Tiffany Martin is an audit manager in a medium- size public accounting firm. Tiffany graduated from college seven years ago with a degree in accounting. She obtained her CPA certification soon after she joined the firm where she currently works. Tiffany is a financial auditor; she has had little training in auditing computerized information systems. The current engagement Tiffany is working on includes a complex information process-ing system with multiple applications. The financial accounting transactions are processed on an AS/ 400 minicomputer. The IT department employs 25 personnel, including program-mers, systems analysts, a database administrator, computer operators, technical support personnel, and a director. Tiffany has not spoken with anyone in the department because she is fearful that her lack of technical knowledge relative to IT will cause some concern with the client. Because Tiffany does not understand the complexities of the computer processing environment, she is unable to determine what risks might result from the computerized system’s operations. She is particularly worried about unauthorized changes to programs and data that would affect the reliability of the financial statements. Tiffany has spoken to Dick Stanton, the partner who has responsibility for this audit client, about her concerns. Dick has suggested that Tiffany conduct more substantive testing than she would undertake in a less complex processing environment. This additional testing will hopefully ensure that there are no errors or fraud associated with the computer processing of the financial statements.
Requirements
1. Do you think that Dick Stanton’s suggested approach is the most efficient way to control risks associated with complex computer environments?
2. How should Tiffany respond to Dick’s suggestion?
3. What can a public accounting firm, such as the one in which Tiffany works, do to ensure that audits of computerized accounting information systems are conducted efficiently and effectively?
4. Should Tiffany be allowed to conduct this audit given her limited level of skills? How might she acquire new skills?