In 1990, our Cooper Industries, Inc. Internal Audit Department decided to review our computer assisted audit techniques for testing data on the computer. For several reasons, we had not been satisfied with the results we were getting with our mainframe-based software.
After a 12-month review, we selected a PC-based product, ACL, which has proved to be a good choice for our particular environment. The assessments and decision-making processes we faced may be of interest to other departments faced with a similar situation.
* Our Environment
Cooper, a six billion-dollar diversified worldwide manufacturing company, makes everything from electrical transformers to spark plugs. Each of Cooper's 22 decentralized divisions is supported by their own MIS departments. These divisions have over 38 processing sites domestically and 41 internationally (almost exclusively on IBM platforms). Twelve of these operate on an IBM 3081 or larger mainframe, while the rest use mid-range (50 or so, predominantly AS/400s) and microcomputers (mostly small locations abroad).
Our audit department is composed of 19 senior auditors, three managers, and a director. Our structure may be somewhat unusual, in that the seniors are assigned to the audit department for two years and are then transferred out to an operating position. All of the seniors were previously senior financial auditors with Big 6 firms. The seniors usually have no experience with mainframe environments; however, most have some PC skills and proficiency in at least one word-processing or spreadsheet application.
* Our Old Approach
In 1990, internal audit relied on three approaches to auditing data on the computer. We used a mainframe-based software product at locations with a mainframe; we tested data manually; or we had MIS departments run reports for us using their report writers. These approaches were not particularly effective in our environment due to various factors. The mainframe-based product:
* Required two weeks of training. Given a senior's two-year stint in the department and the fact that he or she might use the product only once or twice a year, the payback on the training time was poor.
* The product we used was a resource hog, and divisions often relegated our use of the product to late evening hours.
* The product could only be used on mainframes.
* Seniors were generally intimidated by the mainframe environment.
Manual testing was inefficient due to the limited amount of data that could...