Cybersecurity Risk Assessment in the Audit: A CPA Guide

Cybersecurity and the Financial Statement Audit

Cybersecurity risk has become a critical consideration in the financial statement audit. As companies rely increasingly on information technology to process, store, and report financial data, the risk that a cyberattack could compromise the integrity of financial reporting has grown significantly. For CPA AUD candidates, understanding how auditors assess and respond to cybersecurity risks is essential for both the exam and professional practice.

The auditor is not expected to be a cybersecurity expert. However, auditing standards require the auditor to understand the entity information technology environment and to assess the risks that IT-related control deficiencies, including those related to cybersecurity, could lead to material misstatements in the financial statements.

Understanding the IT Environment

During the planning phase of the audit, the auditor obtains an understanding of the entity IT environment, including the applications used to initiate, process, and record transactions, the IT infrastructure supporting those applications, and the IT processes and personnel responsible for maintaining the systems. This understanding helps the auditor identify IT-dependent controls and assess the risk that IT-related issues could affect the reliability of financial reporting.

Key elements of the IT environment that the auditor considers include the financial reporting applications and databases, the interfaces between systems that transfer data, the use of third-party service organizations for IT functions, and the general computing environment including networks, operating systems, and hardware.

IT General Controls

IT general controls (ITGCs) are the foundation of reliable IT-dependent financial reporting. These controls operate across the IT environment and affect the reliability of all applications and data that depend on the IT infrastructure. The four primary categories of ITGCs are access controls, which restrict who can view and modify data and systems; change management controls, which ensure that changes to applications and systems are properly authorized, tested, and implemented; IT operations controls, which ensure that systems operate as intended and that data is backed up and recoverable; and program development controls, which ensure that new applications are designed, tested, and implemented in a manner that supports accurate financial reporting.

Cybersecurity risks directly affect ITGCs, particularly access controls. If an attacker gains unauthorized access to financial systems, they could modify data, create fictitious transactions, or exfiltrate sensitive information. The auditor evaluates whether the entity has implemented adequate controls to prevent, detect, and respond to unauthorized access.

Risk Assessment Procedures

When assessing cybersecurity risks in the context of the financial statement audit, the auditor considers several factors. These include the nature and complexity of the entity IT systems, the sensitivity of the data processed by those systems, the entity history of cybersecurity incidents, the industry-specific cybersecurity threat landscape, and the entity overall cybersecurity governance and risk management framework.

The auditor may also consider whether the entity has experienced any significant cybersecurity events during the audit period that could affect the integrity of financial data. A ransomware attack that encrypted financial databases, a phishing attack that compromised the credentials of finance personnel, or a data breach that exposed customer financial information could all have implications for the financial statement audit.

Service Organizations and Cybersecurity

Many companies outsource IT functions to third-party service organizations, such as cloud computing providers, payment processors, and payroll services. When a service organization processes transactions or maintains data relevant to the entity financial reporting, the auditor must consider the controls at the service organization. SOC 1 reports (Service Organization Control reports under SSAE 18) provide information about the service organization controls that are relevant to user entities internal controls over financial reporting.

The auditor evaluates the SOC 1 report to determine whether the service organization controls are suitably designed and operating effectively, and whether any identified control deficiencies could affect the entity financial reporting. The increasing frequency of cybersecurity incidents at service organizations makes this evaluation particularly important.

Responding to Identified Cybersecurity Risks

If the auditor identifies cybersecurity risks that could result in material misstatement, the auditor must design and perform audit procedures to address those risks. This might include testing access controls to verify that only authorized personnel can access financial systems, performing substantive testing of data integrity to verify that financial data has not been improperly modified, evaluating the entity incident response and recovery procedures to assess whether any cybersecurity events were properly addressed, and considering whether cybersecurity deficiencies rise to the level of material weaknesses in internal controls over financial reporting.

Key Concepts for CPA Candidates

• Understand the four categories of IT general controls and how they relate to the reliability of financial reporting.
• Know how cybersecurity risks affect the auditor risk assessment and audit planning.
• Be prepared to evaluate how a cybersecurity incident could affect the integrity of financial data and the auditor response.
• Understand the role of SOC 1 reports in evaluating controls at service organizations.
• Recognize that cybersecurity is not a separate audit but an integral part of understanding and testing the IT-dependent control environment.

Cybersecurity risk is here to stay, and its importance in the audit will only grow. CPA candidates who understand the intersection of cybersecurity and auditing will be well-prepared for an evolving profession.