This document discusses auditing in an information technology environment. It begins by outlining how IT assists businesses through production, communication, internal controls, financial reporting, and decision making. It then describes the implications of changing IT, including a shift from manual to electronic controls. The document also discusses determining complexity levels in computerized systems, general and application controls, audit planning strategies, and risks related to IT environments like access control and data loss.

1. PRINCIPLE OF AUDITING & ASSURANCE SERVICES IN MALAYSIA 2
CHAPTER 4 : AUDITING AND THE INFORMATION TECHNOLOGY
ENVIRONMENT
GROUP MEMBER’S NAME:
1. AZIMAH SHAZEEDA BINTI SULEIMAN (10DAT17F1056)
2. NURSHAHIRA BINTI ISMAIL ALI (10DAT17F1070)
3. NUR ASMIDA BINTI AZIZUL (10DAT17F1032)
4. KHALIDA HANIM BINTI KHAIRUDIN (10DAT17F1016)
5. KUGENDRAN A/L SUBRAMANIAM (10DAT17F1046)

2. INTRODUCTION
Information technology(IT) has been widely and rigorously used by
most companies. IT assists the business in various aspects such as in
production, communication or E-commerce,internal controls,financial
reporting and deccision making.
The usage of IT:
• People are constantly looking for online activities and expert faster
delivery from business.
• IT plays vital role in producing reliable and timely financial statements
and reports.
• Improve company internal control system.

3. 4.1.1-Describe the changing information of
technology and implication for auditing
• People are constantly looking for online activities and expect faster
delivery. In accounting as well as auditing, IT plays a vital role in
producing reliable and timely financial statements and reports.
• Most companies use IT to improve company internal control system
through the addition of new control procedure through computer and
replacing the manual control due to the likelihood of possible human
error.

4. IMPLICATION
From manual control to electronic environment:
 Traditional paperwork in which the auditor can see and feel the
printed marks evidencing transaction are carried out online and most
cases in 'real time'.
 Generally looks for the authorizing signatures on the papers
evidencing the transactions and electronic.
 It processing environment such authority is evidenced by the user of
identification codes and passwords which are all physically invisible.
 The level of complexity can be classified into 2 level which is low and
high.

5. 4.1.2-Determine the level of complexity in
computerized information system enviroment
1. EDP systems can be defined by their techical complexity and the
extent to which they are used in an organization.
2. Technical complexity :
• Online-line processing
- An online system allows direct access into the computer. Transaction
can be put directly into the system so that master files are updated at
time the entry is made.

6. • Communication systems
- Communication channels can connect the computer directly to users
anywhere in the world.
• Distributed processing
- When the computing function is apportioned among CPU's spread
geographically and connected by a communication system.
• Data Base Management
- As the volume and uses of computer-processed data expand, data on
different files are often redundant.
- The effect is inefficient use of file space and the need to update files
continually.

7. 4.1.3- General control Computerised Information
System(CIS)
Control Description
1. The IT control environment  The IT government structre
 How IT risk are identified, mitigated and
managed
 The information system, strategic plan and
budget
 The orrganizational structure and segregation of
duties
2. Day-to-day computer operations  Acquisition,installations,configuration,
integration and maintenance of the IT
infrastructure.
 Delivery of information service to user
 Management of third-party provider
3. Access to program and data  Security of password
 Internet firewalls and remote access controls
 Data encryption and cryptographic keys

8. 4. Programme development and program changes  Acquisiton and implementation of new applications
 System development and quality assurance
methodology
5. Monitoring of IT operations  Policies and procedures regarding the information
system and reporting that ensure that user comply
with IT general control.

9. Application Control on Computerised Information
System(CIS)
1. Application control is controls within a computer application to
ensure completeness, accuracy of input,processing and validty of
the resulting accounting entries.
2. The main aim is to ensure validity, completeness and accuracy of
accounting data.
3. Application controls classified into:
a) Input controls
b) Processing controls
c) Output controls

10. a) Input Controls
• The main aim of input controls is to reduce errors in the data entered
in the system for processing.
• Input controls include checking data and ensuring that:
- Input data are authorised by the appropriate official.
- Data represent valid record of actual transaction.
- Correctly classified for the purpose of accounting
• Example : Sequence checks
: Batch control

11. b) Proccessing control
• There are divided into mechanical and programmed controls.
• Programmed control are done during the system development to
ensure that only data related to a particular transaction is processed
and not otherwise.
c) Output control
• Controls relating to input and processing itself with the final
objective.
• Relates pricesely to the original input.
• Represents the outcome of a valid and tested program of instructions.

12. 4.1.4-The Plan An Audit Strategic in CIS
approach
• Ensure that these is adequate compliance and substantive procedures
and transmitted date are correct and completed
• Apply professional scepticism by cross verification of record,
reconciliation between primary and subsidiary ledger, questioning
and critical assessment of audit evidence.
• The audit which may be affected by the client CIS enviroment.

13. Basic steps
• Planning
• Studying and evaluating control
• Testing and evaluating control
• Reporting
• Follow up

14. Effect to auditor
• There is invisiability of data and processing
• There is also radical change in the control structure electronic control
replacing manual control.
• There is of the speedof processing
• IT dynamic always challenges the auditor’s comperence in the
workplace.
- Occur very frequently.
- Auditor left behind trying to catch up with the trend.

15. ACCESS CONTROL RISK
IT ENVIRONMENT RISKS
1. Hardware and
software
 Virus/damage (water/overheating)
 Hacked/sabotage
2. Audit trail  Cannot trace the source of accounting information because no pyhsical document
were used.
3. Loss of data  Loss because of virus/fire
- The company may not produce reliable financial information.
- It is important to have backup system.
4. Unauthorised acess  Proper online – user ID and password
 More to security
 Avoid theft

16. CAAT’S TECHNIQUE
a) Test data method
-for which the auditor will create a set of stimulated transaction
data
- Use the client’s application programme to provide evidence
b) Custom audit software
-Written by auditors for a specific task if the client’s IT system is not
compatible with the GAS or when the auditor ants to conduct some
testing that may nott be possible with GAS.
c) Concurrent auditing technique
-Refers to the collection of audit evidence via technology while the
client’s systems continue to run.

17. d) Parallel simulation
- To construct a simulation program that looks like the company’s
application programme.
- Help the auditor to process the actual data.
e) Integrated test facility
- It will give an accurate data to the auditor because it testing the
programmes actually used by the clients.

18. Nature of risk and internal control
a) Lack of transaction trails.
Some CIS are designed so that a complete transaction trail is that useful
for audit purposes might exist for only a short period of time or only in
computer readable form.
b) Uniform processing of transactions.
Computer processing uniformly processes like transactions with the
same processing instructions. Thus, the clerical errors ordinarily
associated with manual processing are virtually eliminated. Conversely,
programming errors (or other systematic errors in hardware or
software) will ordinarily result in all transactions being processed
incorrectly

19. c) Lack of segregation of functions.
Many control procedures that would ordinarily be performed by
seperate individuals in manual systems may be concentrated in CIS.
Thus, an individual who has access to computer programs, processing
or data may be in a position to perform incompatible functions.
d) Potential for errors and irregularities.
The potential for human error in the development, maintenance and
execution of CIS may be greater than in manual systems, partially
because of the level of detail inherent in these activities. Also, the
potential for individuals to gain unauthorized access to data or to alter
data without visible evidence may be greater in CIS than in manual
systems.

20. e) Initiation or execution of transactions.
CIS may include the capability to initiate or cause the execution of
certain types of trasactions, automatically. The authorisation of these
transactions or procedures may not be documented in the same way as
those in manual system, and management's authorisation of these
transactions or procedures may be documented in the same way as
those in a manual system, and management's authorisation of these
transactions may be implicit in its systems.