When audit engagement teams use applications to perform an audit, these applications are referred to as software audit tools by regulators and professionals. Software audit tools include a wide range of applications that perform many different individual functions throughout the audit process. In fact, during the recent AICPA SEC/PCAOB update conference, George Botic, Director of the Division of Registration and Inspections for the PCAOB, discussed a common tool auditors have been using for years: www.confirmation.com. Mr. Botic went on to note recent issues that have been identified as part of the PCAOB inspection program that engagement teams were not appropriately following the standards regarding confirmations when using tools like conformation.com. During the PCAOBs presentation in the conference room chat, many participants submitted or promoted questions around this issue. One of the more popular questions that went unanswered was “what procedures should we be performing when we use Confirmation.com?”
After the conference, JGA fielded many questions from our clients and friends on engagement teams and in firm national office roles. Teams wondered why this is now an issue as they have used Confirmation.com for years and on engagements that had previously gone through PCOAB inspection without an issue in this area. While the standards have not changed in many years, the PCAOB noted in their presentation that the confirmation standard was still relevant. We submit that “relevant” is based on your perspective. For example, when was the last time you sent a facsimile? Audit staff may not know what standard related to facsimiles of audit confirmations and how those aspects of the standards remain relevant today.
Regardless of the unanswered questions, age of the current standards, or your opinion on the issues written by a PCAOB inspection team; audit firms, engagement partners, and engagement team members should follow the current audit standards when using applications in the audit process. At JGA, we work with firms to develop and implement policies and procedures and other elements of the software audit tool control environment that support engagement team’s use of software audit tools throughout the audit process.
What Are Software Audit Tools?
Software audit tools are applications, utilities, or code (e.g., macros, queries, stored procedures, report logic) that process, analyze, calculate, or manipulate data to support an engagement team’s audit procedures. Software audit tools can be used throughout the audit in:
Certain applications like Excel or Access are not software audit tools on their own but may be used to develop a software audit tool using formulas, macros, code, queries, or other features that process, analyze, calculate, or manipulate data to support an engagement team’s audit procedures.
Common Software Audit Tools
Software audit tools can be used in all areas of the audit and within the audit practice. While most auditors are familiar with audit documentation tools and tools that sort and filter populations of data for testing, more advanced tools are continually being introduced that are used by audit firms to further accelerate audit transformation.
Risks Associated with Software Audit Tools
Now that we have explained software audit tools and how they can be used in the audit process, let’s discuss why software audit tools present risks within the audit process. The following risks are often present when considering the use of software audit tools:
As you work through understanding how engagement teams are using software in the audit process, unique risks specific to each software will be identified. Reviewing audit files and the related testing is a fantastic way to understand the wide range of use of software to identify all the risks across the practice. The controls that address these risks, which are discussed in the next section, most often include engagement team procedures as well as centralized procedures performed by the national office (or other centralized group).
Software Audit Tool Control Environment
Given the risks that software audit tools present within the audit process, audit firms should begin to implement controls specific to these risks. The methodology that JGA recommends is to start with engagement-specific controls and add more complex controls as the software audit tools environment within the firm matures. The following six steps cover the key components of the software audit tool control environment:
Step 1: Software Inventory
First, identify all the tools currently being used throughout the firm through discussions with the national office, regional leaders, specialists, engagement partners, and others who may be using tools in the audit process. For each tool, collect all the relevant information about the software and how it is used in the audit process.
Step 2: Engagement Team Process
Next, the first controls to put into place should be developing and implementing policies and procedures for engagement teams using software audit tools. Before national office or other firm-wide processes and procedures are in place, engagement teams should understand their responsibility for ensuring the risk associated with software audit tools are addressed by the engagement team.
Step 3: National Office Process
The audit firm’s National Office (or centralized group) should develop and implement policies and procedures for the certification of certain tools that can be used by engagement teams and other resources used in the audit process. The certification process includes the identification of the risks and controls associated with each software tool and a centralized testing approach for assessing the design and operating effectiveness of each control.
Step 4: Certification Process
Once the policies and procedures are in place, the selected tools should go through the certification process. Then, the controls should be tested. Any control weaknesses should be evaluated to determine if the software audit tool should be certified for use by engagement teams or others involved in the audit process. When a software audit tool is certified, engagement teams should be able to rely on the controls tested by the National Office without testing those controls for each engagement. Note that engagement teams are still responsible for certain controls such as the completeness and accuracy of the information input into the software audit tool and the parameters or other settings used within the software audit tool by the engagement team.
Step 5: Monitoring Process
Once the tools are certified, the audit firm should develop risk-based monitoring procedures to ensure the ongoing effectiveness of the controls supporting each software audit tool. Monitoring may include certain periodic tests, change controls, periodic recertification, and the certification of new software versions or new software audit tools implemented by the firm.
Step 6: Future Tool Planning
Future software audit tool planning is an important activity at anytime during the process. Once the software audit tool is in place the audit firm can develop a roadmap for the development and implementation of future software audit tools. Future audit tool planning includes an evaluation of the capabilities the firm wants to develop within its audit practice, and ensure it has the people, process, and technology resources in place to achieve those capabilities. As the capability gaps are identified, the audit firm can create a roadmap and process to ensure tools are developed, acquired, tested, and certified prior to implementing them throughout the firm.
Software Audit Tool Maturity Model
When developing the software audit tool roadmap, audit firms should assess where they are within the software audit tool maturity model and determine the capabilities the firm needs to add over the next five to seven years. The use of software audit tools is important to improve the quality and efficiency within the audit process, but the effective use of software audit tools is also a competitive advantage for firms within the audit and assurance industry.
As an audit firm progresses in the software audit tool maturity model, the more the audit firm will need to develop supporting people, process, and technology resources to support these new capabilities. A common struggle audit firms encounter is the quality and availability of quality data. More advanced software audit tools require more investment in supporting infrastructure, data management, and technology resources to ensure quality data is readily available.
Getting Started
Addressing all the considerations regarding software audit tools may seem overwhelming, but the full implementation of the software audit tool control environment can be implemented over time. JGA recommends the following four-step process for getting started:
Once these initial steps are completed, the audit firm can formalize its monitoring program and recertification process as it continues to develop new software audit tool capabilities.
Conclusion
Given the recent PCAOB’s comments and our work with firms on designing their systems of quality management under ISQM 1 or SQMS 1, software audit tools continue to be a hot topic with regulators and standard setters. This is no surprise as audit firms continue to add software audit tool capabilities to their audit processes. The effort required to implement a mature software audit tool takes considerable time and resources. Get started by taking inventory of the software your engagement teams are using and how they are used to support the audit process.
Joe Lynch has over 25 years of experience in technology, audit, and audit quality compliance with a focus on technology. At JGA, Joe is the IT Audit Advisory Services Leader and works with internal auditors, public and private companies, and regional and national mid-market public accounting firms to implement and to integrate technology into financial processes and improve the audit integration of engagement teams performing integrated audits and service organization reports. He also provides critical input to IT-specific requirements related to new QC standards implementation.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084