Document ID: chunk:federal_register_of_legislation:F2020L00252:body:0:p23
Version: federal_register_of_legislation:F2020L00252
Segment Type: other
Provision Reference: 
Character Range: 64967–68001

audit evidence at the assertion level.[4] This may occur when an entity conducts its business using IT and no documentation of transactions is produced or maintained, other than through the IT system.  In such cases, paragraph 8(b) requires the auditor to perform tests of relevant controls that address the risk for which substantive procedures alone cannot provide sufficient appropriate audit evidence.

89.               Existing paragraph A27 is amended to read as follows:

The nature of the particular control influences the type of procedure required to obtain audit evidence about whether the control was operating effectively.  For example, if operating effectiveness is evidenced by documentation, the auditor may decide to inspect it to obtain audit evidence about operating effectiveness.  For other controls, however, documentation may not be available or relevant.  For example, documentation of operation may not exist for some factors in the control environment, such as assignment of authority and responsibility, or for some types of controls activities, such as automated controls activities performed by a computer.  In such circumstances, audit evidence about operating effectiveness may be obtained through enquiry in combination with other audit procedures such as observation or the use of CAATs.

90.               Existing paragraph A29 is amended to read as follows:

Because of the inherent consistency of IT processing, it may not be necessary to increase the extent of testing of an automated control.  An automated controls can be expected to function consistently unless the program IT application (including the tables, files, or other permanent data used by the program IT application) is changed.  Once the auditor determines that an automated control is functioning as intended (which could be done at the time the control is initially implemented or at some other date), the auditor may consider performing tests to determine that the control continues to function effectively.  Such tests might may include testing the general IT controls related to the IT application. determining that:

           * Changes to the program are not made without being subject to the appropriate program change controls;

           * The authorised version of the program is used for processing transactions; and

           * Other relevant general controls are effective.

Such tests also might include determining that changes to the programs have not been made, as may be the case when the entity uses packaged software applications without modifying or maintaining them.  For example, the auditor may inspect the record of the administration of IT security to obtain audit evidence that unauthorised access has not occurred during the period.

91.               The following paragraph A30 is inserted following existing paragraph A29 of this Auditing Standard:

Similarly, the auditor may perform tests of controls that address risks of material misstatement related to the integrity of the entity's data,