You have just been engaged as the external auditor for a medium-sized automotive servicing organization. The organization obtains most of its revenue in three ways:

(a) it services motor-vehicle fleets,

(b) it sells spare parts, and

(c) it converts vehicles from petroleum to liquified petroleum gas (LPG) consumption.

The organization uses a local area network of three microcomputers running the following application software packages:

• General ledger

• Debtor/invoicing

• Creditors

• Payroll

• Spare parts/inventory

• Job costing

• Bill-of-materials All applications are relatively straightforward. Job costing and bill of materials, for example, are used to support workshop activities. A supervisor specifies the type of service required for a vehicle, and the bill-of-materials application identifies the standard parts and labor required for the job.
The three microcomputers are placed in different locations: (a) workshop-to enter data about a job or inquire about a job, spare part, and so on; (b) accounting-to process data related to debtors, creditors, payroll, and general ledger and to prepare management reports; and (c) spare parts-to provide over-the-counter service to customers and workshop personnel. The operating system used to support the microcomputers allows concurrent but controlled access to a central database. All the software used by the organization is well-known, well-tested, and supplied by a reputable vendor. The general manager assures you that no modifications have been made to the software and indicates there is no one on the staff of the organization with the computer knowledge needed to carry out modifications to the software.
Required. Outline how you would approach the audit of this organization. In particular, indicate how the use of generalized application software that supposedly has not been modified will affect your audit strategy. In this light, consider the levels of inherent risk and control risk that are likely to exist with the applications. Discuss, also, whether you will focus on user controls, computer controls, or both in any audit testing you undertake.