Information Technology and Information Systems
Information Technology and Information Systems tests how accounting data is captured, processed and controlled, and how the auditor obtains assurance from IT. In Kazakhstan this includes mandatory electronic invoicing and electronic tax reporting, which make system controls part of everyday compliance.
Control framework
- IT general controls: access management, change management, IT operations, backup and disaster recovery. Weak general controls undermine reliance on automated application controls.
- Application controls: input validation, sequence checks, duplicate detection, matching and exception reports.
- Segregation of duties: in an ERP, no single user should create a vendor, approve an invoice and release payment.
- Electronic invoicing: invoices are issued and received through the state electronic invoice system; fixed assets and goods movement are tracked in the virtual warehouse module.
- Data protection: personal data processing follows the Kazakh personal data law, requiring consent, purpose limitation and security.
Worked example
During an ERP review, the auditor finds one user with authority to create supplier master records and to approve payments. The risk is a fictitious supplier paid through an approved but fraudulent invoice. The auditor documents the design deficiency, tests whether a compensating manual control such as bank mandate review operates, and extends substantive testing over supplier additions and payments. Issuing an electronic invoice does not by itself confirm that the underlying transaction occurred.
Traps
- Relying on an automated control without testing the related access and change controls.
- Treating an electronic document as proof of substance.
- Ignoring interface controls when data moves between subsystems.
- Assuming a backup exists without testing restoration.