Information Technology and Data in Accounting
Information Technology and Data in Accounting tests controls over accounting information systems, the use of audit software and data analytics, and the risks created by digital processing. The exam expects knowledge of general IT controls, application controls, CAATs, ERP systems and Egyptian data protection requirements.
IT controls
- General IT controls cover access management, change management, IT operations, backup and recovery, and network security; they support the reliable functioning of application controls.
- Application controls are input, processing and output controls: validity checks, sequence checks, batch totals, exception reports and reconciliation controls.
- The audit trail must allow a transaction to be traced from source document to ledger and back; system-generated logs are evidence.
- Cloud and outsourced systems create reliance on a service organisation; the auditor may use a service auditor's report.
Data analytics and CAATs
- Computer-assisted audit techniques include data extraction, exception testing, duplicate testing, gap detection and recalculation.
- Analytics are used for risk assessment and substantive testing, but the auditor must test the completeness and accuracy of the data used.
- Data protection under Egyptian Law 151/2020 requires lawful processing, security and limits on personal data transfers.
Worked example
An auditor tests duplicate payments in a purchase ledger of 50,000 invoices. The data extracted includes vendor ID, invoice number, invoice date, amount and payment date. The auditor sorts by vendor ID, invoice number and amount, then flags records with the same vendor and amount within 30 days but different invoice numbers. The reasoning is that exact invoice-number duplicates are usually blocked by application controls, so the higher-risk population is same amount and same vendor with a different invoice number. Each flagged item is then traced to the purchase order, goods receipt and bank payment before it is treated as a misstatement.
Traps that cost marks
- Relying on analytics without testing the completeness and accuracy of the underlying data.
- Treating general IT controls as irrelevant when the audit is substantive.
- Confusing input controls with output controls.
- Ignoring the audit trail in an ERP environment or accepting screen prints without system logs.
- Overlooking data protection requirements when extracting personal data for testing.