Electronic Working Papers

1. Electronic Working Papers CIPFA in the Midlands Audit Training Seminar 22 October 2003 Presentation by Stephen Allen, MIIA Allen Computing and Business Analysis

2. Electronic Working Papers (EWP) in context • Whole audit function can be automated, including • risk evaluation & management (not strictly audit) • strategic audit planning • annual planning & resource control • project management & control • working methods and electronic working papers

3. What to automate? • Products available for each audit function • Some products cover several elements within the hierarchy including EWP • Others concentrate on planning and audit resources to the exclusion of EWP • No one product does it all – yet

4. EWP – Relative importance • All elements require consideration • comprehensive packages sometimes lead to overly rigid working practices • EWP the foundation of a pyramid • impact on • all audit staff • clients – both directors & operational • computing requirement • office requirement

5. Why go electronic? • Your reasons could include any or all of the following • saving time • improving standards • reducing storage • facilitating communication • security considerations

6. Attention on EWP • Essentially two choices • a product to match your audit style, or • change audit style to match the product • Most frequently a bit of both • Audit so multi-faceted and complex that off the shelf solutions to EWP are not available • Significant effort required to tailor any of the known products to your needs

7. Audit style? • Current state • Most common means of communication • Level of prescription in using ICQs and DAPs • Audit forms with answer boxes and signature boxes • Handling audit evidence • Use of analytical tools • Approach to audit review • Style of audit report • Approach to storage of audit papers • Audit strategy for development

8. Technical compatibility • State of networking • Unix platforms often have Windows front end • Some products require file server based networks • Thin client technologies impose restrictions on the use of Windows/PC based products • Operating system • Unix network security potentially excellent if set up correctly • Windows NT security is good and improving • Windows 98 and earlier has no security, but XP changed all that • Computing power • modern programs require access to large memory, fast machines and high quality display

9. EWP – Practical issues • Presentation – ease of use • Moving around the project • Audit evidence • Issues and queries • Recommendations • Report writing • Team working • Printing out and Indexes

10. Presentation – ease of use • Simple structure and concept • Access to menus and/or function buttons • Not too many windows • Clear relationship between project and project environment • Handling multiple projects in a single session

11. Moving around the project • Finding the bit you want • Skipping between recent working papers • Cross-referencing working papers • Linking outside the project • Looking at the structure or index • Reviewing the project

12. Audit evidence • Establishing consistent working paper reference approach • Creating an index • Cross referencing • Linking electronic evidence • Marking electronic evidence • Creating electronic evidence from hard copy

13. Issues and Queries • Raising issues and queries • who, when and current status • Reviewing outstanding issues and queries • Clearing queries • who and when • cause and effect • Converting queries into reportable issues • Reporting

14. Recommendations • Setting in context • linking to findings/conclusions • evaluation of consequences (risk) • Reviewing • Reporting • Summarising • creating an action plan

15. Report writing • Ensure all issues are considered • Reviewing elements to report • opportunity to say ‘No’ • opportunity to edit • opportunity to set findings in context • opportunity to establish an appropriate order • Establish an audit trail to findings • Editing final report in suitable package

16. Team working • Multi-user functionality • strategic approach • access controls • Mechanics • user hierarchies • replication • communication • conflict resolution • Rules and procedures • access to guidance and standard work papers

17. Printing out and Indexes • Preview print layout • adaptable layout • page numbering • dating • Must be easy to print out • Clear headings and source identity • Should have printable index

18. Improving standards • Structure and approach • logical structures and planning • sound review procedures • clear reporting logic • Guidance • variety of guidance approaches • access to analytical tools • ease of incorporation into package • ease of access to user

19. Improving standards • Working papers • presentation and layout • on screen and as printed • logic and completeness • cross-referencing • corroborative proof

20. Storage • What to store • working papers • corroborative evidence • report • When (and for how long after that) • during audit • at audit review • after completion

21. Storage • Who needs access • audit department • auditees • senior management • other review bodies • Method of storage (other than paper) • electronic (including compressibility) • hard disc • CD ROM or other remote storage • micro fiche

22. Storage • Methods of conversion • scanners • digital photography • micro-fiche service or other external conversion • Associated time and costs • processing costs • ongoing storage costs • administration costs • purchase of specialized viewers or software

23. Communication • Internal – within Audit unit • common frame work and points of reference for improvement • better access to knowledge base • External • enhances presentation and consistency • ensures adequacy of scope and logic • can be a source of summarized evidence

24. Security • Traditionally audit is secretive • EWP has little direct impact • time to review our traditional approach? • Sarbanes-Oxley Act in US requires storage of audit reports intact • custodial sentences for directors for failure to comply • To maintain audits in unaltered state burn on to CD ROM

25. Commissioning process • Organization and security of audit directories • Preparation and incorporation of standard audit tests and schedules, templates, audit tools etc. • Training in package environment and detailed use • referencing and cross-referencing • queries and recommendations • review processes • report writing • Training in multi-user operation, replication, user hierarchies etc.

26. Commissioning – the audit detail • General audit guidance and instructions • Existing ICQs, testing schedules and access to analytical tools • incorporation within the EWP package • how to convert them (if required) • programme of conversion • Establishing appropriate layouts and standards

27. Case for EWP – reappraised • Saving time • needs effort and practice, but significant savings are possible especially in the reviewing and reporting parts of the auditing cycle • Improving standards • provides a very valuable framework for introducing improvements • real improvements generated in the commissioning process – very important

28. Case for EWP – reappraised • Reducing storage • long-term reductions can be achieved with relative ease • short-term reductions need careful consideration in context of audit approach and the handling of corroborative evidence • Facilitating communication • sound framework for internal improvements

29. Case for EWP – reappraised • Security considerations • encourages effective review of organization-wide network security issues • electronic format permits secure and economic storage • Ancillary advantages • encourages real understanding of nature of applications and their control

30. Summary • Be clear on what to automate - affects product choice • Look for good fit with current and future audit practice and technical environment • Make sure that the EWP standard functionality is what you want • Consider carefully storage implications • Commissioning effort, lead times and product support are important

31. Suppliers