Grau & Assoc. - Laserfiche WebLink

Home Browse Search

increase efficiency. Our firm uses Active Data mining software that enables us to use data from your II financial reporting package to perform CAAT's. Some examples of taking an output file format and converting it into a usable data format for our audit team to perform CAAT's include: • Trends in number and amounts paid to vendors • Search for false employees • Sorting payments to identify items that fall under the threshold of financial control or contract limits • Analyzing sequence in a population for missing or duplicated items • Comparison of vendors and employee addresses CAAT's are also useful in performing a variety of time consuming tests such us: footing files, testing for incomplete data, and sorting. CAAT's are also used to perform a variety of tests of controls such as: selecting a sample for inspection or re-performance of procedures, testing access to critical files and programs, and testing program application controls. Information Systems Audit Procedures In the technology age, information security and financial systems security is a big concern for many of our clients. Areas of potential risk are: • Data security including access to the data and software • Processes that automatically import data from an outside source • Processes that export data to other programs Under current generally accepted auditing standards, we are required to gain an understanding of internal controls which include an entity's Information Technology (IT) environment during audit planning, in order to determine the nature and timing of substantive audit procedures. We assess what level of IT environment an entity has on a scale from one to three. For example, a level one entity has a non- complex IT structure with features including the use of commercial off-the-shelf (COTS) accounting software and a limited number of workstations and online transaction. By comparison, a level three entity has a complex IT structure with one or more servers, several integrated software applications, thirty or more workstations and online transactions. We have partnered with SLPowers, a firm recognized as one of the countries most advanced IT service providers, to work side by side with our audit team. We believe partnering with an industry expert provides additional assurance to the City that its IT systems are being checked and evaluated accurately. SLPowers is at the cutting edge of the rapidly evolving environment of network and database security, internet security and vulnerability testing. In today's information age, an in-house IT auditor may not have the most up-to-date experience and training for handling sensitive information and financial database II security. We will work alongside our IT Contractor to assess, document, and test as deemed necessary the following five areas of IT controls: • Entity Level Control kR /titre! o, • Change Management ,Iw� t ^ht wr. • Information Security - nc-ia ; Cu. reI° mi. , rdrPentarn • Backup and Recoveryanesniert • Third Party Providers (if applicable) I: � � 'iamo�s :t 7^ " 7{.,+}i, - fr P'e s A'4 Once we gain a better understanding of the general controls over IT functions, then we can take a look at specific areas within the financial , 1:111� . I reporting process that need to be reviewed in I 1 nalreine?nlr[ordeals greater detail. Good controls around thesedronbR.o» Walu rtac0ol rertlnikA Ww[GAoi rajad — IeM UNds✓A � ^ .rr� aspects of IT are important in order to maintain W ,h; , rsbre mineral minds the integrity of the number. 18