We continue to update all of our flowcharts on a regular basis and expect to
use flowcharting as a useful tool for some time to come. As part of our
corporate software standardization, we moved away from the audit specific
flow charting packages and agreed to use VISIO. We have found the package
to be highly functional and easy to use. New staff are introduced to
flowcharting by having them make changes to older charts. One-on-one
training is provided by our more experienced auditors.
One observation worth mentioning. In our recruiting drives, we are finding
fewer and fewer auditors with any recent experience in flowcharting. It
appears that many companies are not finding a lot of value in the results of
flowcharting efforts.
My personal perspective is that as systems become more fully integrated and
highly complex computerized processes, there are few individuals that can
understand the process flows and even fewer that know more than a segregated
portion of the process. This can lead to a level of difficulty for the
auditor attempting to flowchart the system or process unless a 'blackbox'
approach to documentation is accepted. In his/her attempt to fully
understand the system, the auditor may be required to interview a large
number of individuals who may have different interpretations of how the
system actually works. This can be very time consuming and tight audit
budgets may be a factor in a decision not to flowchart and to rely on a
system narrative instead.
I feel that flowcharting can be useful and add value if an auditor considers
his/her control objectives and keeps the documentation oriented in that
direction. The primary goal should be to obtain an understanding of the
business process and not get mired in the system details. This type of
approach provides simplicity and flexibility. Over time, systems may change
significantly but the actual business processes do not. The experienced
auditors out there will understand me when I say that even though we've
automated many tasks and procedures, the same control frameworks generally
apply.
As an example, I would offer the task of flowcharting an ERP system that
uses a relational database for the backend. If we were flowcharting the
payroll process, we would chart the business process flows rather than the
actual systems process that take place. In other words we would try to
capture where the data originates, how it is approved, entered and finally
processed and output from the system. This provides the opportunity to
understand where enduser and application controls may be expected and
reasonable. What we would not attempt to do is flowchart the actual system
processes, scripts, tables, and system interfaces. This would be beyond the
technical understanding of most auditors and would most likely not add any
significant value to the audit process.
In my discussions with other colleagues, some have attempted to document the
system processes rather than the business flows and have given up in
frustration. This, I think, may be one of the reasons flowcharting appears
to be growing less popular.
regards,
Daniel B. Sturk, CIA, CISA, CISSP
Senior Specialist Information Systems Auditor
Dofasco Inc.
P.O. Box 2460
1330 Burlington St. E.
Hamilton, Ontario, Canada
L8N 3J5
Business Phone: (905) 544-3761 Ext. 6405
Business Fax: (905) 548-7547
Business E-mail: [EMAIL PROTECTED]
> -----Original Message-----
> From: Kaplan, Jim [SMTP:[EMAIL PROTECTED]]
> Sent: Thursday, July 19, 2001 8:19 AM
> To: '[EMAIL PROTECTED]'
> Subject: Flow Charting for auditors
>
> I would like to know the extent to which flow charting is being used by
> your
>
> audit office.
>
> If you incorporate flow charting in your audits what flow charting package
>
> are you using?
>
> How do you train your staff to prepare flow charts?
>
> What books or resources are you aware of or use for flowcharting?
>
> I was looking for online sources (or books) yesterday and found very
> little
>
> if any information on flowcharting for auditors other than a few classes.
>
> If you want to send your responses directly to me (rather than the list) I
>
> will summarize for the benefit of all.
>
> Thanks,
>
> Jim
>
> Jim Kaplan CIA, CFE
> Internal Audit Director
> Fairfax County Public Schools
> (703) 246-4717 Phone
> (703) 591-6323 FAX
>
If your organization would like to sponsor this discussion list send an e-mail to
[EMAIL PROTECTED] for information.
To unsubscribe to the Audit-l list send an e-mail to [EMAIL PROTECTED] Leave
the subject line blank and include the following message in the body:
Unsubscribe audit-l (yourname)
Thanks,
Jim Kaplan
List Manager
