Control and audit considerations for electronic filing of regulatory information.

• Author: Sheehy, Donald E.

A study group of the Canadian Institute of Chartered Accountants has developed a booklet to assist governments considering whether and how to integrate electronic filing into their operations.

In the past year, electronic filing is becoming more commonplace in the United States and in Canada. In the U.S., the Securities and Exchange Commission set up an Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system for electronic filing of corporate information, with such information being available on the Internet approximately 24 hours after receipt. In Canada, the Canadian Securities Administrators are in the process of implementing their System for Electronic Document Analysis and Retrieval (SEDAR). Also, departments and agencies at various levels of government have implemented, or plan to implement, electronic filing of various types of information, including financial statements of regulated entities, financial information returns, budgets, student enrollment data, subsidy claims, and medical and drug claims.

As clients become involved with electronic filing to improve the efficiency of their filings, so do their auditors. A study group, comprising members of the Canadian Institute of Chartered Accountants who have expertise in dealing with computerized systems, was set up to provide guidance to both clients and auditors on the issues that are being encountered. Its principal terms of reference were to discuss

* technical issues, including desired controls with respect to the submission and receipt of an electronic filing;

* how confidentiality of information filed electronically can best be preserved; and

* the auditor's role in providing assurance that the controls over an electronic filing system are suitably designed and operate effectively.

A booklet setting out the study group views and conclusions was published in December 1995. This article summarizes some of the key issues discussed in the booklet.

Risks and Controls

At each phase of an electronic filing process, there are significant risks that affect the authorization, accuracy, completeness, and confidentiality of the information. At the phase when a filer prepares the information, errors that could occur include loss of accuracy/completeness on transfer from source to filing mode, failure to include all of the information required by the regulator, or uncorrected errors from the initial filing. Errors that could occur during transmission of information by a filer and receipt and official acceptance of the information by the regulator include transmission and acceptance of inaccurate or incomplete data, transmission and acceptance by an unauthorized person, failure to acknowledge acceptance, or failure to notify filer of nature of filing deficiencies on a timely basis. During analysis, use, and storage of the information by the regulator, programming or operational errors causing inaccurate processing, unauthorized alteration, addition or deletion of data files, loss of data due to...