ICAN CAP-III cheat sheet

IFRS 15 five-step model: identify the contract, identify performance obligations, determine transaction price, allocate price to obligations by standalone selling price, recognise revenue when (or as) each obligation is satisfied.

A performance obligation is satisfied over time if the customer simultaneously receives and consumes benefits, the entity creates or enhances an asset the customer controls, or the asset has no alternative use and the entity has an enforceable right to payment for progress.

Variable consideration is included in the transaction price using the expected value method (many similar contracts) or most likely amount (binary outcome), constrained to the amount for which a significant revenue reversal is not highly probable.

A contract modification is treated as a separate contract only if it adds distinct goods or services priced at their standalone selling price; otherwise it is a termination plus new contract, or a cumulative catch-up adjustment.

IFRS 16 lessee: recognise a right-of-use asset and lease liability at the present value of lease payments discounted at the implicit rate or, if not readily determinable, the lessee's incremental borrowing rate.

IAS 36 impairment: recoverable amount is the higher of fair value less costs of disposal and value in use; an impairment loss on a cash-generating unit is allocated first to goodwill, then pro rata to other assets.

IFRS 3: goodwill = consideration transferred + non-controlling interest + previously held interest − fair value of identifiable net assets acquired; acquisition-related costs are expensed.

IAS 21: monetary items are retranslated at the closing rate with differences to profit or loss; a foreign operation's translation differences go to other comprehensive income and are recycled on disposal.

IAS 12 deferred tax is measured at the tax rates expected to apply when the asset is realised or the liability settled, based on rates enacted or substantively enacted by the reporting date.

Audit risk model: audit risk = inherent risk × control risk × detection risk; detection risk is the only component the auditor controls, so it moves inversely with assessed risks of material misstatement.

ISA 315 (Revised) requires identifying risks of material misstatement at the financial statement and assertion level, with inherent risk factors including complexity, subjectivity, change, uncertainty and susceptibility to management bias.

Materiality: overall materiality is commonly a benchmark (often 5% of profit before tax or 0.5-1% of revenue); performance materiality is set below it to reduce the probability that uncorrected aggregate misstatements exceed materiality.

ISA 600 (Revised) governs group audits: the group engagement partner is responsible for direction, supervision and review, and must be involved in component work when risks are significant.

ISA 701 key audit matters apply to audits of complete sets of general purpose financial statements of listed entities; they are selected from matters communicated with those charged with governance.

Going concern (ISA 570): the auditor evaluates management's assessment covering at least 12 months from the reporting date, and concludes whether a material uncertainty or a material inconsistency exists.

Modified opinions: qualified (material but not pervasive), adverse (material and pervasive for a misstatement), disclaimer (material and pervasive for an inability to obtain evidence).

ISA 220 (Revised) requires engagement quality reviews for listed entities and other engagements where required, and mandates firm-level quality management under ISQM 1.

Professional scepticism is a questioning mind and critical assessment of evidence; it is required throughout, and contradictory evidence must be investigated rather than explained away.

Tax planning is legitimate if it has commercial substance and complies with the letter and spirit of the law; tax evasion (concealment, false documents) is unlawful and a criminal matter, while avoidance exploits technicalities.

Deferred tax arises from temporary differences between accounting carrying amounts and tax bases; taxable temporary differences create deferred tax liabilities, deductible temporary differences create deferred tax assets if recovery is probable.

A deferred tax asset is recognised only to the extent it is probable that taxable profit will be available against which the deductible temporary difference or unused tax loss can be utilised.

Capital allowances substitute for accounting depreciation in tax computations: add back depreciation, deduct capital allowances, and adjust for disallowed expenditure such as non-deductible entertainment.

Transfer pricing: intra-group transactions must be at arm's length; the OECD guidelines describe the comparable uncontrolled price, resale price, cost plus, transactional net margin and profit split methods.

Thin capitalisation and interest limitation rules cap deductible interest by reference to a fixed ratio of earnings before interest, tax, depreciation and amortisation, or to group net interest expense.

Withholding tax on cross-border payments (dividends, interest, royalties, service fees) may be reduced under a double tax treaty, subject to beneficial ownership and limitation-on-benefits tests.

Tax losses: relief for carried-forward losses is commonly restricted to a percentage of profits and may be subject to continuity of ownership tests.

A controlled foreign company regime attributes low-taxed passive income of foreign subsidiaries to the resident parent, subject to substance and active-business exemptions.

Return on investment = controllable profit ÷ invested capital; it can be improved by increasing profit, reducing capital employed, or both, but it may encourage managers to reject projects below current ROI.

Residual income = profit − (required rate of return × invested capital); unlike ROI it is consistent with goal congruence because any project above the required rate adds value.

Economic value added = net operating profit after tax − (weighted average cost of capital × invested capital), with accounting adjustments for items such as capitalised research and operating leases.

Balanced Scorecard perspectives: financial, customer, internal business process, and learning and growth; each perspective needs objectives, measures, targets and initiatives.

The four perspectives are linked by cause-and-effect assumptions; lagging outcome measures are balanced by leading driver measures.

Activity-based costing assigns overhead to activities and then to products by cost drivers; it improves accuracy where product diversity and overhead complexity are high.

Transfer pricing methods: market-based price, cost-plus, and negotiated; a dual transfer price lets the selling division use market price and the buying division pay variable cost, with the difference charged centrally.

Variance analysis: material price variance = (standard price − actual price) × actual quantity purchased; material usage variance = (standard quantity for actual output − actual quantity used) × standard price.

Customer lifetime value = (average contribution per period × retention life) − acquisition cost; it supports decisions on retention spending versus acquisition spending.

Weighted average cost of capital = (E/V × Ke) + (D/V × Kd × (1 − t)), using market values of equity and debt; it is the appropriate discount rate for projects of average business risk.

Capital asset pricing model: Ke = risk-free rate + beta × equity risk premium; beta measures systematic risk, and unsystematic risk is diversifiable and unrewarded.

Dividend growth model: Ke = (D1 ÷ P0) + g; the growth rate can be estimated as retention ratio × return on equity.

Adjusted present value = base-case net present value at the all-equity rate + present value of financing side effects such as tax shields and issue costs.

Net present value is preferred over internal rate of return because IRR can give multiple answers with non-conventional cash flows and ignores project scale; modified IRR resolves the reinvestment assumption.

Interest rate risk: a borrower hedges rising rates by buying an interest rate cap or paying fixed on a swap; a lender hedges falling rates with a floor or receiving fixed.

Purchasing power parity links exchange rates to relative inflation; interest rate parity links forward rates to relative interest rates; the international Fisher effect links interest differentials to expected inflation.

Forward rate = spot rate × (1 + interest rate of quote currency) ÷ (1 + interest rate of base currency), reflecting covered interest arbitrage.

Cash operating cycle = inventory days + receivable days − payable days; it measures the period between paying suppliers and collecting from customers.

Agency theory: separation of ownership and control creates conflicts; monitoring mechanisms include independent non-executive directors, audit committees, external audit, and incentive alignment.

Stewardship theory assumes managers are trustworthy and motivated by intrinsic rewards, so governance emphasises empowerment and long-term value rather than tight monitoring.

Stakeholder theory holds that the firm is accountable to parties affected by it (employees, customers, suppliers, communities), not only shareholders; shareholder primacy focuses on residual value.

The five fundamental principles of professional ethics: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

The conceptual framework for ethics: identify threats (self-interest, self-review, advocacy, familiarity, intimidation), evaluate their significance, and address them by eliminating the circumstance, applying safeguards, or declining the engagement.

Independence in appearance as well as in fact is required for audit; long association creates familiarity threats, and fee dependence creates self-interest threats.

The King IV report applies 16 principles on an apply-and-explain basis, covering ethical leadership, the governing body's role, audit committee, risk governance, and stakeholder inclusivity.

Whistleblowing is protected disclosure made in good faith to an appropriate authority; confidentiality obligations do not override the duty to report illegal acts.

Conflicts of interest must be disclosed and managed; a professional accountant in business must not use inside information for personal gain.

The CIA triad (confidentiality, integrity, availability) frames information security; controls are classified as preventive, detective or corrective.

Segregation of duties in an ERP environment: the person who authorises a transaction should not record it, and the person who records it should not have custody of the related asset.

General IT controls cover access management, change management, IT operations and program development; application controls cover input, processing and output, and depend on effective general controls.

Audit data analytics techniques include trend analysis, ratio analysis, stratification, clustering, regression, and anomaly detection; CAATs include test data, parallel simulation and embedded audit modules.

Benford's law predicts the frequency of leading digits in naturally occurring data; deviations may indicate fabrication or processing errors and warrant further investigation.

Data quality dimensions: completeness, accuracy, validity, consistency, timeliness and uniqueness; poor input quality cannot be corrected by later analytics.

Cloud computing service models: IaaS (infrastructure), PaaS (platform), SaaS (software); shared responsibility means the customer retains responsibility for data and access controls.

Blockchain provides an append-only distributed ledger with cryptographic hashing and consensus; it supports integrity and traceability but not, by itself, the validity of the underlying transaction.

Robotic process automation performs rule-based repetitive tasks; it is not artificial intelligence, and its controls require logging, exception handling and periodic review of rules.

Business continuity: recovery point objective measures tolerable data loss; recovery time objective measures tolerable downtime; a disaster recovery plan addresses the technology, a business continuity plan addresses the whole organisation.

Data privacy principles under GDPR-style regimes: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

A computer-assisted audit technique such as test data must be run against a copy or in a controlled environment to avoid contaminating live data.

Analytics on the full population reduces sampling risk but introduces the risk of false positives; results still require professional judgement and corroboration.

Predictive analytics uses historical data to forecast outcomes; prescriptive analytics recommends actions; descriptive analytics summarises what happened.

Emerging technology risk: algorithmic bias, model risk, data leakage, and over-reliance on automated output without verification.

A system's audit trail should record user identity, date and time, the transaction, and before-and-after values, and should be tamper-proof.

IT general control weaknesses usually require a report to those charged with governance and may cause the auditor to rely on substantive procedures instead of controls.

Digital transformation changes the control environment; automated controls require testing of their design and operating effectiveness, including the underlying configuration.

Data analytics in audit: population testing, visualisation and exception reporting support risk assessment and substantive testing, but the auditor must assess completeness and accuracy of the source data.

The auditor's use of a data analytics tool does not remove the need to evaluate the reliability of the data extracted from the client's system.

Cybersecurity governance: the board sets risk appetite, management implements controls, and the audit committee oversees the control environment.

Artificial intelligence systems require governance over training data, model validation, explainability and human oversight.

Continuous auditing uses automated, near-real-time tests of controls and transactions; continuous monitoring is performed by management, not the auditor.

A service organisation's SOC 1 report covers controls relevant to financial reporting; a SOC 2 report covers security, availability, processing integrity, confidentiality and privacy.

Data analytics lifecycle: define the question, obtain and validate data, clean and transform, analyse, interpret, and communicate; each stage carries a risk of error.

Sampling in analytics: random, systematic, stratified and monetary unit sampling; larger sample sizes reduce sampling risk but not non-sampling risk.

Visualisation should match the message: bar charts for comparison, line charts for trends, scatter plots for correlation, and heat maps for density.

Dashboards for performance measurement should use leading and lagging indicators and be linked to strategic objectives.

Data governance assigns ownership, stewardship and quality accountability; master data management maintains a single trusted source.

Emerging technology adoption should be assessed against business value, risk, cost and control implications, not novelty.

The auditor must document the use of automated tools, including the source of data, the procedures performed and the conclusions reached.

A digital audit trail must be complete, accurate and secure; system-generated reports used as audit evidence must be tested for completeness and accuracy.

Key IT risks: unauthorised access, data loss, system downtime, inadequate change control, and reliance on spreadsheets outside the controlled system.

Cloud provider assurance: review the service organisation's independent assurance report, the scope and period covered, and complementary user entity controls.

Data protection impact assessments are required where processing is likely to result in high risk to individuals.

Incident response stages: preparation, detection, containment, eradication, recovery and lessons learned.

Automation of controls can reduce human error but creates risk of systematic error affecting the whole population.

Analytics results should be corroborated with other audit evidence before conclusions are drawn.

Data extraction from an ERP should be performed by the auditor or observed, with record counts and control totals reconciled to the general ledger.

Machine learning models require validation of inputs, outputs and ongoing performance monitoring to detect model drift.

The audit committee should oversee significant technology projects and the associated risks.

Third-party risk management: due diligence, contractual controls, right to audit, and exit planning.

Business process automation requires controls over access to the automation tool and change control over the rules.

Analytics can support fraud detection through anomaly, duplicate and outlier testing, but results are indicators, not proof.

Data retention and disposal policies must balance legal requirements with privacy obligations.

Emerging technologies such as distributed ledgers, robotic process automation and artificial intelligence alter the evidence available to the auditor and the nature of controls.

A distributed ledger provides assurance over the integrity of recorded entries but not over the validity of the underlying transactions or the completeness of off-ledger activity.

Automated decision-making raises accountability and explainability issues; governance should ensure human review of significant decisions.

Analytics on the full population reduces sampling risk but introduces the risk of false positives; results still require professional judgement and corroboration.

Predictive analytics uses historical data to forecast outcomes; prescriptive analytics recommends actions; descriptive analytics summarises what happened.

The auditor's use of a data analytics tool does not remove the need to evaluate the reliability of the data extracted from the client's system.

Cybersecurity governance: the board sets risk appetite, management implements controls, and the audit committee oversees the control environment.

Data analytics lifecycle: define the question, obtain and validate data, clean and transform, analyse, interpret, and communicate; each stage carries a risk of error.

Sampling in analytics: random, systematic, stratified and monetary unit sampling; larger sample sizes reduce sampling risk but not non-sampling risk.

Visualisation should match the message: bar charts for comparison, line charts for trends, scatter plots for correlation, and heat maps for density.

Dashboards for performance measurement should use leading and lagging indicators and be linked to strategic objectives.

Data governance assigns ownership, stewardship and quality accountability; master data management maintains a single trusted source.

Emerging technology adoption should be assessed against business value, risk, cost and control implications, not novelty.

The auditor must document the use of automated tools, including the source of data, the procedures performed and the conclusions reached.

A digital audit trail must be complete, accurate and secure; system-generated reports used as audit evidence must be tested for completeness and accuracy.

Key IT risks: unauthorised access, data loss, system downtime, inadequate change control, and reliance on spreadsheets outside the controlled system.

Cloud provider assurance: review the service organisation's independent assurance report, the scope and period covered, and complementary user entity controls.

Data protection impact assessments are required where processing is likely to result in high risk to individuals.

Incident response stages: preparation, detection, containment, eradication, recovery and lessons learned.

Automation of controls can reduce human error but creates risk of systematic error affecting the whole population.

Analytics results should be corroborated with other audit evidence before conclusions are drawn.

Data extraction from an ERP should be performed by the auditor or observed, with record counts and control totals reconciled to the general ledger.

Machine learning models require validation of inputs, outputs and ongoing performance monitoring to detect model drift.

The audit committee should oversee significant technology projects and the associated risks.

Third-party risk management: due diligence, contractual controls, right to audit, and exit planning.

Business process automation requires controls over access to the automation tool and change control over the rules.

Analytics can support fraud detection through anomaly, duplicate and outlier testing, but results are indicators, not proof.

Data retention and disposal policies must balance legal requirements with privacy obligations.

Emerging technologies such as distributed ledgers, robotic process automation and artificial intelligence alter the evidence available to the auditor and the nature of controls.

A distributed ledger provides assurance over the integrity of recorded entries but not over the validity of the underlying transactions or the completeness of off-ledger activity.

Automated decision-making raises accountability and explainability issues; governance should ensure human review of significant decisions.

Analytics on the full population reduces sampling risk but introduces the risk of false positives; results still require professional judgement and corroboration.

Predictive analytics uses historical data to forecast outcomes; prescriptive analytics recommends actions; descriptive analytics summarises what happened.

The auditor's use of a data analytics tool does not remove the need to evaluate the reliability of the data extracted from the client's system.

Cybersecurity governance: the board sets risk appetite, management implements controls, and the audit committee oversees the control environment.

Data analytics lifecycle: define the question, obtain and validate data, clean and transform, analyse, interpret, and communicate; each stage carries a risk of error.

Sampling in analytics: random, systematic, stratified and monetary unit sampling; larger sample sizes reduce sampling risk but not non-sampling risk.

Visualisation should match the message: bar charts for comparison, line charts for trends, scatter plots for correlation, and heat maps for density.

Dashboards for performance measurement should use leading and lagging indicators and be linked to strategic objectives.

Data governance assigns ownership, stewardship and quality accountability; master data management maintains a single trusted source.

Emerging technology adoption should be assessed against business value, risk, cost and control implications, not novelty.

The auditor must document the use of automated tools, including the source of data, the procedures performed and the conclusions reached.

A digital audit trail must be complete, accurate and secure; system-generated reports used as audit evidence must be tested for completeness and accuracy.

Key IT risks: unauthorised access, data loss, system downtime, inadequate change control, and reliance on spreadsheets outside the controlled system.

Cloud provider assurance: review the service organisation's independent assurance report, the scope and period covered, and complementary user entity controls.

Data protection impact assessments are required where processing is likely to result in high risk to individuals.

Incident response stages: preparation, detection, containment, eradication, recovery and lessons learned.

Automation of controls can reduce human error but creates risk of systematic error affecting the whole population.

Analytics results should be corroborated with other audit evidence before conclusions are drawn.

Data extraction from an ERP should be performed by the auditor or observed, with record counts and control totals reconciled to the general ledger.

Machine learning models require validation of inputs, outputs and ongoing performance monitoring to detect model drift.

The audit committee should oversee significant technology projects and the associated risks.

Third-party risk management: due diligence, contractual controls, right to audit, and exit planning.

Business process automation requires controls over access to the automation tool and change control over the rules.

Analytics can support fraud detection through anomaly, duplicate and outlier testing, but results are indicators, not proof.

Data retention and disposal policies must balance legal requirements with privacy obligations.

Emerging technologies such as distributed ledgers, robotic process automation and artificial intelligence alter the evidence available to the auditor and the nature of controls.

A distributed ledger provides assurance over the integrity of recorded entries but not over the validity of the underlying transactions or the completeness of off-ledger activity.

Automated decision-making raises accountability and explainability issues; governance should ensure human review of significant decisions.

Analytics on the full population reduces sampling risk but introduces the risk of false positives; results still require professional judgement and corroboration.

Predictive analytics uses historical data to forecast outcomes; prescriptive analytics recommends actions; descriptive analytics summarises what happened.

The auditor's use of a data analytics tool does not remove the need to evaluate the reliability of the data extracted from the client's system.

Cybersecurity governance: the board sets risk appetite, management implements controls, and the audit committee oversees the control environment.

Data analytics lifecycle: define the question, obtain and validate data, clean and transform, analyse, interpret, and communicate; each stage carries a risk of error.

Sampling in analytics: random, systematic, stratified and monetary unit sampling; larger sample sizes reduce sampling risk but not non-sampling risk.

Visualisation should match the message: bar charts for comparison, line charts for trends, scatter plots for correlation, and heat maps for density.

Dashboards for performance measurement should use leading and lagging indicators and be linked to strategic objectives.

Data governance assigns ownership, stewardship and quality accountability; master data management maintains a single trusted source.

Emerging technology adoption should be assessed against business value, risk, cost and control implications, not novelty.

The auditor must document the use of automated tools, including the source of data, the procedures performed and the conclusions reached.

A digital audit trail must be complete, accurate and secure; system-generated reports used as audit evidence must be tested for completeness and accuracy.

Key IT risks: unauthorised access, data loss, system downtime, inadequate change control, and reliance on spreadsheets outside the controlled system.

Cloud provider assurance: review the service organisation's independent assurance report, the scope and period covered, and complementary user entity controls.

Data protection impact assessments are required where processing is likely to result in high risk to individuals.

Incident response stages: preparation, detection, containment, eradication, recovery and lessons learned.

Automation of controls can reduce human error but creates risk of systematic error affecting the whole population.

Analytics results should be corroborated with other audit evidence before conclusions are drawn.

Data extraction from an ERP should be performed by the auditor or observed, with record counts and control totals reconciled to the general ledger.

Machine learning models require validation of inputs, outputs and ongoing performance monitoring to detect model drift.

The audit committee should oversee significant technology projects and the associated risks.

Third-party risk management: due diligence, contractual controls, right to audit, and exit planning.

Business process automation requires controls over access to the automation tool and change control over the rules.

Analytics can support fraud detection through anomaly, duplicate and outlier testing, but results are indicators, not proof.

Data retention and disposal policies must balance legal requirements with privacy obligations.

Emerging technologies such as distributed ledgers, robotic process automation and artificial intelligence alter the evidence available to the auditor and the nature of controls.

A distributed ledger provides assurance over the integrity of recorded entries but not over the validity of the underlying transactions or the completeness of off-ledger activity.

Automated decision-making raises accountability and explainability issues; governance should ensure human review of significant decisions.

Analytics on the full population reduces sampling risk but introduces the risk of false positives; results still require professional judgement and corroboration.

Predictive analytics uses historical data to forecast outcomes; prescriptive analytics recommends actions; descriptive analytics summarises what happened.

The auditor's use of a data analytics tool does not remove the need to evaluate the reliability of the data extracted from the client's system.

Cybersecurity governance: the board sets risk appetite, management implements controls, and the audit committee oversees the control environment.

Data analytics lifecycle: define the question, obtain and validate data, clean and transform, analyse, interpret, and communicate; each stage carries a risk of error.

Sampling in analytics: random, systematic, stratified and monetary unit sampling; larger sample sizes reduce sampling risk but not non-sampling risk.

Visualisation should match the message: bar charts for comparison, line charts for trends, scatter plots for correlation, and heat maps for density.

Dashboards for performance measurement should use leading and lagging indicators and be linked to strategic objectives.

Data governance assigns ownership, stewardship and quality accountability; master data management maintains a single trusted source.

Emerging technology adoption should be assessed against business value, risk, cost and control implications, not novelty.

The auditor must document the use of automated tools, including the source of data, the procedures performed and the conclusions reached.

A digital audit trail must be complete, accurate and secure; system-generated reports used as audit evidence must be tested for completeness and accuracy.

Key IT risks: unauthorised access, data loss, system downtime, inadequate change control, and reliance on spreadsheets outside the controlled system.

Cloud provider assurance: review the service organisation's independent assurance report, the scope and period covered, and complementary user entity controls.

Data protection impact assessments are required where processing is likely to result in high risk to individuals.

Incident response stages: preparation, detection, containment, eradication, recovery and lessons learned.

Automation of controls can reduce human error but creates risk of systematic error affecting the whole population.

Analytics results should be corroborated with other audit evidence before conclusions are drawn.

Data extraction from an ERP should be performed by the auditor or observed, with record counts and control totals reconciled to the general ledger.

Machine learning models require validation of inputs, outputs and ongoing performance monitoring to detect model drift.

The audit committee should oversee significant technology projects and the associated risks.

Third-party risk management: due diligence, contractual controls, right to audit, and exit planning.

Business process automation requires controls over access to the automation tool and change control over the rules.

Analytics can support fraud detection through anomaly, duplicate and outlier testing, but results are indicators, not proof.

Data retention and disposal policies must balance legal requirements with privacy obligations.

Emerging technologies such as distributed ledgers, robotic process automation and artificial intelligence alter the evidence available to the auditor and the nature of controls.

A distributed ledger provides assurance over the integrity of recorded entries but not over the validity of the underlying transactions or the completeness of off-ledger activity.

Automated decision-making raises accountability and explainability issues; governance should ensure human review of significant decisions.

Analytics on the full population reduces sampling risk but introduces the risk of false positives; results still require professional judgement and corroboration.

Predictive analytics uses historical data to forecast outcomes; prescriptive analytics recommends actions; descriptive analytics summarises what happened.

The auditor's use of a data analytics tool does not remove the need to evaluate the reliability of the data extracted from the client's system.

Cybersecurity governance: the board sets risk appetite, management implements controls, and the audit committee oversees the control environment.

Data analytics lifecycle: define the question, obtain and validate data, clean and transform, analyse, interpret, and communicate; each stage carries a risk of error.

Sampling in analytics: random, systematic, stratified and monetary unit sampling; larger sample sizes reduce sampling risk but not non-sampling risk.

Visualisation should match the message: bar charts for comparison, line charts for trends, scatter plots for correlation, and heat maps for density.

Dashboards for performance measurement should use leading and lagging indicators and be linked to strategic objectives.

Data governance assigns ownership, stewardship and quality accountability; master data management maintains a single trusted source.

Emerging technology adoption should be assessed against business value, risk, cost and control implications, not novelty.

The auditor must document the use of automated tools, including the source of data, the procedures performed and the conclusions reached.

A digital audit trail must be complete, accurate and secure; system-generated reports used as audit evidence must be tested for completeness and accuracy.

Key IT risks: unauthorised access, data loss, system downtime, inadequate change control, and reliance on spreadsheets outside the controlled system.

Cloud provider assurance: review the service organisation's independent assurance report, the scope and period covered, and complementary user entity controls.

Data protection impact assessments are required where processing is likely to result in high risk to individuals.

Incident response stages: preparation, detection, containment, eradication, recovery and lessons learned.

Automation of controls can reduce human error but creates risk of systematic error affecting the whole population.

Analytics results should be corroborated with other audit evidence before conclusions are drawn.

Data extraction from an ERP should be performed by the auditor or observed, with record counts and control totals reconciled to the general ledger.

Machine learning models require validation of inputs, outputs and ongoing performance monitoring to detect model drift.

The audit committee should oversee significant technology projects and the associated risks.

Third-party risk management: due diligence, contractual controls, right to audit, and exit planning.

Business process automation requires controls over access to the automation tool and change control over the rules.

Analytics can support fraud detection through anomaly, duplicate and outlier testing, but results are indicators, not proof.

Data retention and disposal policies must balance legal requirements with privacy obligations.