HOW
INFORMATION TECHNOLOGY HAS AFFECTED THE AUDITOR'S
WORK
ENVIRONMENT AND THE AUDITING PROCESS
by
Amy Bivens
and
Neal
VanZante
Texas A&M University-Kingsville
ABSTRACT
Information technology has affected the work of
auditors and the auditing process in recent years. Leaders in the auditing profession are implementing
information technology into their firms and making technological training a
priority for the staff. Auditing
has become more efficient and effective through the use of new technology.
The
purpose of this paper is to describe and explain recently developed
information technologies and illustrate how they impact the auditor’s work
environment and the auditing process. Information
technologies discussed are: the internet, the
intranet, groupware/collaborative computing, portable computing, electronic
commerce, electronic data interchange, image processing systems, and trial
balance/auditing software.
The last section of the paper includes a summary of
the information technologies and a discussion of how these technologies have
contributed to “continuous auditing.” The paper concludes with
limitations, ideas for future research, and opinions about how future
technological advances will affect the auditor and the auditing profession.
INTRODUCTION
In recent years, information technology has had a
major impact on the work of auditors and the auditing process.
Hand-written working papers traditionally used when performing audits
have been replaced by electronic spreadsheets and sophisticated auditing
software. Several of the nation’s
largest auditing firms have already moved to a “paperless” audit where all
work papers are prepared and stored on laptops which the auditor can take from
client to client. Once an audit is complete, all work papers are e-mailed to
the different members of the audit team for their review. As a result, the amount of paper used and the travel time for
auditors has been drastically reduced.
The
entire auditing profession is rapidly changing because of advances in
information technology. Leaders
in the auditing profession are implementing information technology into their
firms and making technological training a major priority for the staff.
"Information technology affects organization effectiveness,
efficiency, and innovation by eliminating, automating, enhancing, and enabling
business processes" (Hollander, Denna, & Cherrington, 2000).
The
purpose of this paper is to describe and explain several recently developed
information technologies and illustrate how they impact the auditor’s work
environment and the auditing process. Several
information technologies are discussed as to how they have impacted the
auditing process and the work of the auditor,followed by a discussion of how
these technologies have enabled the concept of
"continuous auditing" to become a reality.
The paper concludes with limitations, ideas for future research, and
opinions about how future technological advances may affect the auditing
profession.
INFORMATION TECHNOLOGIES
The Internet
The
Internet has provided auditors with a vast supply of resources and information
to help with every aspect of an audit engagement. "It has provided a medium for various communication
trends and new forms of networks" (Hollander, Denna, & Cherrington,
2000). Auditors performing audit
engagements will discover that the Internet is a gigantic virtual library that
offers a wealth of information (Begin & Laroche, 1999).
Internet technologies have begun to change the market, through 2003,
hey will be the primary drivers of growth (McKendrick, 1999).
The
Internet is a useful source for auditors in the preparation and planning of an
audit engagement. The Internet
provides an easier method of doing research about a potential client or
competitor. Statistics on a
particular segment or industry that might be needed to support an auditor's
risk analysis can be found online. If
auditors need assistance in determining which procedures to use in the audit
program, a site such as Auditnet, can consulted.
Questions concerning legal issues about auditing can be resolved
without having to physically law library. Auditors may need to refer to
accounting and auditing standards in their everyday work and to question how
they are applied or interpreted in various contexts.
In the normal course of an audit engagement, confirmation requests must
be sent out and followed up on. The
Internet offers a number of useful directories and listings such as WhoWhere
and Canada411 which makes this type of information readily accessible (Begin
& Laroche, 1999).
It
is no longer necessary to purchase journals in order to read articles dealing
with accounting or auditing issues. Various
journal articles can be found on online databases, such as Lexis-Nexis
Academic Universe or Ovid. Internet
sites like CAARNet (Center for Accounting and Auditing Research) are designed
specifically for the purpose of doing accounting and auditing research.
Discussion groups, auditing newsgroups, and sites that present video
clips of selected conferences are other ways of exchanging ideas on topics of
interest on the Internet (Begin & Laroche, 1999).
Internet
messaging solutions have significantly developed over the last few years.
This enables users to manage voice and fax messages from their desktops
just like they currently manage e-mail messages.
When a person is out of the office, calls might be forwarded to another
location or a cellular phone. With
the use of the Internet, systems have been designed to screen calls or
selectively pick and choose which calls to answer depending upon the type of
day a person is having (VoicePlus, 1999).
Intranet
Where the Internet connects people, organizations,
and information sources by using common protocols to link computers on a
public basis, the Intranet uses the same common protocols for internal company
or group purposes. "An
Intranet is an implementation of Internet technologies within a corporate
organization to distribute information throughout the organization"
(Starkey, 2000). Intranets are
private networks entirely apart from the global Internet.
They increase employee awareness of new and existing online tools and
information sources.
Intranets are needed by large organizations that
constantly require current intra-office information. An Intranet is most useful when an organization has different
locations, such as large auditing firms.
Intranets provide a single place that allows all employees of an
organization to get any information from the executives, Human Resources,
Marketing, Sales, Training, Finance, Partners, or Operations twenty-four hours
a day. Hundreds of documents
including presentations, notes, software, policies, and training materials are
all available online. Some of the
many uses of Intranets within an organization include "executive decision
support systems, sales cycle automation tools, financial systems, online
analytical processing applications, personal productivity applications,
financial trading floor systems, procurement and business-to-business commerce
applications, document management systems, and customer support and help desk
applications" (Starkey, 2000). Because
information is readily accessible on an Intranet, decision-makers are able to
analyze business processes, business opportunities, and business goals much
faster.
With an Intranet, auditors can send e-mail,
collaborate on reports or workpapers, and view organization-wide Web pages.
There are numerous business benefits of Intranets, including:
· People use and get accustomed to the same kinds of approaches and systems for internal company/group working, working externally with other groups/ companies/individuals, and private use for work or leisure purposes. This shortcuts learning curves.
·
The company/group and
its people have access to the very wide and rapidly increasing range of
applications, products, and services flowing from the world- wide acceptance
of Internet methods. Very attractive prices result from intense competition
among suppliers - as well as a lot of free or very low cost applications and
information.
·
The skills needed to
develop, maintain, and enhance applications are converging, and companies will
be able to obtain technical skills from a wider pool.
·
Employees and jobs
can become more flexible and mobile, since the Intranet approach means that
applications and information are readily shared regardless of geography and
time zones, and people share a common platform of learning.
·
A common approach to
internal information and published information enables significant savings,
for example, in design and print of publications. Customers and staff can
access the same data at the same time. (www.eto.org.uk, 2000)
Groupware/Collaborative Computing
Groupware/collaborative
computing has given companies and corporations a true competitive advantage as
a result of communication technologies available only to those who implement
such strategic applications. "Collaborative
computing functions can include company-wide scheduling, electronic mail,
group conferencing, and other tools so corporations can alter their business
processes and streamline communications" (Korzeniowski, 2000).
Through the use of collaborative computing/groupware, auditors can work
together by allowing every member of an audit team to view and update
documents.
Groupware
packages support a range of document types, including voice and video clips,
and are in tune with today's business requirements. Groupware provides auditors with common desktop software so
they can send and receive messages and attachments to or from anyone in the
company at any time. Companies can use groupware to ease maintenance chores, lower
training requirements, and ease integration tasks (Korzeniowski, 2000).
Groupware is increasing the productivity of auditors with fewer people
doing more with less. Organizations are being reshaped to increase quality, improve
customer service and provide greater employee autonomy through the use of
groupware (Starkey, 2000).
Groupware
offers significant advantages to auditors over single-user systems.
The following are some of the most common advantages of groupware:
·
Facilitate
communication by making it faster, clearer, and more persuasive
·
Enable
communication where it wouldn't otherwise be possible
·
Enable
telecommuting
·
Cut
down on travel costs
·
Bring
together multiple perspectives and expertise
·
Save
time and cost in coordinating group work
·
Enable
new models of communication, such as anonymous interchanges
(www.usabilityfirst.com
, 1998)
Portable
Computing
The
integration of portable computing devices is enabling new levels of mobility,
which in turn facilitates new ways of working (Wendland, 1999).
Many audit professionals have turned mobile, trading in their desktops
for an array of portable office tools including notebooks, hand-held
computers, and cellular phones.
Auditors
are faced with a variety of portable technology choices, and to be
competitive, firms will need to be properly equipped with reliable portable
tools that facilitate communication, organization, and performance.
With the use of portable computers, time spent on an airplane and on
the road can be much more productive. According
to John Hudson of the AICPA, accountants used to carry only calculators when
they traveled, and now they carry more computing power in their laptops than
Neil Armstrong carried to the moon (Stimpson, 1999). E-mail messages can be
sent, PowerPoint presentations can be created, auditing engagements can be
worked on, and a variety of other things can be done while traveling.
The sale of wireless LAN (local area network) products, which let users retain a wireless connection to the network while roaming around a building or campus with a portable computing device, have begun a steady rise in sales because of improving performance, decreasing prices, and emerging standards. Never before has the wireless market been so volatile, so competitive, and so rich with opportunity (Computers Today, 1999).
Laptop computers have
significantly improved over the years. The slimness and light weight of the
newest models of laptop computers is making them more of a pleasure to lug
around in a briefcase or through a boarding gate (Stimpson, 1999).
Some of the smallest laptops weigh less than two pounds.
Laptops are a necessity for auditors, and now they can be carried
virtually anywhere with very little effort.
Various
palm operating system devices have become increasingly popular with mobile
professionals. The PalmPilot
model is one of the portable computing devices used by many auditors.
It can be used to verify flight information and car reservations,
to remind people of appointments, and to book new engagements
(Alexander, 1999). PalmPilots are
also equipped to store names and e-mail addresses.
Other variations of the PalmPilot include the Palm III, the Palm IIIx,
the Palm IIIc, and the Palm Vx. These
hand-held organizers, through their various incarnations, have become the most
popular organizers ever made (www2.palmgear.com,
2000)
Portable
zip drives are the perfect solution for people who have to work with large
amounts of information. When on
the road for an engagement, auditors may use a portable zip drive to copy
files and data. If a client needs
support later, auditors can pull up the client's data without having to be in
their office (Alexander, 1999). Portable
zip drives are great for backing up, organizing, and transporting important
files. Larger amounts of data can
be stored in a zip drive than on a regular 3.5-inch floppy disk. If an auditor is working in a place where other people have
access to the same computer, work can be saved on a zip drive, and the disk
can be locked up until it is needed again (Peterson, 1998).
U.S.
West FaxPower, the Timex Data Link watch, and Hewlett Packard's CapShare 910
are other portable computing devices that are beneficial to auditors.
U.S. West FaxPower can be installed on a notebook and used for virtual
faxes. "FaxPower lets users
send faxes from their desktop using any Windows 95, 98, or NT application and
an Internet connection and receive faxes right at their desktop."
If a portable calendar is necessary, the Timex Data Link watch can be
worn. This is a personal
organizer that programs with a personal computer.
To scan documents, a Hewlett Packard HP CapShare 910 has been
developed. It is a hand-held
device that electronically captures documents (Alexander, 1999).
Electronic
Commerce
Electronic-commerce (e-commerce) is those online
activities that facilitate the exchange of goods and services between
businesses and individuals, and business to business, for financial and
monetary gain (Thomas, 1999). The
growth of electronic commerce is among the top ten technology issues for
auditing (Hollander, Denna, & Cherrington, 2000).
The major audit concerns of electronic commerce are that only
authorized transactions are received and that they are not duplicated, lost,
or modified during processing (Helms & Mancino, 1998).
Controls developed for ordinary e-commerce
transactions are very beneficial to auditors.
The secure electronic transactions (SET) standard, developed by
Mastercard, Visa, Microsoft, and Netscape, provides for encryption of data and
protects financial transactions during transmission. It helps assure that transactions are authorized and that
electronic thieves will not steal credit card numbers during transmission.
A digital signature is another control, which
allows a sender to attach additional data to a message to form a unique and
unforgeable sender identifier. "Batch
controls help ensure that data is not lost or altered during transmission.
Users establish independent batch totals of documents that are later
reconciled against totals the data processing department generates "
(Helms & Mancino, 1998).
Electronic
Data Interchange
Electronic
Data Interchange (EDI) is the electronic transfer of structured data, by
agreed message standards, from one computer system to another, by electronic
means. EDI is often referred to
as paperless trading. EDI was
first introduced in the 1980s and is the fastest growing and most common
subset of e-commerce that auditors are most likely to encounter (Stone, 1997).
Electronic
data interchange has been continuously improving since it was first
introduced, and it has proven to be very beneficial to auditors. In an auditor's work environment, large amounts of paper must
be transmitted, filed, and stored. In
recent years, more and more of the information that is exchanged among
individuals exists in electronic form rather than on paper.
Information technology often requires auditors to use electronic
evidence to reduce audit risk to an acceptably low level, which raises issues
about the validity, completeness, and integrity of that evidence (Williamson,
1997). EDI can be used for both
intra-company and inter-company communications.
"Most current EDI applications operate some form of batch transfer
mechanism, operating on a store and retrieve mode, whereby the data is sent
via a third party network to a mailbox, to be subsequently received by the
recipient" (www.cf.ac.uk, 2000).
EDI
may seem difficult to distinguish from electronic mail because both involve
the transmission of electronic messages between computer systems.
What differentiates EDI from e-mail is the data message's internal
structure and content. The
content of an e-mail message is not intended to be processed in any way by the
receiving system. EDI messages
are intended for and are structured for automatic processing (Hawker, 2000).
EDI
presents numerous audit and control implications. Auditors need to understand how certain entities conduct
business using EDI and how to adjust their audit procedures accordingly.
EDI creates a dependence on the trading partner's computer system, so
its errors and security problems might affect the client's system.
A feature of Electronic Data Interchange is that the business cycle is
often compressed, resulting in lower year end account balances for inventory,
receivables, and payables (Helms & Mancino, 1998).
Because
EDI is a subset of e-commerce, the controls previously mentioned for
e-commerce also apply to electronic data interchange.
Policies and procedures for ensuring that access to equipment,
software, and data is restricted to authorized users must be enforced.
Auditors might investigate controls such as the use of passwords to ensure the
entity's compliance with adequate application software maintenance procedures
(Helms & Mancino, 1998). Physical
security measures include storing backup files off site and keeping equipment
behind locked doors. An audit
concern regarding the security of electronic data interchange is to make sure
that only authorized transactions are transmitted and received, and that they
are not duplicated, lost, or modified during processing. Another control common to the use of electronic data
interchange is continuous auditing (Helms & Mancino, 1998).
Auditors
must be thoroughly familiar with the differences between traditional
documentary and electronic evidence. The
scope of the auditing procedures necessary to assure the competence of
electronic information must be considered.
Auditors need to understand how electronic evidence is extracted from
the information system. Auditors
must consider the competence of tools used to access electronic evidence and
how the use of computer-assisted audit techniques expands the ability to
analyze data and test the assertions contained in the financial statements.
Auditors need to be watchful for potential errors, such as data
transmission errors or the deliberate manipulation of data. Limited access to,
or retention of, electronic evidence may require the auditor to select samples
several times during the audit period rather than just at year end
(Williamson, 1997).
Source
documents such as purchase orders, bills of lading, invoices, and checks might
be replaced with electronic messages. In
certain organizations where evidence is in electronic form, an auditor may
determine that it would not be practical or possible to reduce detection risk
to an acceptable level by performing only substantive tests for one or more
financial statement assertions. The
potential for the alteration of information to occur and not be detected may
be greater if information is produced or maintained only in electronic form.
The auditor should perform tests of controls to gather evidence to
support an assessed level of control risk below the maximum level.
This evidence, combined with evidence from substantive tests, should be
sufficient to support the opinion to be issued (Williamson, 1997).
Image processing involves the conversion of paper documents into
electronic form through scanning, as well as the subsequent storage and
retrieval of the electronic image (Helms & Mancino, 1998).
An important business mission to many auditors is to improve the
productivity and quality of their audits.
"Document image processing technology supports this mission by
storing documents in the form of pictures or images, and indexing those images
for efficient retrieval over a network of display terminals and printers"
(Littlejohn & Plagman, 1992, p.64).
A key issue for auditors in image processing is document
authenticity. They have to figure
out if the electronic image is actually what it appears to be or if it has
been altered in any way. The
auditor should test controls to verify that only valid and authorized
documents are scanned into the system. For example, the auditor could review
an image of a purchase order when someone had used a desktop publishing
program to alter the quantities, prices, and other relevant data, thereby
creating an image that could be substantially different from the now discarded
original source document (Helms & Mancino, 1998). A
quality control function should be implemented to guarantee that the scanned
image is captured without errors before the paper document is destroyed.
Clients almost always discard paper documents after scanning them into
the computer system. "The
auditor should test controls, such as the use of passwords, that prevent
unauthorized changes to the stored electronic images" (Helms &
Mancino, 1998).
Image
processing systems allow auditors access to both data information and
electronic images. In traditional paper- based environments, the number of
cases that can be audited and the timing of the audit are constrained by the
need to assemble original documents and all related data before the audit can
proceed. Image processing
technology allows data and documents to be inspected while documents are
actually being processed. Auditors
can detect problems sooner than they did in the past through the use of "real-time" image processing systems.
Audit samples can be prioritized, with the necessary documents
electronically attached. Image
processing systems can provide a record of who did what with the documents and
data records used in an audit (Nehmzow, 1992).
Advantages of using image processing over
manual, paper-based systems include:
·
Saves floor space and
labor costs
·
Reduces the time
needed to search for and retrieve information
·
Prevents document
loss
·
Prevents unauthorized
access to sensitive documents
·
Enables the addition
of documents to a file without first retrieving the file
·
Creates multiple
backup copies, which ensures continuity in case of a disaster
(Littlejohn & Plagman, 1992).
Trial Balance Software
Trial
balance software helps improve audit engagement efficiency and workflow by
automating many mundane, time-consuming procedures. Trial balance software packages perform tedious procedures
quickly and accurately, allowing auditors to spend less time on number
crunching and more on professional judgment.
Trial balance software can be used to prepare workpapers, trial
balances, financial statements, and detailed account analyses (Knaster, 1998).
Technology
has impressively changed and improved trial balance software.
As early computer users found that the machines automated their writing
and calculation chores, they began to demand better ways of computerizing
their accounting functions (Cohn & Bellone, 1997).
The implementation of trial balance software is mandatory for any firm,
regardless of its size, that performs audit review and compilation
engagements. Benefits of trial balance software include:
·
Preparer and reviewer
time is reduced by creating better-documented lead schedules and workpapers
free of footing, cross-footing, and posting errors.
·
Analytical procedures
are easily performed, thus reducing the need for other types of time
consuming substantive testing.
·
Trial balance
software prepares financial statements, and it reduces the number of manual
schedules clients need to prepare.
·
The prior years
adjusted balance, current adjustments, and current year's adjusted
balance any account can be viewed
using this software.
·
It creates efficiency
during audit execution and promotes knowledge sharing.
·
The quality and
organization of working papers are improved.
·
Working papers are
more accessible, and team review is facilitated.
· This software enables audit team members to have immediate access to shared information