Preface |
|
xi | |
Acknowledgments |
|
xiii | |
|
Chapter 1 Why Is IT Auditing Important to the Financial Auditor and the Financial Statement Audit? |
|
|
1 | (20) |
|
Management's Assertions and the IT Audit |
|
|
2 | (3) |
|
Objectives of Data Processing for Small and Medium-Sized Enterprises (SMEs) |
|
|
5 | (3) |
|
Special Challenges Facing SMEs |
|
|
8 | (5) |
|
Research Confirming the Risks Associated with SMEs |
|
|
13 | (3) |
|
A Framework for Evaluating Risks and Controls, Compensatory Controls, and Reporting Deficiencies |
|
|
16 | (4) |
|
|
20 | (1) |
|
Chapter 2 General Controls for the SME |
|
|
21 | (16) |
|
General Controls: Scope and Outcomes |
|
|
22 | (8) |
|
The "COSO Process"---Putting It All Together: Financial Statements, Assertions, Risks, Control Objectives, and Controls |
|
|
30 | (5) |
|
|
35 | (2) |
|
Chapter 3 Application-Level Security |
|
|
37 | (22) |
|
|
37 | (3) |
|
|
40 | (2) |
|
|
42 | (2) |
|
|
44 | (4) |
|
|
48 | (1) |
|
Personnel, Roles, and Tasks |
|
|
49 | (7) |
|
|
56 | (2) |
|
|
58 | (1) |
|
|
58 | (1) |
|
Chapter 4 General Ledger and the IT Audit |
|
|
59 | (22) |
|
The General Ledger: A Clearinghouse of Financial Information |
|
|
60 | (2) |
|
Chart of Accounts for QuickBooks |
|
|
62 | (3) |
|
SME Risks Specific to the General Ledger and the Chart of Accounts |
|
|
65 | (1) |
|
Assertions Underlying the Financial Statements and General Ledger Controls |
|
|
66 | (1) |
|
IT Controls, the Transaction Level, and the General Ledger |
|
|
66 | (12) |
|
|
78 | (3) |
|
Chapter 5 The Revenue Cycle |
|
|
81 | (26) |
|
Risk Exposures and Subprocesses |
|
|
81 | (3) |
|
Application Controls, Revenue Cycle Risks, and Related Audit Procedures |
|
|
84 | (21) |
|
|
105 | (2) |
|
Chapter 6 The Expenditure Cycle |
|
|
107 | (28) |
|
Risk Exposures and Subprocesses |
|
|
107 | (4) |
|
Application Controls, Expenditure Cycle Risks, and Related Audit Procedures |
|
|
111 | (22) |
|
|
133 | (2) |
|
Chapter 7 The Inventory Cycle |
|
|
135 | (24) |
|
Risk Exposures and Subprocesses |
|
|
136 | (7) |
|
Application Controls, Inventory Cycle Risks, and Related Audit Procedures |
|
|
143 | (14) |
|
|
157 | (2) |
|
Chapter 8 The Payroll Cycle |
|
|
159 | (90) |
|
Risk Exposures and Subprocesses |
|
|
159 | (4) |
|
Application Controls, Payroll Cycle Risks, and Related Audit Procedures |
|
|
163 | (85) |
|
|
248 | (1) |
|
Chapter 9 Risk, Controls, Financial Reporting, and an Overlay of COSO on COBIT |
|
|
249 | (40) |
|
PCAOB Warnings: Insufficient Evidence to Support Opinions |
|
|
250 | (1) |
|
How We Got Here: A Historical Perspective |
|
|
251 | (9) |
|
|
260 | (1) |
|
|
261 | (1) |
|
|
262 | (7) |
|
|
269 | (10) |
|
PCAOB Guidance on IT Controls |
|
|
279 | (1) |
|
Integrating COSO, COBIT, and the PCAOB |
|
|
280 | (6) |
|
|
286 | (3) |
|
Chapter 10 Integrating the IT Audit into the Financial Audit |
|
|
289 | (48) |
|
Risks, Maturity, and Assessments |
|
|
290 | (5) |
|
Cross-Referencing COBIT to the PCAOB and COSO |
|
|
295 | (8) |
|
|
303 | (8) |
|
Program Development and Change |
|
|
311 | (6) |
|
Computer Operations and Access to Programs and Data |
|
|
317 | (13) |
|
|
330 | (4) |
|
|
334 | (3) |
|
Chapter 11 Spreadsheet and Desktop Tool Risk Exposures |
|
|
337 | (34) |
|
Specific Types of Risks and Exposures |
|
|
338 | (1) |
|
Research on Errors in Spreadsheets |
|
|
339 | (5) |
|
Compliance Dimensions of Spreadsheet Risk Exposures |
|
|
344 | (4) |
|
Spreadsheet Auditing Tools |
|
|
348 | (4) |
|
Governance of Spreadsheets and Desktop Tools |
|
|
352 | (3) |
|
|
355 | (1) |
|
Auditing Controls and Creating a Baseline |
|
|
356 | (12) |
|
Life after the Baseline: Maintaining Spreadsheets and Desktop Tools |
|
|
368 | (1) |
|
|
369 | (2) |
|
Chapter 12 Key Reports and Report Writers Risk Exposures |
|
|
371 | (14) |
|
|
371 | (1) |
|
Original Reports within the Application |
|
|
372 | (4) |
|
Modified or Customized Reports within the Application |
|
|
376 | (2) |
|
Reports Using Third-Party Packages |
|
|
378 | (4) |
|
Analyzing and Validating Reports |
|
|
382 | (1) |
|
|
383 | (2) |
|
Chapter 13 IT Audit Deficiencies: Defining and Evaluating IT Audit Deficiencies |
|
|
385 | (14) |
|
A Framework for Audit Deficiencies |
|
|
385 | (3) |
|
Types of IT Audit Failures and Illustrative Cases |
|
|
388 | (1) |
|
Use of Compensatory Controls |
|
|
388 | (1) |
|
Ideas for Addressing Segregation-of-Duties Issues |
|
|
388 | (10) |
|
|
398 | (1) |
References |
|
399 | (6) |
About the Authors |
|
405 | (2) |
Index |
|
407 | |