Understanding SAS 94

1. Understanding SAS 94 NYSSCPA Emerging Technologies Committee Bruce H. Nearon J.H. Cohn LLP Bnearon@jhcohn.com 973-403-6955 April 26, 2001

2. Introduction • What is SAS 94? • Au Section 319 – The Effect of Information Technology on the Auditor’s Consideration of Internal Control in a Financial Statement Audit • What is the effective date of SAS 94? • Audits of financial statements for periods beginning on or after June 1, 2001

3. Why do I have to understand SAS 94? • Au 150.02 GAAS – The second standard of field work • A sufficient understanding of internal control is to be obtained to plan the audit and to determine the nature, timing, and extent of the tests to be performed.

4. What is Internal Control? • A device to regulate a system • Ex. What keeps gasoline from leaking as it flows from your gas tank to the engine? • The construction of the fuel tank, fuel pipe, and connections.

5. Ex. What keeps money and resources from leaking as it flows through a business entity? The construction of the financial accounting and internal control system.

6. How much time do I need to spend on SAS 94 Procedures? • How big is the client? • Assets? Sales? • How many transactions? • 1000’s, 10,000’s, 100,000’s, millions • How sophisticated is the computer system? • How much time is in your audit budget for I/C work?

7. What if I only have 8 hours or less? • Au Sec 319.04 Assess control risk at the maximum. Document your conclusion. The basis of the conclusion need not be documented.

8. Taking the easy way out • Assessing Control Risk at the Max • WARNING! You need to be satisfied that performing only substantive tests will be sufficient. • If initiation, recording, and processing of financial data exists only in computers then the power of substantive tests is significantly reduced.

9. Do you understand the extent of computer processing in your audit client? • Au 319.17 – The use of IT (Computers) affects the fundamental manner in which transactions are initiated, recorded, processed, and reported.

10. Automated procedures may: • Initiate • Record • Process • Report Producing e-records: • Purchase orders • Invoices • Shipping documents • Journals and ledgers

11. You may not understand e-records and IT controls, and rely on paper hardcopy and manual controls • BEWARE! Paper records provided by clients and their manual controls may not be independent of IT, may in fact be produced from e-records, and may lack credibility.

12. IT risks to internal control Au 319.19 • Unauthorized access to menus, programs, and data • destruction or improper changes • unauthorized, nonexistent or inaccurate transactions. • errors and fraud. • Failure to make necessary changes to systems or programs i.e. obsolete programs and patch levels

13. Au 319.20 • A lack of control at a single user entry point might compromise the security of the entire database. • Improper changes • Destruction of data • When IT personnel and users are given, or can gain access privileges beyond necessary to perform their assigned duties, a breakdown in segregation of duties can occur

14. Au 319.21 • Errors may occur in designing, maintaining, or monitoring IT controls • IT personnel may not completely understand how the system processes transactions AU 319.22 • Edit routines in programs designed to identify and report transactions that exceed certain limits may be overridden or disabled

15. Obtaining an understanding of Internal Control Au 319.26 • Procedures depend on: • Size and complexity of entity • Previous experience • Specific controls • Entity’s use of IT • Changes in systems and operations

16. Planning the audit Au 319.30 • What IT risks can result in misstatements? • The more complex and sophisticated the entity’s operations and systems the more likely the need to increase the auditor’s understanding of internal control

17. Do you need an IT Audit Specialist? Au 319.31 • How complex is the IT system? • How is IT used in operations? • Have there been significant changes to the system or implementation of new systems? • Is data shared with other systems either internally or externally? • Is there e-commerce? • Is there emerging technology such as wireless networks and devices? • Is audit evidence available only in electronic form?

18. What IT audit skills are needed? • Developing IT questionnaires • Understanding and challenging IT personnel responses to technical inquiries • Locating online system control settings, understanding and evaluating them • Selecting and using audit software tools • Designing and performing IT audit tests • Knowing classic computer control weaknesses • Keeping up with the latest hacking techniques

19. A Common Control Environment Weakness Au 319.36 • Management’s failure to commit sufficient resources to address security risks presented by IT may adversely affect internal control by allowing improper changes to be made to computer programs or to data, or by allowing unauthorized transactions to be processed.

20. Control Activities Au 319.43 • The auditor should obtain an understanding of how IT affects control activities that are relevant to planning the audit.

21. General Controls • Data center and network operations • System and application acquisition, development, and maintenance • Access security

22. Application controls • Initiation, recording, processing, and reporting • Authorization, completeness, validity, accuracy

23. What is a sufficient understanding? How much is enough? Au 319.49 The auditor should understand • The IT and manual procedures to record, process, and report transactions from occurrence to inclusion in the financial statements. • The related records whether electronic or manual used to initiate or record transactions • How the information system captures events and conditions significant to the financial statements.

24. How can misstatements occur? • Does the system allow employees in the accounting or IT department to inappropriately override automated processes? • Ex. Changes to account numbers, vendor or customers, or amounts in journals or ledgers • Does the IT system leave little or no visible evidence of such changes?

25. Nonstandard, nonrecurring, or unusual transactions • Do you understand how nonstandard, nonrecurring, or unusual transactions are authorized, documented, and posted to the system? • Au 319.51 Such entries may exist only in electronic form and may be more difficult to identify through physical inspection of printed documents

26. Monitoring • Much of the information used in monitoring may be produced by IT. This information may be unintentionally or intentionally incomplete and erroneous. Audit monitoring logs may not be retained, may have gaps in them, or be subject to alteration. Management and auditors may rely on this information and develop a false sense of confidence.

27. Audit documentation • Complex IT systems • Flowcharts, questionnaires, checklists • Screen shots, CAAT reports • Walkthroughs, narratives • Systems with limited use of IT, non-complex, few transactions • memorandum

28. Assessing control risk at the maximum • Only substantive tests are performed • Confirm bank balances • Confirm a/r • Observe inventory • Substantive tests are typically performed based on information produced by the entity’s IT system • What evidence do you have that information from the IT system is accurate, valid, and complete?

29. Au 319.68 • Is there a significant amount of information supporting the financial statements electronically: • Initiated and recorded? • Processed and reported ? • What evidence do you have that controls over IT are effective? • Your audit evidence derived solely from substantive tests may not be competent and sufficient

30. Assessing control risk below the maximum Au 319.71 • Identify the types of misstatements that can occur • Consider factors that affect the risk of material misstatement • Identify controls that are likely to prevent or detect material misstatement in specific assertions

31. Tests of general controls • Are changes to programs made without appropriate program change controls? • Segregation of duties • Testing • Documentation • Authorization

32. Are authorized versions of programs used for processing transactions? • Control of development and test libraries • Have changes been made to financial application programs? • Is packaged software used with modification or maintenance?

33. Are access logs produced, retained, and monitored? • Are changes to security settings monitored? • Are the security settings appropriate? • Are critical files and IT personnel audited? • Does someone independent of IT monitor the logs?

34. Warning for those that assess risk at the maximum • Audit samples, records, and reports that originate from a control environment that allows undocumented, unauthorized, and unmonitored changes may not be competent and sufficient.

35. What should I do? I’m not an IT auditor and I don’t have time in my audit budget for this? • Take an hour or two and interview the CFO and IT manager. • Does the CFO take any interest in IT? • Who oversees the IT Manager? • What are the CFO’s and IT manager’s attitude toward controlling IT

36. Interviewing the IT Manager • Have the IT manager explain the IT system and how financial information is processed. • Ask the IT manager how unauthorized changes to financial information are prevented and detected. • If you don’t understand what the IT manager is saying tell him or her so. • If they still can’t explain it so you understand it they probably don’t understand the controls either, or worse there are no controls.

37. Conclusion • Even if you assess risk at the maximum don’t just copy an old narrative or questionnaire and change the date. • Take an hour or two to interview the CFO and IT manager specifically about IT controls and document and analyze what they say • If you want to assess risk at less than the maximum: • The JHC IT audit department has general and application controls audit programs available. • These audit programs can be modified specifically for your client • We can review the responses and help you assess risk and develop management letter comments

38. Thank you