CPA Exam AUD: IT Audit Considerations and Controls
Learn about IT audit considerations for the CPA AUD exam. Covers general IT controls, application controls, CAATs, and the impact of technology on audit procedures.
IT Audit Considerations: What CPA Candidates Must Know
Information technology (IT) affects virtually every aspect of modern auditing. The auditor must understand how the entity uses IT in its financial reporting process and how IT affects internal control and audit procedures. While there is no single AU-C section dedicated exclusively to IT auditing, IT considerations permeate AU-C 315 (Understanding the Entity and Its Environment), AU-C 330 (Performing Audit Procedures), and related standards.
General IT Controls (GITCs)
General IT controls are policies and procedures that relate to many applications and support the effective functioning of application controls. They help ensure that information systems continue to function properly. Key areas of general IT controls include:
- Access controls: Logical and physical access restrictions to programs, data, and IT infrastructure. These controls ensure that only authorized individuals can access and modify systems and data. Examples include password policies, user authentication, role-based access, and physical security of servers.
- Program change controls: Controls over modifications to existing programs, systems, and configurations. These controls ensure that changes are properly authorized, tested, and approved before implementation. This prevents unauthorized or untested changes from corrupting data or processing logic.
- Program development controls: Controls over the design, coding, testing, and implementation of new systems and applications. These controls ensure that new systems meet specified requirements and process data accurately.
- Computer operations controls: Controls over the processing of data, including job scheduling, backup and recovery procedures, and incident management. These controls help ensure the continuity and reliability of IT operations.
Weaknesses in general IT controls can undermine the effectiveness of application controls. For example, if access controls are inadequate, an unauthorized user could modify application processing rules, rendering application controls unreliable.
Application Controls
Application controls are specific to individual applications and relate to the processing of individual transactions. They are designed to help ensure that transactions are valid, properly authorized, and completely and accurately recorded. Application controls include input controls (ensure data entered is valid, complete, and accurate, such as edit checks, validation rules, and reasonableness tests), processing controls (ensure that data is processed correctly, such as run-to-run totals, sequence checks, and limit tests), and output controls (ensure that processing results are complete and properly distributed, such as reconciliations, report distribution logs, and error reports).
Application controls can be automated (performed by the system without human intervention) or manual (requiring human action, such as reviewing an exception report). Automated controls are generally more reliable because they are consistently applied, but they depend on the effectiveness of general IT controls.
Impact of IT on Audit Risk Assessment
IT can both increase and decrease audit risk. IT increases risk through unauthorized access to data, unauthorized changes to programs, failure to make necessary changes to systems, inappropriate manual intervention, and potential loss of data. IT decreases risk through consistent application of predefined business rules, enhanced ability to monitor and supervise activities, ability to implement effective segregation of duties through access controls, and the ability to process large volumes of transactions accurately.
Computer-Assisted Audit Techniques (CAATs)
CAATs are tools that help auditors perform procedures more efficiently and effectively in an IT environment. Common CAATs include audit software (generalized audit software such as ACL or IDEA that can read data files, select samples, perform calculations, and detect anomalies), test data (submitting fictitious transactions through the entity's system to evaluate processing controls), integrated test facilities (embedding test data within the entity's live production system to process alongside real transactions), and parallel simulation (using auditor-controlled software to independently process data and compare results to the entity's output).
CAATs can be used for tests of controls (testing automated controls and access logs), substantive procedures (selecting samples, recalculating amounts, identifying anomalies), and analytical procedures (analyzing large datasets for trends and patterns).
IT Specialists and the Auditor
When the entity's IT environment is complex, the auditor may need to involve IT audit specialists. The auditor is responsible for directing, supervising, and reviewing the IT specialist's work. The auditor should have sufficient understanding of IT to evaluate whether the specialist's work is adequate for the auditor's purposes. The use of an IT specialist does not reduce the auditor's responsibility for the audit.
Exam Tips for IT Audit Considerations
- General IT controls support application controls; weak GITCs can undermine application controls.
- Automated controls are reliable only if GITCs are effective.
- CAATs include audit software, test data, integrated test facilities, and parallel simulation.
- IT can both increase and decrease audit risk depending on the quality of controls.
- The auditor must understand the IT environment even if an IT specialist is used.
Practice What You Learned
Study with 1,200+ flashcards and 140 practice exams across all 4 CPA sections.