The Complexity of Investigation Procedure in a Computer Related Embezzlement

In the early days of computer auditing auditors tended to see the computer as a black and somewhat mysterious box into which output was ejected and distributed at the other side. Audit activity was concentrated on ensuring that the source documentation (the basis of input) was subjected to proper controls outside the computer room to ensure it was genuine, accurate and complete (we still do this of course). The output was subject to the normal analytical review techniques and, on a test basis, was compared with the input documentation (and vice versa), with other records kept internally and with external evidence. What happened in the actual computer processing was largely ignored, the approach being known as auditing round the computer. In comparing output with input, the auditor used control totals kept by the data control section as a guide, but had little further contact with the EDP installation and its staff. To some extent this approach was acceptable in the early stages of computer development, as the computer was used in many instances as though it was a fast and reliable human being, rather than in the integrative manner that it is today. In the mid-1960s, computer processing was normally off-line and was broken down into a number of runs, which made it easier to maintain the information/audit trail: Today, however, computer systems are complex, processing is often-on-line and/or in real time and this may mean that no audit trail exists. As computer system developed in complexity, auditors moved towards an 'Auditing through the computer approach. When the auditor audits through the computer, the computer is seen as a tool in the hands of the auditor and the audit is said to be computer assisted. Generally, the computer may be used for: * Testing the system itself and the manner in which the computer processes data (tests of control); * Testing the data (transactions and balances) held on computer file (substantive tests of detail). If the auditor intends to use the computer, it will make the audit planning stage more important, as computer files and programmes are not retained indefinitely and because of the need to negotiate with management for use of computer time for audit purposes