"Around" the computer or "through" it: how did auditors turn the computer into an audit tool?

For hundreds of years the auditor worked with the same tools: a pencil, a notebook and patience. All records were on paper; one could leaf through them and tick them off. In the middle of the 20th century, however, companies' accounts began to move onto magnetic tape, and for the first time the auditor was left facing a "ledger" that could not be read.

Key points

Two approaches. A 1971 master's thesis at Northern Illinois University examines the two main ways of checking an electronic accounting system: auditing "around" the computer and auditing "through" the computer. In the first, the auditor treats the machine as a "black box" and only compares the documents going in with the paper reports coming out. In the second, the examination is directed at the data and the program in the machine itself.
Firms wrote their own programs. The abstract of a 1969 Journal of Accountancy article describes Auditape as the system of the audit firm Haskins and Sells: a package of ready-made audit programs run by means of specification cards prepared by the auditor. Another master's thesis, from 1972, compares three generalized computer audit systems of the time: Auditape, Audassist and System 2170. According to the author's conclusion, Auditape was rated superior overall because of its sophisticated statistical programs, while the other two stood out for their flexible audit language.
Government audit joined in. According to a 1976 article in the journal of the U.S. General Accounting Office (GAO), GAO first used the computer as an audit tool in 1969: Auditape was applied to a copy of the tapes of the Federal Housing Administration (FHA).
The compatibility problem and CAAT. The same article says that Auditape was not compatible with the agency's computer, so GAO began to develop its own computer assisted audit techniques (CAAT, Computer Assisted Audit Techniques). The lesson that followed was not "one program for everyone" but "a tool suited to each system".
A new professional community. According to ISACA's history, the EDP Auditors Association (EDPAA) was incorporated in Los Angeles in 1969; today's ISACA grew out of exactly this organization. According to the same source, the CISA certification for information systems auditors was introduced in 1978.
The tool changed, the question did not. From Auditape to today's data analysis software, the aim is the same: to gather sufficient and reliable audit evidence. The computer only speeds up sampling and lets the auditor see the whole population.

Then and now

Aspect	1960s–1970s	Today
Where the data is	Magnetic tape, punched cards, printed reports	Accounting software database, cloud services
Auditor's tool	The firm's generalized audit program (for example, Auditape)	Data analysis software, spreadsheets
Who runs the program	Often the client's computing centre	The auditor's own computer
Scope of testing	Sampled records	Often the whole population, then an in-depth sample
Specialist	EDP auditor (a new profession)	Information systems auditor, data analyst

Example: picking out suspicious entries from the "Navro'z Savdo" journal

The example below was compiled by the author; the figures are hypothetical.

Sardor, an auditor at the hypothetical "Ishonch Audit" LLC in Samarkand, is examining the annual sales journal of the wholesale company "Navro'z Savdo": the journal contains 12 000 entries.

Method	What is done	Result
Manual sample	60 documents are taken at random	60 ÷ 12 000 = 0.5% of entries checked
Software filter 1	Entries made on a day off (Sunday)	37 entries picked out
Software filter 2	Duplicated invoice numbers	4 pairs found
Next step	Primary documents are requested for the 37 entries and 4 pairs picked out	Explanation or correction

With a manual sample Sardor would have seen only 0.5% of the journal. The software, by contrast, "looked through" all 12 000 entries in a few minutes and picked out the cases that need attention. But the final conclusion is still drawn by the auditor: a Sunday entry may be an error, or it may be an ordinary duty-shift sale.

Link with the previous period: in the 20th century international standards on auditing standardized "what to check", while computer audit programs changed "how to check". At the next stage, in the 21st century, whole-population data analysis and artificial intelligence are continuing along this path.