Data Analytics for Internal Auditors

440 Pages·2017·7.96 MB·English

by  Richard E. Cascarino

Data Analytics
for Internal Auditors
Internal Audit and IT Audit
Series Editor: Dan Swanson
Cognitive Hack: The New Battleground in Internal Audit Practice from A to Z
Cybersecurity ... the Human Mind Patrick Onwura Nzechukwu
James Bone ISBN 978-1-4987-4205-4
ISBN 978-1-4987-4981-7
Leading the Internal Audit Function
Lynn Fountain
The Complete Guide to Cybersecurity
ISBN 978-1-4987-3042-6
Risks and Controls
Anne Kohnke, Dan Shoemaker,
Mastering the Five Tiers
and Ken E. Sigler of Audit Competency:
ISBN 978-1-4987-4054-8 The Essence of Effective Auditing
Ann Butera
Corporate Defense and the Value
ISBN 978-1-4987-3849-1
Preservation Imperative:
Bulletproof Your Corporate Operational Assessment of IT
Defense Program Steve Katzman
Sean Lyons ISBN 978-1-4987-3768-5
ISBN 978-1-4987-4228-3
Operational Auditing:
Principles and Techniques for
Data Analytics for Internal Auditors
a Changing World
Richard E. Cascarino
Hernan Murdock
ISBN 978-1-4987-3714-2
ISBN 978-1-4987-4639-7
Ethics and the Internal Auditor’s
Practitioner’s Guide to Business Impact
Political Dilemma:
Analysis
Tools and Techniques to Evaluate
Priti Sikdar
a Company’s Ethical Culture
ISBN 978-1-4987-5066-0
Lynn Fountain
ISBN 978-1-4987-6780-4 Securing an IT Organization through
Governance, Risk Management,
A Guide to the National Initiative and Audit
for Cybersecurity Education (NICE) Ken E. Sigler and James L. Rainey, III
Cybersecurity Workforce ISBN 978-1-4987-3731-9
Framework (2.0)
Security and Auditing of Smart Devices:
Dan Shoemaker, Anne Kohnke,
Managing Proliferation of Confidential Data
and Ken Sigler
on Corporate and BYOD Devices
ISBN 978-1-4987-3996-2
Sajay Rai, Philip Chukwuma,
and Richard Cozart
Implementing Cybersecurity:
ISBN 978-1-4987-3883-5
A Guide to the National Institute
of Standards and Technology Risk Software Quality Assurance:
Management Framework Integrating Testing, Security, and Audit
Anne Kohnke, Ken Sigler, and Dan Shoemaker Abu Sayed Mahfuz
ISBN 978-1-4987-8514-3 ISBN 978-1-4987-3553-7
Internal Audit and IT Audit
Series Editor: Dan Swanson
Cognitive Hack: The New Battleground in Internal Audit Practice from A to Z
Data Analytics
Cybersecurity ... the Human Mind Patrick Onwura Nzechukwu
James Bone ISBN 978-1-4987-4205-4
ISBN 978-1-4987-4981-7
Leading the Internal Audit Function for Internal Auditors
Lynn Fountain
The Complete Guide to Cybersecurity
ISBN 978-1-4987-3042-6
Risks and Controls
Anne Kohnke, Dan Shoemaker,
Mastering the Five Tiers
and Ken E. Sigler of Audit Competency:
ISBN 978-1-4987-4054-8 The Essence of Effective Auditing
Ann Butera
Corporate Defense and the Value
ISBN 978-1-4987-3849-1
Preservation Imperative:
Bulletproof Your Corporate Operational Assessment of IT
Defense Program Steve Katzman
Sean Lyons ISBN 978-1-4987-3768-5
ISBN 978-1-4987-4228-3
Operational Auditing:
Data Analytics for Internal Auditors Principles and Techniques for Richard E. Cascarino
a Changing World
Richard E. Cascarino
Hernan Murdock
ISBN 978-1-4987-3714-2
ISBN 978-1-4987-4639-7
Ethics and the Internal Auditor’s
Practitioner’s Guide to Business Impact
Political Dilemma:
Analysis
Tools and Techniques to Evaluate
Priti Sikdar
a Company’s Ethical Culture
ISBN 978-1-4987-5066-0
Lynn Fountain
ISBN 978-1-4987-6780-4 Securing an IT Organization through
Governance, Risk Management,
A Guide to the National Initiative and Audit
for Cybersecurity Education (NICE) Ken E. Sigler and James L. Rainey, III
Cybersecurity Workforce ISBN 978-1-4987-3731-9
Framework (2.0)
Security and Auditing of Smart Devices:
Dan Shoemaker, Anne Kohnke,
Managing Proliferation of Confidential Data
and Ken Sigler
on Corporate and BYOD Devices
ISBN 978-1-4987-3996-2
Sajay Rai, Philip Chukwuma,
and Richard Cozart
Implementing Cybersecurity:
ISBN 978-1-4987-3883-5
A Guide to the National Institute
of Standards and Technology Risk Software Quality Assurance:
Management Framework Integrating Testing, Security, and Audit
Anne Kohnke, Ken Sigler, and Dan Shoemaker Abu Sayed Mahfuz
ISBN 978-1-4987-8514-3 ISBN 978-1-4987-3553-7
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2017 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed on acid-free paper
Version Date: 20161122
International Standard Book Number-13: 978-1-4987-3714-2 (Hardback)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts
have been made to publish reliable data and information, but the author and publisher cannot assume
responsibility for the validity of all materials or the consequences of their use. The authors and publishers
have attempted to trace the copyright holders of all material reproduced in this publication and apolo-
gize to copyright holders if permission to publish in this form has not been obtained. If any copyright
material has not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, trans-
mitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereaf-
ter invented, including photocopying, microfilming, and recording, or in any information storage or
retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www. copyright
.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood
Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and
registration for a variety of users. For organizations that have been granted a photocopy license by the
CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
About the Author xiii
IntroductIon xv
chApter 1 IntroductIon to dAtA AnAlysIs 1
Benefits to Audit 2
Data Classification 5
Audit Analytical Techniques 7
Data Modeling 7
Data Input Validation 8
Getting the Right Data for Analysis 9
Statistics 11
chApter 2 understAndIng sAmplIng 15
Population Sampling 15
Sampling Risk 17
General Advantages 20
Planning the Audit 20
Data Analysis Objectives 21
Characteristics of Populations 21
Population Variability and Probability Distributions 22
Binomial Distributions 22
Poisson Distribution 23
Continuous Probability Distributions 24
Normal Distribution 24
Uniform Distributions 25
Exponential Distribution 26
Central Tendency and Skewed Distributions 26
Population Characteristics 27
v
vi Contents
chApter 3 JudgmentAl versus stAtIstIcAl sAmplIng 29
Judgmental Sampling 29
The Statistical Approach 31
Sampling Methods 31
Calculation of Sample Sizes 36
Attribute Sampling Formula 36
Classic Variable Sampling Formula 38
PPS Sampling Formula 38
Selecting the Sample 40
Interpreting the Results 41
Nonparametric Testing 42
Confusing Judgmental and Statistical Sampling 43
Common Statistical Errors 43
chApter 4 probAbIlIty theory In dAtA AnAlysIs 45
Probability Definitions 45
Classical Probability 46
Empirical Probability 47
Subjective Probability 48
Probability Multiplication 48
Conditional Probability 48
Bayes’ Theorem 50
Use in Audit Risk Evaluation 51
Other Uses 52
Financial Auditing 52
Overstatement of Assets 53
Probability Distributions 53
chApter 5 types of evIdence 55
Influencing Factors 55
Quantity Required 57
Reliability of Evidence 57
Relevance of Evidence 58
Management Assertions 58
Audit Procedures 59
Documenting the Audit Evidence 60
Working Papers 60
Working Paper Types 60
Contents of Permanent File 62
Contents of Current File 63
Selection 63
Client Background 63
Internal Control Descriptions 64
Audit Program 64
Results of Audit Tests 64
Audit Comment Worksheets 65
Report Planning Worksheets 65
Copy of the Audit Report 65
Contents vii
Follow-Up Program 65
Follow-Up of Prior Audit Findings 66
Audit Evaluation 66
Ongoing Concerns 66
Administrative/Correspondence 66
General Standards of Completion 66
Cross-Referencing 66
Tick Marks 67
Notes 68
Working Paper Review 68
General Review Considerations 69
Working Paper Retention/Security 70
chApter 6 populAtIon AnAlysIs 71
Types of Data 71
Correspondence Analysis 72
Factor Analysis 72
Populations 74
Sampling Error 75
Central Tendency 76
Variation 77
Shape of Curve 80
chApter 7 correlAtIons, regressIons, And other
AnAlyses 83
Quantitative Methods 83
Trend Analysis 83
Chi-Squared Tests 85
Correspondence Analysis 86
Cluster Analysis 86
Graphical Analysis 88
Correlation Analysis 88
Audit Use of Correlation Analysis 90
Learning Curves 91
Ratio and Regression Analysis 92
The Least Squares Regression Line 93
Audit Use of Regression Analysis 94
Linear Programming 94
Parametric Assumptions 96
Nonparametric Measurement 96
Kruskal-Wallis Analysis of Variance (ANOVA) Testing 96
chApter 8 conductIng the AudIt 99
Audit Planning 99
Risk Analysis 100
Determining Audit Objectives 104
Compliance Audits 105
Environmental Audits 106
viii Contents
Financial Audits 106
Performance and Operational Audits 107
Fraud Audits 107
Forensic Auditing 108
Quality Audits 110
Program Results Audits 110
IT Audits 111
Audits of Significant Balances and Classes of Transactions 112
Accounts Payable Audits 114
Accounts Receivable Audits 115
Payroll Audits 116
Banking Treasury Audits 116
Corporate Treasury Audits 117
chApter 9 obtAInIng InformAtIon from It systems
for AnAlysIs 119
Data Representation 119
Binary and Hexadecimal Data 119
Binary System 119
Hexadecimal System 119
ASCII and EBCDIC 120
Fixed-Length Data 120
Delimited Data 121
Variable-Length Data 121
Databases 121
Definition of Terms 122
Principals of Data Structures 123
Database Structuring Approaches 123
Sequential or Flat File Approach 123
Hierarchical Approach 124
Network Approach 124
Relational Model 125
Data Manipulation 125
Terminology 126
Big Data 126
The Download Process 128
Access to Data 129
Downloading Data 129
Data Verification 130
Obtaining Data from Printouts 131
Sanitization of Data 131
Documenting the Download 132
chApter 10 use of computer-AssIsted AudIt
technIques 135
Use of CAATs 135
Standards of Evidence 136
Test Techniques 137
Contents ix
Embedded Audit Modules (SCARFs—System Control
Audit Review Files) 139
CAATs for Data Analysis 139
Generalized Audit Software 141
Application- and Industry-Related Audit Software 143
Customized Audit Software 144
Information Retrieval Software 144
Utilities 144
Conventional Programming Languages 144
Common Problems 145
Audit Procedures 146
CAAT Use in Non-Computerized Areas 147
Getting Started 147
CAAT Usage 149
Finance and Banking 150
Government 151
Retail 154
Services and Distribution 155
Health Care 155
General Accounting Analyses 157
chApter 11 AnAlysIs of bIg dAtA 159
Online Analytical Processing (OLAP) 161
Big Data Structures 162
Other Big Data Technologies 164
Hive 167
Statistical Analysis and Big Data 167
R 168
chApter 12 results AnAlysIs And vAlIdAtIon 171
Implementation of the Audit Plan 172
Substantive Analytical Procedures 173
Validation 175
Data Selection Bias 177
Questionnaire Analysis 177
Use of Likert Scales in Data Analysis 178
Statistical Reliability Analysis 179
chApter 13 frAud detectIon usIng dAtA AnAlysIs 181
Red Flags and Indicators 181
Pressure Sources 181
Changes in Behavior 182
General Personality Traits 182
Nature of Computer Fraud 184
Computer Fraud Protection 185
Cloud Computing 186
Information Fraud 187
Seeking Fraud Evidence 188