Electronic Working Papers

CIPFA in the Midlands Audit Training Seminar

22 October 2003

Presentation by

Stephen Allen, MIIA
Allen Computing and Business Analysis

Electronic Working Papers
(EWP) in context
Whole audit function can be automated,
including
risk evaluation & management (not strictly audit)
strategic audit planning
annual planning & resource control
project management & control
working methods and electronic working
papers

What to automate?
Products available for each audit function
Some products cover several elements
within the hierarchy including EWP
Others concentrate on planning and audit
resources to the exclusion of EWP
No one product does it all yet
EWP Relative importance
All elements require consideration
comprehensive packages sometimes lead to overly rigid
working practices
EWP the foundation of a pyramid
impact on
all audit staff
clients both directors & operational
computing requirement
office requirement
Why go electronic?
Your reasons could include any or all of the
following
saving time
improving standards
reducing storage
facilitating communication
security considerations
Attention on EWP
Essentially two choices
a product to match your audit style, or
change audit style to match the product
Most frequently a bit of both
Audit so multi-faceted and complex that off
the shelf solutions to EWP are not available
Significant effort required to tailor any of
the known products to your needs
Audit style?
Current state
Most common means of communication
Level of prescription in using ICQs and DAPs
Audit forms with answer boxes and signature boxes
Handling audit evidence
Use of analytical tools
Approach to audit review
Style of audit report
Approach to storage of audit papers
Audit strategy for development
Technical compatibility
State of networking
Unix platforms often have Windows front end
Some products require file server based networks
Thin client technologies impose restrictions on the use of
Windows/PC based products
Operating system
Unix network security potentially excellent if set up correctly
Windows NT security is good and improving
Windows 98 and earlier has no security, but XP changed all that
Computing power
modern programs require access to large memory, fast machines
and high quality display
EWP Practical issues
Presentation ease of use
Moving around the project
Audit evidence
Issues and queries
Recommendations
Report writing
Team working
Printing out and Indexes
Presentation ease of use
Simple structure and concept
Access to menus and/or function buttons
Not too many windows
Clear relationship between project and
project environment
Handling multiple projects in a single
session
Moving around the project
Finding the bit you want
Skipping between recent working papers
Cross-referencing working papers
Linking outside the project
Looking at the structure or index
Reviewing the project

Audit evidence
Establishing consistent working paper
reference approach
Creating an index
Cross referencing
Linking electronic evidence
Marking electronic evidence
Creating electronic evidence from hard
copy
Issues and Queries
Raising issues and queries
who, when and current status
Reviewing outstanding issues and queries
Clearing queries
who and when
cause and effect
Converting queries into reportable issues
Reporting
Recommendations
Setting in context
linking to findings/conclusions
evaluation of consequences (risk)
Reviewing
Reporting
Summarising
creating an action plan
Report writing
Ensure all issues are considered
Reviewing elements to report
opportunity to say No
opportunity to edit
opportunity to set findings in context
opportunity to establish an appropriate order
Establish an audit trail to findings
Editing final report in suitable package
Team working
Multi-user functionality
strategic approach
access controls
Mechanics
user hierarchies
replication
communication
conflict resolution
Rules and procedures
access to guidance and standard work papers
Printing out and Indexes
Preview print layout
adaptable layout
page numbering
dating
Must be easy to print out
Clear headings and source identity
Should have printable index
Improving standards
Structure and approach
logical structures and planning
sound review procedures
clear reporting logic
Guidance
variety of guidance approaches
access to analytical tools
ease of incorporation into package
ease of access to user
Improving standards
Working papers
presentation and layout
on screen and as printed
logic and completeness
cross-referencing
corroborative proof
Storage
What to store
working papers
corroborative evidence
report
When (and for how long after that)
during audit
at audit review
after completion
Storage
Who needs access
audit department
auditees
senior management
other review bodies
Method of storage (other than paper)
electronic (including compressibility)
hard disc
CD ROM or other remote storage
micro fiche
Storage
Methods of conversion
scanners
digital photography
micro-fiche service or other external conversion
Associated time and costs
processing costs
ongoing storage costs
administration costs
purchase of specialized viewers or software
Communication
Internal within Audit unit
common frame work and points of reference for
improvement
better access to knowledge base
External
enhances presentation and consistency
ensures adequacy of scope and logic
can be a source of summarized evidence
Security
Traditionally audit is secretive
EWP has little direct impact
time to review our traditional approach?
Sarbanes-Oxley Act in US requires storage
of audit reports intact
custodial sentences for directors for failure to
comply
To maintain audits in unaltered state burn
on to CD ROM
Commissioning process
Organization and security of audit directories
Preparation and incorporation of standard audit
tests and schedules, templates, audit tools etc.
Training in package environment and detailed use
referencing and cross-referencing
queries and recommendations
review processes
report writing
Training in multi-user operation, replication, user
hierarchies etc.
Commissioning the audit detail
General audit guidance and instructions
Existing ICQs, testing schedules and access
to analytical tools
incorporation within the EWP package
how to convert them (if required)
programme of conversion
Establishing appropriate layouts and
standards
Case for EWP reappraised
Saving time
needs effort and practice, but significant
savings are possible especially in the reviewing
and reporting parts of the auditing cycle
Improving standards
provides a very valuable framework for
introducing improvements
real improvements generated in the
commissioning process very important

Case for EWP reappraised
Reducing storage
long-term reductions can be achieved with
relative ease
short-term reductions need careful
consideration in context of audit approach and
the handling of corroborative evidence
Facilitating communication
sound framework for internal improvements
Case for EWP reappraised
Security considerations
encourages effective review of organization-
wide network security issues
electronic format permits secure and economic
storage
Ancillary advantages
encourages real understanding of nature of
applications and their control
Summary
Be clear on what to automate - affects
product choice
Look for good fit with current and future
audit practice and technical environment
Make sure that the EWP standard
functionality is what you want
Consider carefully storage implications
Commissioning effort, lead times and
product support are important
Suppliers
ACBA EWP
http://www.acba.co.uk/
AutoAudit
http://www.paisleyconsulting.com
Galileo
http://www.horwathsoftware.com/
TeamMate
http://www.pwcglobal.com