IS Standards, Guidelines and Procedures for Auditing and Control ...

G14 Application Systems Review continued- Compliance- Reliability of Information2.1.8 Where the IS auditor has been involved previously in the development, acquisition, implementation or maintenance of anapplication system and is assigned to an audit engagement, the independence of the IS auditor may be impaired. The ISauditor should refer to appropriate guidelines to deal with such circumstances.3. PERFORMANCE OF AUDIT WORK3.1 Documenting the Flow of Transactions3.1.1 Information gathered should include both the computerised and manual aspects of the system. The focus should be on datainput (whether electronic or manual), processing, storage, and output that are of significance to the audit objective. The ISauditor may find, depending upon the business processes and the use of technology, that documenting the transaction flowmay not be practical. In that event, the IS auditor should prepare a high level data flow diagram or narrative and/or utilisesystem documentation if provided. Consideration should also be given to documenting application interfaces with othersystems.3.1.2 The IS auditor may confirm the documentation by performing procedures such as a walkthrough test.3.2 Identifying and Testing the Application System Controls3.2.1 Specific controls to mitigate the application risks may be identified and sufficient audit evidence obtained to assure the ISAuditor that the controls are operating as intended. This can be accomplished through procedures such as:• Inquiry and observation• Review of documentation• Testing of the application system controls where programmed controls are being tested; the use of CAATs may beconsidered3.2.2 The nature, timing and extent of testing should be based on the level of risk of the area under review and the audit objectives.In the absence of strong general IT controls, the IS auditor may make an assessment of the effect of this weakness on thereliability of the computerised application controls.3.2.3 If the IS auditor finds significant weaknesses in the computerised application controls, assurance should be obtained(depending on the audit objective), if possible, from the manually performed processing controls.3.2.4 The effectiveness of computerised controls is dependent on strong general IT controls. Therefore, if general IT controls arenot reviewed, the ability to place reliance on the application controls may be severely limited and the IS auditor shouldconsider alternative procedures.4. REPORTING4.1 Weaknesses4.1.1 Weaknesses identified in the application review either due to an absence of controls or to non-compliance should be broughtto the attention of the business process owner and to IS management responsible for the support of the application. Whereweaknesses identified during the application systems review are considered to be significant or material, the appropriate levelof management should be advised to undertake immediate corrective action.4.1.2 Since effective computerised application controls are dependent on general IT controls, weaknesses in this area should alsobe reported. In the event that general IT controls were not reviewed, this fact should be included in the report.4.1.3 The IS auditor should include appropriate recommendations to strengthen controls in the report.4. EFFECTIVE DATE5.1 This guideline is effective for all information systems audits beginning on or after 1 November 2001.47