Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p90
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 267813–272429

ability to monitor the performance of the entity's activities and its policies and procedures;

           * Reduce the risk that controls will be circumvented; and

           * Enhance the ability to achieve effective segregation of duties by implementing security controls in IT applications, databases and operating systems.

2.                   The characteristics of manual or automated elements are relevant to the auditor's identification and assessment of the risks of material misstatement, and further audit procedures based thereon.  Automated controls may be more reliable than manual controls because they cannot be as easily bypassed, ignored, or overridden, and they are also less prone to simple errors and mistakes.  Automated controls may be more effective than manual controls in the following circumstances:

           * High volume of recurring transactions, or in situations where errors that can be anticipated or predicted can be prevented, or detected and corrected, through automation.

           * Controls where the specific ways to perform the control can be adequately designed and automated.

Understanding the Entity's Use of Information Technology in the Information System (Ref: Para. 25(a))

3.                   The entity's information system may include the use of manual and automated elements, which also affect the manner in which transactions are initiated, recorded, processed, and reported.  In particular, procedures to initiate, record, process and report transactions may be enforced through the IT applications used by the entity, and how the entity has configured those applications.  In addition, records in the form of digital information may replace or supplement records in the form of paper documents.

4.                   In obtaining an understanding of the IT environment relevant to the flows of transactions and information processing in the information system, the auditor gathers information about the nature and characteristics of the IT applications used, as well as the supporting IT infrastructure and IT.  The following table includes examples of matters that the auditor may consider in obtaining the understanding of the IT environment and includes examples of typical characteristics of IT environments based on the complexity of IT applications used in the entity's information system.  However, such characteristics are directional and may differ depending on the nature of the specific IT applications in use by an entity.
                                                                                                                                                                                                                                                                                        Examples of typical characteristics of:
                                                                                                                                                                                                                                                                                        Non-complex commercial software                                                                 Mid-size and moderately complex commercial software or IT applications                                                                                           Large or complex IT applications (e.g., ERP systems)

Matters related to extent of automation and use of data:
      * The extent of automated procedures for processing, and the complexity of those procedures, including, whether there is highly automated, paperless processing.                                                                                                                  N/A                                                                                             N/A                                                                                                                                                              Extensive and often complex automated procedures
      * The extent of the entity's reliance on system-generated reports in the processing of information.                                                                                                                                                                               Simple automated report logic                                                                   Simple relevant automated report logic                                                                                                                           Complex automated report