Information Technology and Audit
IT environment and general controls
Understand how IT affects the audit: automated controls, data integrity, and the need to consider IT general controls (ITGCs) over access, program changes, program development, and computer operations. ITGCs support the reliable operation of automated application controls. If ITGCs are weak, reliance on automated controls is reduced.
Application controls and data
Know application controls: input, processing, and output controls. Understand edit checks, validation, reconciliation, and access restrictions. Data analytics and computer-assisted audit techniques allow full-population testing, anomaly detection, and recalculations. Consider risks from cybersecurity, cloud services, and reliance on third-party service organisations.
Traps in questions
Distractors suggest automated controls need no testing because they are programmed, or that ITGCs are irrelevant when application controls are strong. Another trap confuses general controls with application controls. Watch for questions on service organisations, where the auditor may need a service auditor's report.
Rule of thumb
Before relying on an automated application control, confirm the relevant ITGCs (especially program change and access controls) are effective; otherwise the automated control cannot be trusted across the period.
Worked example
A client's automated revenue recognition control appears effective, but the auditor finds that developers have unrestricted production access. Because change management and access ITGCs are weak, the auditor cannot rely on the automated control and must perform additional substantive testing.