In the slidecast, Keith Chan (UWaterloo) provides an overview of the various types of documentation types: narrative and diagrammatic documentation, and its uses in business process modelling and business models for use by auditors in determination of auditor risk and control risk, and for providing recommendations in business analysis context to management, board of directors, and audit committees. The presentation provides an overview of the different types of diagrammatic modelling techniques that an IT assurance professional (CISA) or a CA practitioner can use. The presentation closes with recommendations for a practitioner to improve their communication ability with management.

1. Documentation Techniques and Technologies For ACC626 Keith Chan University of Waterloo

2. Welcome Keith Chan, BMath ‘11Candidate for Master of Accounting at University of Waterloo School of Accounting and FinanceCA Student ACC626- IT Assurance & Computer-Assisted Audit Techniques (CAATs) Instructor: Professor Malik Datardina, MAcc, CA, CISA

3. Agenda Overview of Documentation Techniques and Technologies Relevance for C-Suite Executives Documentation Techniques and Technological Aids for Practitioners Current Issues for Documentation Recommendations

4. A. Overview Auditors: Understanding business processes and provide analysis to management Narrative and Diagrammatic Documentation to depict: Business models Business process modelling

5. Types of Documentation Narrative documentation- systematic documentation of business processes in writing Diagrammatic documentation- utilize diagrams to depict business processes

6. Uses of Documentation Business process modelling- simplified depiction of a business process (Carnaghan) Business models- representation of a company’s network that includes value proposition, activities, assets, suppliers, customers, potential rivals, competitors, etc. (Alencar, Boritz, Carnaghan)

7. Why is Documentation So Important? Alencar, Boritz, and Carnaghan: Altering the presentation of information provided to auditors about the business model can improve their audit risk assessment decisions. Parker- strong connection between understanding of business knowledge, documentation, and communication of findings to management and auditors

8. Guidelines for Audit Documentation in General Sayana (ISACA Journal): “All documentation should relate to the appropriate subject and audit objective”. (Overall Guideline) Documentation may be a record of points from an interview; topic of discussion, person (client) interviewed, position and designation, time and place should be clearly documented. (Narrative) Documentation serves as a record of the auditor’s observations over the re-performance of their client’s work, including place and time. (Narrative and Diagrammatic)

9. Guidelines for Audit Documentation in General (2) Sayana (ISACA Journal): The information systems auditor should include details such as audit objectives and the assertions tested. (Narrative) Auditors should not rely solely on template audit work programs, but to fill in other details mentioned in previous points. (Narrative)

10. B. Relevance for C-Suite Executives Strong documentation skills are often required by management, auditors, and IT assurance professionals. use documentation techniques to record information required as part of the audit procedures for a client. IT audit and assurance professionals need to use “effective measurement and benchmarking” (Parker)

11. Techniques and Aids for Practitioners Narrative Processes- propositional/sentence-based structure Diagrammatic- use of models Business Process Documentation (recommended by ISACA) General Modeling Methodologies

12. Narrative Process Alencar, Boritz, and Carnaghan: “text format more superior to the Diagram format for focusing auditors’ attention on the implications of business model changes on financial statement account changes.” Boritz, Borthick and Presslee: “the method of representing the business process had no effect on participants’ accuracy and efficiency in performing control risk assessments”, … as long as the narrative presentation are equivalent in the information contained.

13. Business Process Documentation (diagrammatic) CISA: growing need to participate in business process reengineering (BPR) engagements to “design new process or improve existing processes [in the company] to replace out-dated and inefficient processes” Obtaining documentation and providing documentation are identified as core tasks within the BPR methodology: Envision, Diagnose, Redesign, and Evaluate.

14. CISA Recommended Documentation Tools (1) Process Maps- use of flow charts, fish-bone Risk Assessment- use narrative documentation to record suggestions from interviewing, brainstorming, Delphi technique Benchmarking- “translate the findings into hypothesis”

16. General Modelling Methodologies (2) System Flowcharts- controls via decision points Diagram:Carnaghan (2006)

17. General Modelling Methodologies (3) Resource-event-agent (REA) Models- exchange of resources Diagram:Carnaghan (2006)

18. General Modelling Methodologies (4) IDEF0/IDEF3- transformation of inputs, outputs and controls of each process Diagram:Carnaghan (2006)

19. General Modelling Methodologies (5) Extended Event-driven Process Chain (EPC) diagram- completechain of activitiesachieved by a businessprocess Diagram:Carnaghan (2006)

20. General Modelling Methodologies (6) UML Activity Diagrams-captures activities and flow of control Diagram:Carnaghan (2006)

21. General Modelling Methodologies (7) Business Process diagrams/Business Process Modeling Notation (BPMN)- further decomposed Diagram:Carnaghan (2006)

22. Summary of Section C Neither type of documentation (narrative or diagrammatic) is more superior than the other Several approaches should be used in conjunction with each other, such as IDEF0, IDEF3, and DFD modelling, in order to offset each model’s limitations.

23. Current Issues Recent studies have proved that narrative approach is just as effective as diagrammatic approach. CA practitioners and IT assurance professionals have both options to choose to represent the required information in documentation.

24. Recommendations CA practitioner or IT assurance professional should: develop strong business knowledge understand their users and learn the various methods of documentation available to reach the required audit objective and meet management’s expectations.

25. Thank you Keith Chan, BMath (2011)Candidate for Master of Accounting (MAcc) at University of Waterloo School of Accounting and FinanceContact information: keith.chan [at] uwaterloo [dot] ca

26. Works Cited Alencar, Paulo S., J. Efrim Boritz, and Carla Carnaghan. "Business Modeling to Improve Auditor Risk Assessment: An Investigation of Alternative Representations." International Symposium on Audit Research (ISAR), 21 Apr. 2008. Web. 26 June 2011. Bernus, Peter. "GERAM: The Generalised Enterprise Reference Architecture and Methodology." IFIP-IFAC Task Force on Architectures for Enterprise Integration. Griffith University, Mar. 1999. Web. 26 June 2011. <http://www.ict.griffith.edu.au/~bernus/taskforce/geram/versions/geram1-6-3/v1.6.3.html> Boritz, J. Efrim, A. Faye-Borthick, and Adam Presslee. "Narratives versus Diagrams: The Impact of Alternative Business Process Representations on Auditor Risk and Control Assessments." University of Waterloo Centre for Information Integrity and Information Systems Assurance, 15 Sept. 2010. Web. 26 June 2011. Browne, Jim, Yuliu Chena, Hui Shen, Brian Wallb, and Michal Zarembab. "Integration of Business Modelling Methods for Enterprise Information System Analysis and User Requirements Gathering." Computers in Industry 54.3 (2004): 307-323. Print. Cannon, David L. CISA: Certified Information Systems Auditor Study Guide. 3rd ed. Indianapolis, IN: Wiley, 2011. Print. Pg. 32, 370. Carnaghan, Carla. "Business Process Modeling Approaches in the Context of Process Level Audit Risk Assessment: An Analysis and Comparison." International Journal of Accounting Information Systems 7 (2006): 170-204. Print. Chesbrough, Henry, and Richard Rosenbloom. "The Role of the Business Model in Capturing Value from Innovation: Evidence from Xerox Corporation’s Technology Spinoff Companies." Industrial and Corporate Change 11 (2002). Harvard Business School. Web. 26 June 2011. <http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.123.2039.pdf> Parker, Robert G. "Business Skills for the IT Audit and Assurance Professional." ISACA Journal 3 (2010): 18-25. Print. Sayana, Anantha. "The Necessity for Documentation." ISACA Journal 3 (2002). Web. 25 May 2011. <http://www.isaca.org/Journal/Past-Issues/2002/Volume-3/Pages/The-Necessity-for-Documentation.aspx>