Computers touch an audit in two ways. The auditor uses them to do the work, and the client uses them to keep its accounts. The second matters more. When processing happens inside a computer, there may be no paper trail, and the auditor must test the system itself and not only its inputs and outputs.
This topic covers the auditor’s own use of computers, the general and application controls found in computer-based systems, the special problems of microcomputer, on-line and EDI systems, and computer-assisted audit techniques (CAATs). Examiners ask you to list controls for a system, to explain how CAATs work and what they cost, and to say what makes an on-line or EDI system hard to audit.
The wider question of information technology (IT) in the audit process, which appeared in November 2025, is developed in later topics on the impact of IT on audit.
In 30 seconds
Computers affect an audit because the auditor may use them to perform the work, and because the client’s accounting system may be computer-based, in which case the auditor must consider its controls and whether to use CAATs. Controls in a computer-based system are of two kinds. General controls cover the environment in which the systems are developed, operated and maintained.
They cover system development, program changes, prevention of unauthorised program changes, prevention of wrong programs or data files being used, prevention of unauthorised changes to data files and continuity of operations. Application controls are specific to each application, such as payroll, and cover input, processing, and master files and standing data. Weak general controls make it unlikely that processing is complete and accurate.
Microcomputer, on-line and EDI systems need special attention. CAATs are of two common types, audit software and test data, and embedded audit facilities allow tests in real time. CAATs should be used only if the benefits exceed the costs.
How computers affect an audit
Computer systems affect the audit process in two ways.
- The auditor may use computers to do the audit work.
- The client’s accounting systems may be computer-based. If so, the auditor must consider the controls in the system and whether they are effective, and whether to use CAATs for some of the work.
Both are considered at the planning stage.
Using computers to do the audit
Audit team members usually take laptops to the client’s premises. They use them for:
- audit administration and control, such as timesheets and work programmes;
- audit planning, such as risk and materiality assessments;
- preparing working papers;
- analytical procedures, including a record of the client’s statistics and ratios from earlier years; and
- sampling software, if suitable.
Managers and partners can review work without visiting the client, because papers can be sent by e-mail. This saves travelling time.
Controls over the auditor’s own computer systems
When the audit is done largely on computers, the auditor needs the controls that apply to any computer application. They should ensure that:
- client data stays confidential and cannot be seen by an unauthorised person;
- audit work held on file cannot be lost;
- an audit trail exists for the work done, to help review and control; and
- programs work as expected.
Controls in computer-based systems
In a computer-based system, internal controls consist of manual procedures, such as locking a room, and procedures built into programs, such as passwords. They fall into two categories, general controls and application controls. The auditor needs to be satisfied that both are effective.
General controls
General controls are controls over the environment in which the computer-based information system is designed, developed, operated and maintained. They apply to most or all of the entity’s applications, not just the accounting system.
| Control area | Typical controls |
|---|---|
| Development of systems and applications | Standards for designing, developing, programming and documenting each new system. Testing of each new system. Formal approval of the design by the user’s management. Segregation of duties between designers and testers. Staff training |
| Documentation and testing of program changes | Formal testing of any change to a current program. Formal authorisation of changes. Training of staff in making and testing changes |
| Prevention or detection of unauthorised program changes | Segregation of duties between programmers and operators. Full documentation of changes. Restricted access to program files. Program logs recording access. Anti-virus software and back-up copies of program files |
| Prevention of use of wrong programs or data files | Standard operating procedures and trained operators. Job scheduling that specifies the program and data files to be used. Supervision of computer operations. Regular management review of operations |
| Prevention of unauthorised changes to data files | Restricted access to authorised staff. Transaction logs of all uses of data files, reviewed by management |
| Continuity of operations | Secure back-up copies of program and data files. Protection of equipment against fire, power failure and other hazards. Disaster recovery plans. Maintenance and service agreements for bought software |
If general controls are weak, it is unlikely that the system’s processing is complete and accurate. The auditor reviews and tests general controls to reach a conclusion on their effectiveness, and this lets the auditor assess the control risk of the entity’s computer-based systems.
Background: International Standard on Auditing (ISA) 315 (Revised 2019) groups general IT controls around four themes: access to programs and data, program changes, program development and IT operations. They match the list above, so you can use either framing in an exam answer.
Application controls
Application controls are specific to each computerised application, such as inventory, receivables and payroll. They are meant to give assurance that processed transactions have been properly authorised, and that processing is complete, accurate and timely. The detail varies by application, but they share common features. The auditor puts great emphasis on controls over input, because if the input is wrong, the output cannot be right.
| Control area | Typical controls |
|---|---|
| Input: authorisation | Data authorised before input. Data input only by authorised personnel |
| Input: completeness | Document counts, control totals, checking output to input, and review of output against expected values (for example, whether total payroll cost is in line with expectation) |
| Input: accuracy | Data validation checks in the software: check digits on key codes such as customer and employee numbers, range checks, existence checks. Review and reconciliation of output, and control totals |
| Processing | Checks that all input has been processed: control totals, batch totals (the computer counts items in a batch and the count is compared with a manual record), manual review, and an on-screen warning if processing is incomplete |
| Master files and standing data | Management review of master files and standing data. Regular updating. Record counts |
The auditor reviews the application controls in each application to decide whether they are effective on paper. Tests of controls then show whether they operate effectively in practice.
Microcomputer, on-line and EDI systems
Many organisations use decentralised systems instead of a central mainframe. Stand-alone computers or networks are operated by people who are not IT specialists. These are often efficient for the client, but they create extra problems for the auditor, who must be satisfied that the controls work. Three types need special attention.
Microcomputer systems
A microcomputer system is a set of stand-alone desktop computers spread through the organisation. It is often cheaper and easier to run than a mainframe. For the auditor, the problems are:
- difficulty in ensuring physical security of the equipment;
- difficulty in ensuring the security of data and storage media;
- access by many people, some unauthorised, with a risk of unauthorised changes to programs or data. Passwords and user names limit the risk;
- programs may be written or changed by the user, which creates control risks over processing and software. In an extreme case, the accounting data may not be usable by the auditor; and
- software may lack adequate documentation, which the user then has to write.
On-line systems
On-line systems are networks that give users direct access to centrally held data and programs through remote terminals. They allow transactions to be entered immediately from many places, update central master files at once, and give immediate answers to enquiries. Because transactions are processed as soon as they are input, the controls matter more.
General controls in an on-line system include controls over access to the system and its files, controls in the system software to prevent or detect unauthorised program changes, transaction logs to create an audit trail, and firewalls for systems connected to the Internet. An audit trail is the ability to trace a transaction through all its processing stages.
It may not exist on paper, so the program must be written to produce it on request.
Application controls include pre-processing authorisation (log-on, user names and passwords), data validation checks such as the right number of digits in a product code. “balancing”, which is checking control totals of data sent from remote terminals before and after processing.
Electronic data interchange (EDI)
EDI is the electronic transmission of business documents, such as invoices or payroll data, between computer systems. The system translates data from one computer into a form that another can read without human intervention. It may work inside the organisation, for example between sales and accounts, or outside it, for example sending payroll data to an agency or purchase orders to a supplier.
The problems for the auditor are:
- no paper audit trail;
- greater dependence on the entity’s computer systems and possibly those of others, so a failure in one affects the other;
- risk of loss or corruption of data in transmission; and
- security risks in transmission.
Auditors should expect controls over the transmission of data (encryption, acknowledgement and authentication codes for senders), monitoring and checking of output, virus protection, and contingency plans and back-up arrangements.
Computer-assisted audit techniques
CAATs are techniques that let the auditor use computer systems to generate audit evidence. They are often needed because a computer-based system may give no adequate audit trail, and because processing is invisible. The auditor must “get inside the computer” to check that processing is complete and accurate. Two common types are audit software and test data.
Audit software
Audit software is programs the auditor uses to extract information from the client’s system. The main types are:
- interrogation programs, which access the client’s files and extract data;
- interactive software, for interrogating on-line systems; and
- resident code or embedded software, which monitors transactions as the client’s programs process them. This is an embedded audit facility.
It is used mainly for substantive testing. Examples are extracting all items above ₦50,000 from the repairs expense account, producing an aged list of receivables where the client does not, and calculating ratios and comparisons for analytical procedures.
Test data
The auditor processes a sample of transactions through the client’s system and compares the output with results already worked out. Test data is used mainly for tests of controls and gives evidence that specific application controls operate effectively. Its weakness is that it shows how the system works only at the time the data is processed. It cannot show that controls operate at any other time. Embedded audit facilities deal with this.
Embedded audit facilities
An embedded audit facility, also called resident audit software or an integrated audit module, is audit software built into the client’s system, temporarily or permanently. It allows tests to be carried out in real time, as transactions are processed. Procedures written into the system produce data for audit every time the system runs.
To avoid corrupting operational files with test data, a dummy department is usually set up, and only the auditor has access to its data. These facilities are most useful for on-line systems where data is processed all the time and master files are always being updated, or where the system cannot provide a satisfactory audit trail.
Advantages and disadvantages
| Advantages | Disadvantages (costs) |
|---|---|
| Test the completeness and accuracy of the electronic processing itself, not only inputs and outputs | Buying or developing the programs |
| Test a large number of transactions in a short time, which reduces overall audit risk | Keeping the programs up to date with changes in hardware and software |
| Test the effectiveness of controls programmed into the software | Training staff, because CAATs are of no value unless auditors can use them |
| Obtaining time on the client’s computers to run them |
CAATs should be used only if the benefits exceed the costs.
COBIT in the syllabus
The syllabus describes Control Objectives for Information and Related Technologies (COBIT) at the end of this section, as an accepted framework that may give the auditor extra assurance over a client’s information system. That description is of the third edition, with four domains and 34 IT processes.
The later topic on governance, risk and compliance (GRC) software and COBIT covers COBIT 2019 in full, and you should learn the 2019 version for the exam.
The rules in more depth
Why general controls come first
General controls are the foundation. If programs can be changed without authority, or anyone can alter data files, then an application control that looks good may be bypassed or altered. The auditor therefore tests general controls before relying on application controls.
Why input controls are stressed
A computer processes what it is given. Wrong or incomplete input produces wrong output, however good the program. Authorisation, completeness and accuracy checks at input are the cheapest place to catch errors.
Why a lack of paper changes the audit
In a manual system, the auditor can follow documents. In an EDI or on-line system there may be none. The auditor must then rely on logs and on CAATs, and must test the controls that create the trail. If the controls fail, substantive procedures alone may not give enough evidence.
Why test data has a time limit
Test data shows what the system does when the test is run. A program could be changed later. This is why auditors use embedded audit facilities, or combine test data with tests of program change controls.
Worked example: controls over a computerised payroll
Scenario. Olu Retail Ltd processes the payroll for 400 staff on a computer. Any member of the finance team can open the payroll data files. The programmer who maintains the payroll program also runs the monthly payroll. Staff hours are keyed in by supervisors without any total being agreed. Required: identify general and application control weaknesses, suggest controls and say how the auditor might use CAATs.
| Weakness | Type | Control |
|---|---|---|
| Anyone in finance can open the data files | General: unauthorised changes to data files | Restrict access to authorised staff by password. Keep transaction logs and have management review them |
| The programmer also runs the payroll | General: program changes and operations | Segregate programmers and operators. Log and authorise program changes |
| Hours keyed in with no agreed total | Application: input completeness | Batch or control totals of hours, agreed before and after processing. Review of total payroll cost against expectation |
| No checks on employee numbers | Application: input accuracy | Check digits and existence checks on employee numbers. Range checks on hours |
CAATs. The auditor could use audit software to match the payroll file to the employee master file, list employees with unusually high pay or hours, and find duplicate bank accounts. Test data with invalid employee numbers and excessive hours would show whether the validation checks work. The costs of programs and training must be weighed against the benefits.
How to score full marks
- Split controls into general and application. Use the headings from the tables and give a control under each that fits the facts.
- For input controls, think authorisation, completeness and accuracy, with an example of each.
- For CAATs, name audit software and test data, say what each is used for, and give a cost-benefit warning.
- For on-line and EDI, name the loss of the paper audit trail, dependence on systems, security and the controls that answer them.
- For microcomputers, name physical security, data security, unauthorised access, user-written programs and documentation.
- Link to the audit. Say whether the auditor can rely on the controls and what this does to substantive testing.
- Time. Spend time in proportion to marks.
Common mistakes in the exam
- Mixing general and application controls.
- Listing controls with no link to the system in the question.
- Saying that test data proves controls work at all times.
- Forgetting the costs of CAATs.
- Forgetting that general controls come first.
- Describing the auditor’s own use of computers when the question asks about the client’s controls, or the reverse.
- Forgetting that the lack of a paper audit trail is the central problem in on-line and EDI systems.
Quick revision
- Two effects: the auditor uses computers, and the client’s systems are computer-based.
- General controls: development; program changes; unauthorised program changes; wrong programs or data; unauthorised data changes; continuity.
- Application controls: input (authorisation, completeness, accuracy), processing, master files and standing data.
- Microcomputers: security, access, user-written programs. On-line: access, logs, firewalls. EDI: no paper trail, dependence, transmission risk.
- CAATs: audit software (interrogation, interactive, embedded) and test data. Embedded facilities test in real time.
- CAATs: test the processing itself and many transactions; cost of programs, updating, training and computer time.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. Controls over the way IT systems are developed and operated are called:
- Application controls
- General controls
- Embedded controls
- Management controls
Show the answer
B. They apply to all IT applications in the entity.
Question 2. Controls specific to a computerised payroll or receivables system are:
- General controls
- Application controls
- Physical controls only
- Environmental controls
Show the answer
B. They cover input, processing and master files for that application.
Question 3. A check that a value lies within a realistic span is a:
- Check digit
- Range check
- Existence check
- Batch total
Show the answer
B. An existence check tests that a code exists.
Question 4. A check digit is used mainly on:
- Key code numbers such as customer or employee numbers
- Narrative descriptions
- Dates
- Profit figures
Show the answer
A. It detects keying errors in codes.
Question 5. The two common types of CAAT are:
- Audit data and test solutions
- Audit software and test data
- Bespoke systems and check sums
- Passwords and firewalls
Show the answer
B. Embedded audit facilities are a form of audit software.
Question 6. A weakness of test data is that it:
- Shows how the system works only at the time it is processed
- Cannot test controls
- Is used for substantive testing only
- Needs no preparation
Show the answer
A. Embedded audit facilities help to deal with this.
Question 7. An embedded audit facility allows the auditor to:
- Test transactions in real time as they are processed
- Avoid understanding the system
- Delete client data
- Skip general controls
Show the answer
A. It is built into the client’s system.
Question 8. A main audit problem with EDI is:
- Too much paper
- The lack of a paper audit trail
- Excess staff
- Low speed
Show the answer
B. There is also dependence on other systems and risk in transmission.
Question 9. A firewall is a control that:
- Prevents unauthorised access to a system from the Internet
- Counts documents
- Checks arithmetic
- Reconciles bank statements
Show the answer
A. It is a general control for on-line systems.
Question 10. CAATs should be used if:
- The auditor likes technology
- The benefits exceed the costs
- The client insists
- Never
Show the answer
B. The costs include programs, updating, training and computer time.
Written questions
Question 11 (10 marks). Distinguish general controls from application controls in a computer-based information system, giving examples of each.
Question 12 (20 marks). (a) Describe the types of computer-assisted audit technique. (6 marks) (b) Discuss the advantages and disadvantages of using CAATs. (6 marks) (c) Explain the problems for the auditor of microcomputer systems. (4 marks) (d) Describe the controls the auditor would expect over an EDI system. (4 marks)
Question 13 (10 marks). Eko Stores Plc takes sales orders on-line from customers and updates its inventory and receivables files immediately. Explain the audit problems this creates and the general and application controls the auditor would expect. (10 marks)
Model answers
Show the model answer to Question 11
General controls (5 marks). Controls over the environment in which the systems are designed, developed, operated and maintained. (1) They apply to most or all applications. (1) Examples: standards and testing for new systems (0.5); authorisation and testing of program changes (0.5); segregation between programmers and operators, restricted access to program and data files (1); back-up copies, disaster recovery and protection of equipment (1).
Application controls (5 marks). Controls specific to each application, such as payroll or receivables. (1) They give assurance that transactions are authorised and that processing is complete, accurate and timely. (1) Examples: input authorisation (0.5); completeness checks such as control totals and document counts (0.5); accuracy checks such as check digits, range and existence checks (0.5); processing checks such as batch totals (0.5); review of master files and standing data (1).
Show the model answer to Question 12
(a) Types (6 marks). CAATs are techniques that enable the auditor to use computer systems to generate audit evidence. (1) Audit software extracts information from the client’s system. It includes interrogation programs, interactive software for on-line systems, and embedded or resident code that monitors transactions as they are processed. (2) It is used mainly for substantive testing, for example account analysis, aged receivables lists and ratios.
(1) Test data is a sample of transactions processed through the client’s system, compared with expected results, and is used mainly for tests of controls. (1) Embedded audit facilities allow tests in real time, using a dummy department to protect live data. (1)
(b) Advantages and disadvantages (6 marks). Advantages:
- they test the processing itself and not only inputs and outputs (1)
- they test many transactions quickly, reducing audit risk (1)
- they test controls built into the software (1)
Disadvantages: cost of buying or developing programs (1); keeping them up to date (1); training staff and obtaining computer time (1). Use only where benefits exceed costs.
(c) Microcomputers (4 marks). Physical security of equipment is hard (1). Data and storage media are hard to secure (1). Many people have access, including unauthorised users, so programs and data may be changed (1). Users may write or change programs, and documentation may be poor (1).
(d) EDI controls (4 marks). Controls over transmission: encryption, acknowledgement and authentication codes (1); monitoring and checking of output (1); virus protection (1); contingency plans and back-up arrangements (1).
Show the model answer to Question 13
Audit problems (4 marks). Transactions are processed as soon as they are input, so access controls are vital. (1) There may be no paper audit trail. (1) The system is open to the Internet, creating security risks. (1) Master files are updated continuously, so the auditor may need real-time tests such as embedded audit facilities. (1)
General controls (3 marks). Controls over access to the system and its files (1); controls in the system software to prevent or detect unauthorised program changes (0.5); transaction logs to create an audit trail (1); firewalls for Internet access (0.5).
Application controls (3 marks). Pre-processing authorisation by log-on, user names and passwords (1); data validation checks, such as the right number of digits in a product code (1); balancing, which is checking control totals of data submitted from remote terminals before and after processing (1).
Pathfinder on computers in auditing and IT controls
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
The question asks how an auditor applies information technology in examining the statements of a crypto and payments company and in giving assurance over proof of reserves (10 marks), and the impact of blockchain (5 marks). The auditor’s uses of IT in planning, risk assessment, controls testing and reporting are covered in the later topics on IT in audit. This topic gives the controls and CAAT background those answers use.
Revise first: Computer-assisted audit techniques
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
