RISK ASSESSMENTS AND INTERNAL
CONTROL:
CIS CHARACTERISTICS AND
CONSIDERATIONS
Learning Outcomes: After the end of this module, the students
should be able to:
1. elucidate the importance of internal controls in auditing in a
CIS environment
2. understand the nature or processing and design
Organizational Structure
Characteristics of a CIS organizational structure includes:
a) Concentration of functions and knowledge
- Although most systems employing CIS methods will include
certain manual operations, generally the number of persons involved in
the processing of financial information is significantly reduced.
b) Concentration of programs and data
- Transaction and master file data are often concentrated, usually in
machine-readable form, either in one computer installation located
centrally or in a number of installations distributed throughout the entity
Nature of Processing
The use of computers may result in the design
of systems that provide less visible evidence
than those using manual procedures. In
addition, these systems may be accessible by
large number of persons.
Nature of Processing
System characteristics that may result from the nature of CIS
processing include:
a) Absence of input documents
i. Data may be entered directly into the computer system without
supporting document.
ii. In some online transaction systems, written evidence of individual
data entry authorization (e.g., approval for order entry) may be
replaced by other procedures such as authorization controls
contained in computer programs (e.g., credit approval).
Nature of Processing
System characteristics that may result from the nature of CIS
processing include:
b) Lack of visible audit trail
The transaction trail may be partly in machine-readable form and
may exist only for a limited period of time (e.g., audit logs may be set
to overwrite themselves after a period of time or when the allocated
disk space is consumed)
Nature of Processing
System characteristics that may result from the nature of CIS
processing include:
c) Lack of visible output
Certain transactions or results of processing may not be
printed, or only summary data may be printed.
Nature of Processing
System characteristics that may result from the nature of CIS
processing include:
d) Ease of access to data and computer programs
Data and computer programs may be accessed and
altered at the computer or through the use of computer
equipment at remote locations. Therefore, in the absence of
appropriate controls, there is an increased potential for
unauthorized access to, and alteration of, data and programs by
persons inside or outside the entity.
Design and Procedural Aspects
The development of CIS will generally result in design and procedural
characteristics that are different from those found in manual systems.
These different design and procedural aspects of CIS include:
a. Consistency of performance
CIS perform functions exactly as programmed and are potentially
more reliable than manual systems, provided that all transaction types
and conditions that occur are anticipated and incorporated into the
system. On the other hand, a computer program that is not correctly
programmed and tested may consistently process transactions or other
data erroneously.
Design and Procedural Aspects
b. Programmed control procedures
The nature of computer processing allows the design of internal
control procedures in computer programs.
c. Single transaction update of multiple or data base computer files
A single input to the accounting system may automatically update
all records associated with the transaction.
Design and Procedural Aspects
d. Systems generated transactions
Certain transactions may be initiated by the CIS itself without the
need for an input document.
e. Vulnerability of data and program storage media
Large volumes of data and the computer programs used to process
such data may be stored on portable or fixed storage media, such as
magnetic disks and tapes. These media are vulnerable to theft, or
intentional or accidental destruction.