The Status of Computer Auditing in Kenya

Abstract

The main objective of this study was to establish the status of computer auditing in Kenya. The study was conducted by personal interviews with the managers drawn from a sample of audit firms in Kenya which were categorized into local and foreign firms. The research was undertaken to answer the following questions: • To what extent is computer auditing practiced in Kenya? • What are the computer auditing practices in Kenya? • What are some of the factors that inhibit computer auditing from being fully practiced in Kenya? The research was also intended to establish whether there is a clear policy as regards computer auditing in Kenya and in the absence of this kind of policy to establish, the source of guidelines being used by audit firms that conduct computer auditing. To make the study complete, a sample of 30 audit firms comprising all the 5 international (foreign) audit firms operating in Kenya and 25 local firms selected on a judgmental basis and after consultations with the Institute of Certified Public Accountants of Kenya. This sample was selected based on a list of 208 audit firms obtained from the Institute of Certified Public Accountants of Kenya ICPA(K). The target was to administer these questionnaires to partners or managers in charge of computer auditing in these firms. The research was unable to achieve the target 30 responses in the preliminary stage of the interviews and only achieved 25 responses and therefore replacement sampling had to be done to satisfy the target 30 responses. The results from this research indicated that the level of computerization among companies in Kenya was about 67% and this can be regarded as relatively high. The research findings indicate that slightly over 14% of those that were categorized as large had computer audits being conducted for them. The research findings also indicate that only 13.3% of audit firms in Kenya conducted computer audits for their clients. These audit firms that conducted computer audits had the following characteristics: were foreign(international)controlled and used international guidelines from their principal audit firms elsewhere or relied on guidelines from certain international organizations such as the Information Systems Control Association (ISACA), The Institute of Internal Auditors (UK) and the Global Risk Management systems group (UK) The research findings also indicate that companies in Kenya that have their computer systems audited conduct such audits on a needs basis or on an annual basis. This indicates that computer auditing is not regarded by companies as important since computer systems audits should be conducted more regularly. The research indicated that the most commonly pursued computer-auditing objective was protective auditing followed by efficiency and effectiveness auditing. From the research there was a clear indication that the (ownership) orientation of the firm i.e. whether local or foreign, affected the kind of practice that they were involved in, this is because all those firms conducting traditional computer auditing had foreign ownership. The research also indicated that the most commonly used auditing techniques by the 13.3% of the firms that practice computer auditing, are the use of generalized audit software, generalized computer audit enquiry packages, load and go packages and tailored programs. The findings of this research further indicated that lack of trained staff, the apparent lack of awareness of corporate managers of the importance of computer auditing, the high cost of training and acquisition of computer audit software and computer hardware are some of the factors inhibiting the practice of computer auditing in Kenya. The above results should be viewed and adopted in the light of the limitations of this study which are methodological, user sampling and the apparent small size of audit firms that practice computer auditing. The study, however serves as a useful starting point for shaping of the computer auditing profession in Kenya.