IT Audit Process. Michael Romeu-Lugo MBA, CISA November 4, IT Audit Process. Prof. Mike Romeu

Transcription

1 Michael Romeu-Lugo MBA, CISA November 4,

2 Audit Sampling Audit Sampling is the application of an audit procedure to less than 100% of the target population for the purpose of drawing a general conclusion about the entire population based on the characteristics detected in the sample. Why Sample? Sampling is generally used when it is not cost- or time-efficient to review 100% of the population. 2

3 Audit Sampling Auditors must design sampling technique to ensure That evidence is sufficient, reliable and relevant That the sampling approach is appropriate for the characteristics of the population and the objectives of the audit. A good sample is representative of the entire population Sample Size Sample Selection 3

4 Sampling Approaches Statistical Non-Statistical Advantages Disadvantages Advantages Disadvantages May yield desired results from minimum number of items Yields quantified data Includes measures of sampling risk, confidence level, and precision Is adaptable to computer testing Lends credibility to audit conclusions and recommendations Can be costly and time-consuming May require training and software costs May preclude experienced auditors insights Flexibility Use of internal auditor s judgment Allows reasonable reliability at reasonable cost Results not statistically valid No objective measure of sampling risk provided Chance of wrong sample size Effectiveness depends upon auditor s skill 4

5 Statistical Sampling Attribute Sampling Compliance Testing Yes or No Good for testing Internal Controls Variable Sampling Substantive Testing Good for estimating value or other unit of measure Is my Accounts Receivable misstated? 5

6 Sampling Methods Judgmental Sampling Description: Based on deliberate choice of the auditor Advantages Normal application is for small samples from a population that is well understood and there is a clear method for picking the sample Is used to provide illustrative examples or to check forecasts Disadvantages Sample is typically small and can be misleading Prone to bias Sample results cannot be extrapolated be extrapolated to give population results 6

7 Sampling Methods Attribute Sampling Description: Used to determine error rates in the population Advantages Results in the minimum sample size needed to express an opinion of a given confidence level Disadvantages Only valid for populations > 5,000 May result in a larger sample size than judgmentally sampling Requires random selection to remain valid 7

8 Sampling Methods Variable Sampling Description: Used to estimate values of a population Advantages Results in the minimum sample size needed to express an opinion of a given confidence level Disadvantages Only valid for populations > 5,000 May result in a larger sample size than judgmentally sampling Requires random selection to remain valid 8

9 Sampling Methods Stratified Sampling Description: The population is sub-divided into mutually exclusive layers. The strata can have equal sizes or you may wish a higher proportion in certain strata. Advantages Disadvantages Ensures units from each main group are included and may therefore be more reliably representative Should reduce the error due to sampling Typically results in lower sample sizes Selecting the sample is more complex and requires good population Estimates involve complex calculations 9

10 Sampling Methods Simple Random Selection Description: Ensures each member of the population has an equal chance of selection Advantages Disadvantages Produces defensible estimates of the population and sampling error Simple sample design and interpretation Need complete and accurate population listing May not be possible in an unnumbered population 10

11 Sampling Methods Systematic Selection Description: After randomly selecting a starting point in the population between 1 and n, every n th unit is selected. Advantages Easier to extract the sample than simple random selection Ensures cases are spread across the population Disadvantages Can be costly and time-consuming if the sample is not conveniently located Cannot be used where there is a pattern to the population distribution 11

12 Sampling Methods Probability Proportional to Size (PPS) Or Monetary Unit Sampling (MUS) Description: Samples are drawn in proportion to their size giving a higher chance of selection to the larger items (i.e., the chance of being selected is proportional to the individual item s size) Advantages Disadvantages Unit to be selected is a single monetary unit (e.g., dollar) Where you want each element to have equal chance of selection rather than each sampling unit Powerful to identify overexaggeration Can be expensive to get the information to draw the sample Only appropriate if you are interested in the elements Not appropriate if elements are under-exaggerated 12

13 Risks Sampling Risk the sample chosen does not represent the population Non-Sampling Risk the auditor misses a significant error while using a representative of the population. Beta Risk Alpha Risk Compliance Testing Over-Reliance on Control: The sample leads the auditor to place reliance on the control when it is not justified Under-Reliance on Control: The sample leads the auditor to evaluate the population as beyond tolerance levels erroneously. Substantive Testing Incorrect Acceptance: the sample supports the auditor s conclusion that the amount or quantity is not materially misstated when in fact it is. Incorrect Rejection: The sample leads the auditor to believe that the amount or quantity is materially misstated when in fact it is not. 13

14 Documentation Work papers should include sufficient detail to describe clearly: Sampling objective Sampling process used Work papers should include: Purpose of the sample Source of the population, definition of the population and its relation to the audit scope Sampling parameters: sample size, random start of seed number or method by which random start was obtained, sampling interval Sampling method Items selected and, if non-statistical sampling is used, justification for the selected items Details of audit tests performed including evaluation of errors and alternative audit procedures (if applicable) Conclusions reached 14

15 CAAT vs. CAATT CAAT - Computer-Assisted Audit Technique CAATT Computer-Assisted Audit Tools and Techniques Software used to increase an auditor s personal productivity and software used to perform data extraction and analysis Techniques to increase the efficiency and effectiveness of audit function 15

16 16

17 17

18 18