataprovidedtomanagementfordecision-making.organisationalcontrols,passingadministrativeandsystemsdevelopmentcontrolsproceduralcontrols,coveringinput,processing,networking,outputanddatabasemanagementsystems(DBMS)controlsGrowthandGenesisofITAuditingITauditingasastudyisconsideredtobeinter-disciplinaryinnatureborrowingitstheoryandmethodologiesfromthediversedisciplines:traditionalauditingcomputersciencebehaviouralscienceandinformationmanagement.ITAuditApproachTwomajorbasesareconsideredforclassifyingITcontrolsManagementcontrols:

ensurethedevelopment,implementationandtheexecutionofITproceedsinapre-plannedandcontrolledmanner.Theapplicationsystemcontrols

makesurethateveryapplicationsafeguardsassetsoftheentity,maintainintegrity,andprocessdataefficiently.PhasesinITauditPreliminaryReviewPhaseDetailedReviewPhaseComplianceTestingPhaseTestingandReviewofUserControlPhaseSubstantiveTestingPhaseAuditDecisionsevaluationdecisiondecisiononthetimingofauditproceduredecisionontheapplicationsystemselectionITauditinginthreeISphasesauditduringthesystemdesignphaseauditduringtheoperationphaseevaluationduringthepost-auditphaseAud