audit materiality (g6) jalal hafidi bijan barikbin caitlyn e carney megan a stephens
Post on 26-Dec-2015
219 Views
Preview:
TRANSCRIPT
Audit Materiality (G6)
JALAL HAFIDI
BIJAN BARIKBIN
CAITLYN E CARNEY
MEGAN A STEPHENS
Background: Material Weakness
What is a material weakness?• Controls are _____ and/or controls are _____
and or/controls are _____.
Background: S12 Audit Materiality
When Determining the Nature, Timing and Extent…Audit materiality and its relationship to audit risk
Potential weakness/absence of controls
Cumulative effect of deficiencies or weaknesses and absence of controls
• Disclose ineffective controls or absence of controls and the significance of the control deficiencies and possibility of resulting in material weakness.
Identify
Consider
Report
Need for Guideline: IS vs. Financial Audits
Financial IS
• Monetary • Physical access controls
• Quality control• Personnel
management• Password generation
Planning: Assessing Materiality
Professional judgment
IS auditors should consider: Level of error acceptable Potential to become material
Planning: Assessing Materiality
When should a financial auditor’s measure of materiality be considered in an IS audit?
Meeting Audit Objectives: Identify relevant control objectives & material control Determine what to examine based on risk tolerance rate
Planning: Assessing Materiality
What types of “information assets” should be verified in the assessment of materiality?
Classification of Information Assets: Confidentiality, Integrity, Availability (CIA) Access Control Rules Criticality & Risk Exposure
Materiality of Deficiencies: IT General Controls Application Controls
Planning: Assessing Materiality
Consider how deficiencies effect an application, and how it will act when aggregated against all of the other control deficiencies.
They all can effect the organization, individually and as a whole!
Planning: Assessing Materiality
Why should the auditor obtain sign-offs from stakeholders?
Are there any reasons an auditor should not have stakeholders sign off?
By not fixing a control’s deficiency, it could become material to the audit and to the organization.
Not only should stakeholders discuss known material weaknesses, but the auditor should have them sign off on acknowledging them.
Factors in Materiality
• Effectiveness of countermeasures.
• Number of accesses per period– Transactions/inquiries/etc.
• Reporting & files maintained– Nature/timing/extent
• Materials handled– Nature/quantity
• SLAs and costs of penalties• Penalties for lack of compliance
– Legal, regulatory, contractual, public health, and safety
• Critical for business processes supported by system/operation
• Number and type of application• Number of users• Number of managers/directors
(based on privileges)• Criticality of the network
communications.• Cost of system• Potential cost of errors.• Cost of loss of information
– In terms of time and money to reproduce
What do you think is the most important factor?
Why?
Reporting
What should be reported ?
The materiality of any errors found Control weaknesses (potential materiality)
In order to obtain a statement of assurance regarding IS controls (unqualified opinion):
The controls should be placed according to the standards and they meet their objectives Free of material weakness
Reporting Cont’d
If the controls don’t meet their objectives, the IS auditor should issue qualified or adverse opinion
The IS auditor should consider reporting to management weaknesses that are not material
Who has the final decision about what should be reported?
IS Auditor NOT the management
Conclusion
Who do external auditors report to?A. ManagersB. EmployeesC. Board of directorsD. Audit Committee
How can small errors or weaknesses become material over time?
Thank you
Questions
top related