Auditing

1
Auditing

• Pete Donnell, State Auditors Office

2
Auditing

• Definition of auditing
• Types of audits SAO performs
• Standards SAO follows
• Financial statement assertions
• Understanding information systems
• Internal controls

3
Auditing - continued

• Information technology audit objectives
• General controls reviews
• Application controls reviews
• Determining whether an application will be
  audited
• Features auditors would like to see

4
Definition of Auditing

• Auditing is a process of accumulating and
  evaluating evidence about quantifiable
  information for the purpose of reporting on the
  degree of correspondence between the quantifiable
  information and established criteria

5
Types of Audits SAO Performs

• Comprehensive Annual Financial Report
• State Single Audit
• Legal Compliance

6
Standards SAO Follows

• Statements on Auditing Standards (SASs)
• Yellow Book Standards for Government Audits

7
Financial Statement Assertions

• Existence or occurrence
• Completeness
• Rights and obligations
• Valuation or allocation
• Presentation and disclosure

8
Understanding Information Systems

• The classes of transactions that are significant
  to the financial statements.
• How those transactions are initiated.
• The accounting records, supporting information,
  and specific accounts in the financial statements
  involved in the processing and reporting of
  transactions.

9
Understanding Information Systems

• The accounting processing involved from the
  initiation of a transaction to its inclusion in
  the financial statements, including electronic
  means (such as computers and electronic data
  interchange) used to transmit, process, maintain
  and access information.
• The financial reporting process used to prepare
  the entitys financial statement, including
  significant accounting estimates and disclosures.

10
Internal Controls

• Consider what can go wrong
• Determine control objectives
• Identify controls in place to mitigate risks
• Identify material weaknesses

11
Specific Audit Objectives

• Applications dealing with cash receipts or
  revenue we are concerned that all transactions
  get recorded.
• Applications dealing with disbursements or
  expenditures we are concerned that all
  transactions are authorized or approved and
  proper separation of duties exist.

12
Information Technology Audit Objectives

• Integrity of information
• Availability of information
• Control over access to information
• Auditability of information

13
General Controls Reviews

• Organization
• Physical Security
• Backup/Recovery
• Application Design
• Operation System
• Electronic Access and Internet Usage

14
Application Controls Reviews

• Controls to ensure completeness and accuracy of
• Input
• Processing
• Output
• Program change controls
• Controls limiting access to key files

15
Determining Whether an Application Will Be Audited

• Have the transactions or processes been audited
  in the past?
• Does the application process financial
  transactions?
• Is the application considered mission critical?

16
Features Auditors Would Like To See

• Documentation of the significant inputs.
• Documentation of testing performed to ensure the
  application processes accurately.
• Ability to obtain the information in an
  electronic form.
• Information to help us assess the amount of
  transactions and dollar amounts processed during
  a year.

17
Conclusion

• The State Auditors Office wants to continue to
  participate in the development of new
  applications
• To request our involvement, contact the audit
  manager of the line team auditing your agency or
  Pete Donnell at 586-1915
• DonnellP_at_sao.wa.gov