E-business risks, digital forensics and robotics in audit

E-business changes what can go wrong for a company, and so it changes what an auditor must look at. A shop that sells online can lose sales when its website goes down, lose customer data to a hacker, or lose money to card fraud. An auditor who cannot work through these risks cannot judge the client’s controls or its going concern position.

This topic covers three parts of the syllabus: the risks of e-business and how to address them, how digital forensics helps in a fraud investigation, and how robotics (robotic process automation, drones and smart glasses) is used in audit. Examiners ask for lists with short explanations, and they like scenarios such as a ghost workers allegation.

The earlier topics cover the wider impact of information technology (IT) on audit and governance, risk and compliance (GRC) software. The next topic covers data protection.

CAMA 2020: records, access and pressure on the auditor

CAMA 2020 does not mention e-business, forensics or robots. Its audit duties apply however the records are kept.

Background: Digital evidence must also meet the rules of evidence if it is to be used in court. In Nigeria, section 84 of the Evidence Act 2011 sets conditions for the admission of documents produced by a computer. This is from outside the Institute of Chartered Accountants of Nigeria (ICAN) syllabus, so treat it as background and check it before quoting.

Risks inherent in an e-business environment

E-business and e-commerce have grown fast across most sectors. ICAN lists seven risks that should interest governance, risk and compliance professionals.

How an organisation can address these risks

1. Hold regular IT awareness programmes for staff.
2. Put strong IT security policies in place, including a password protection policy.
3. Protect every device with anti-malware software and firewalls.
4. Collect and store only the customer data that is needed.
5. Update all software regularly.
6. Back up critical data and applications regularly.
7. Take out a cyber insurance policy.

For the auditor these risks matter in three ways. They affect the risk of material misstatement, for example unrecorded sales when the site is down. They affect the going concern assessment when the business depends on one platform. They create legal exposure that may need a provision or disclosure.

Digital forensics in fraud investigation

Digital forensics is the process of identification, extraction, preservation, examination and analysis of digital information that can be admitted as evidence in a court of law. It is the science of finding admissible evidence on electronic media such as computers, mobile phones, networks and servers. Most of its use worldwide is in resolving suspected crimes such as fraud.

Where it is used

• fraud investigations;
• intellectual property theft;
• bankruptcy investigations;
• forgery;
• inappropriate use of the corporate internet;
• industrial espionage; and
• contract disputes.

A digital forensic practitioner may be hired by a company or by a law enforcement agency. A corporate practitioner must follow the same procedures as law enforcement officers, because the work may be used in court whether the case is civil or criminal.

How it helps the auditor

• It helps the auditor identify, extract, analyse and preserve computer evidence so it can be presented in court.
• It can suggest the motive for the crime and who was involved.
• It helps to make sure the evidence obtained is not corrupted.
• It allows recovery of deleted files and deleted partitions from digital media.
• It allows evidence to be extracted and validated.
• It helps the auditor identify evidence quickly.
• It supports a computer forensic report that covers the whole investigation.
• It preserves evidence by following the chain of custody.

What it can achieve in a fraud case

• Find the actual time of the fraud.
• Find the exact amount lost.
• Identify those involved.
• Find where the fraud took place.
• Identify the control lapses that made it possible.
• Obtain evidence that a court will accept.

The six stages of a digital forensic investigation

1. Planning. Understand the purpose of the investigation, the resources needed, and what evidence exists, where it is and in what format. The auditor may build theories about the crime.
2. Collection and preservation. Collect the available information, then isolate, secure and preserve it.
3. Documentation and imaging. Record all the available data. Document the scene with photographs, images, sketches and maps.
4. Examination. Evaluate and inspect each item of information in detail, usually with advanced extraction and analysis tools.
5. Reporting. Prepare a report in plain language that sets out the procedures used and the conclusions reached.
6. Return of evidence. Give the information and devices back to their original location.

Procedures for an allegation of payments to ghost workers

1. Get the approval of the chief executive to start the assignment.
2. Understand and map the workflow for payroll transactions.
3. Arrange enough storage, possibly terabytes, and create a folder for each evidence type.
4. Obtain and scan all hard-copy payroll information to PDF.
5. Identify every electronic device used to process payroll.
6. Collect those devices and tag each item with a case number. Connect all hard drives to a write-blocker.
7. Use audit software such as ACL to match the names on the monthly payroll files to the names on the master file (the employee nominal roll).
8. Extract the event logs on each device and look into any unusual activity.
9. Run keyword searches on the payroll data, for example “delete”, “variance”, “no approval”, “difference”, “hired”, “sacked” and “leave”.
10. Obtain and review the payroll staff’s email messages, surveillance videos and CDs where available.

Advantages, disadvantages and challenges

The challenges that auditors face are the many types and brands of computers and phones, the huge storage on modern devices, the wide availability of advanced hacking tools for deleting information, the speed of technology change, and the lack of physical evidence, which makes prosecution hard in places with an old legal framework.

Computer robotics in the audit process

For three decades auditors have gained from spreadsheets, word processors, automated working papers and audit software. Even so, the audit still contains repetitive, manual and error-prone tasks:

• data preparation and entry;
• combining data from several files;
• importing audit-relevant data into spreadsheets or other software by hand;
• copying, pasting and sorting data;
• basic audit tests such as recomputations and analytical procedures; and
• inventory counts.

Robotic process automation

Robotic process automation (RPA) is software deployed at the user interface level to automate work that is repetitive, structured or rule-based and that uses machine-readable data. It can speed up evidence collection and give near end-to-end automation of audit steps, because it can run tests that have been pre-programmed in other applications such as spreadsheets.

When RPA takes over the time-consuming tasks, the auditor can spend more time on complex accounting issues that need professional judgement.

RPA should be implemented carefully and in phases. The tasks must be broken into discrete steps that can be turned into programmable functions, and the data used must be standardised and in machine-readable form.

When the client uses robots

Robots can also be audited. A client that uses robots gets a reliable, standardised process flow, and the relevant data is available in a consistent form. This lets the auditor focus the approach on the process and give more weight to understanding the financial position and reviewing the management decisions behind it. The client’s use of RPA affects the nature, timing or extent of the audit procedures.

Drones

Drones are used in audit for inventory counts and to check the physical condition of assets, for example for possible impairment. They give the auditor timely data on the quantity, location and condition of assets. They are a new way of collecting evidence and do not change the audit objective. They are useful where insecurity makes a physical count dangerous, and in very large warehouses.

They are faster, cheaper, safer and more accurate than a manual count.

Smart glasses

KPMG has tested smart glasses for audit. The client’s counting staff wear the glasses, and the auditor watches what the wearer sees through an internet connection and augmented reality. A traditional count needs the auditor to travel to the site, count every item and travel back, and may need an expert or a partner to rule on damaged or perishable stock. Smart glasses save much of that cost, time and travel.

The rules in more depth

Why a corporate investigator follows police procedure

Evidence found in a company investigation may end up in court. If the company’s practitioner mishandles a device or fails to record who held it, the other side can argue that the evidence was changed. That is why the procedure stresses chain of custody, case numbers, write-blockers (which stop the investigator from altering a drive) and a record of every step.

Why imaging comes before examination

The investigator works on a copy and leaves the original untouched. This protects the evidence and lets another expert repeat the work and reach the same result. It also explains why the first stages of the process are about planning, collecting and recording, and the analysis comes later.

Why RPA needs standard data

A robot follows rules. It cannot decide what an unusual layout means. If a bank statement arrives in five different formats, the robot cannot read all of them without being told how. That is why the data must be standardised and machine-readable before a task is automated.

Why the objective does not change

Drones, robots and smart glasses change how evidence is gathered. They do not change what the auditor must achieve, which is sufficient appropriate evidence to support the opinion. The auditor still plans, assesses risk, applies professional scepticism and concludes.

Worked example: a ghost workers allegation

1. Planning. Get the chief executive’s approval, set the purpose (find whether ghost workers exist, who set them up and how much was lost), and map the payroll workflow from hiring through approval to payment.
2. Collection and preservation. Identify and tag the computers and drives used in payroll, connect drives to a write-blocker, scan the hard-copy payroll files and keep a chain-of-custody record.
3. Documentation and imaging. Image the drives and document the evidence items with their case numbers.
4. Examination. Use audit software to match the 512 payroll names to the 500 on the master file. Twelve names are not on the master file. Extract the event logs to see who added them and when, and run keyword searches such as “no approval” and “hired”. Review the payroll staff’s emails.
5. Quantify.
   Loss per month is 12 × ₦150,000 = ₦1,800,000.
   Over 8 months it is 8 × ₦1,800,000 = ₦14,400,000.
6. Control lapses. Payroll was changed without matching approval from human resources, and nobody compared the payroll to the master file each month.
7. Reporting. Write a plain-language report that sets out the procedures, the amount, the people involved and the control lapses, and then return the evidence to its original location.

The same facts also raise a CAMA 2020 point. If management had pressed the auditor to skip the payroll test, that could fall within section 406. The audit committee’s duty under section 404(7)(f) to authorise the internal auditor to investigate matters of concern is also relevant.

How to score full marks

• Use the numbered lists as your skeleton. The seven risks, the seven responses, the six stages and the ten ghost worker procedures are all numbered lists. Learn the headings and add a few words of explanation to each.
• Link each risk to a response in a scenario. If the case mentions a crash on a sales day, name website downtime and recommend regular back-ups and a tested recovery plan.
• Give the forensic stages in order. Planning, collection and preservation, documentation and imaging, examination, reporting, return of evidence. The order is itself a mark.
• Name the tool or control. Write “write-blocker”, “chain of custody” and “audit software such as ACL”. Specific words earn marks that vague words do not.
• For robotics, state the benefit and the limit. RPA suits repetitive, rule-based work with machine-readable data. It does not replace professional judgement.
• Quote CAMA 2020 only where it fits. Sections 406 and 407(3) fit scenarios about pressure or access. Do not claim the Act regulates e-business.

Common mistakes in the exam

• Listing only risks and forgetting the responses, or the reverse.
• Defining digital forensics as only recovering deleted files. It covers identification, extraction, preservation, examination and analysis.
• Mixing up the stages, for example reporting before examination.
• Forgetting that evidence must be preserved, with a chain of custody, so that it is accepted in court.
• Saying robots remove the need for the auditor’s judgement.
• Saying drones change the audit objective. They only change how evidence is collected.
• Saying CAMA 2020 requires an audit firm to use RPA, drones or forensic tools. It does not.

Quick revision

• Seven e-business risks: hackers, downtime, service provider failure, traffic interruptions, card fraud, IP theft, warranty and returns failure.
• Seven responses: awareness programmes, security policies, anti-malware and firewalls, limited data, updates, back-ups, cyber insurance.
• Digital forensics: identify, extract, preserve, examine, analyse, admissible in court.
• Six stages: planning, collection and preservation, documentation and imaging, examination, reporting, return of evidence.
• Ghost workers: approval, workflow map, storage, scan, devices, tag and write-blocker, match to master file, event logs, keywords, emails.
• RPA: repetitive, rule-based, machine-readable data, phased roll-out, standardised data.
• Drones: inventory counts and asset condition. Smart glasses: remote view of a count.
• CAMA 2020: s. 374 records, s. 404(7)(d) controls, s. 405 certification, s. 406 improper influence, s. 407(3) access.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.