Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p98
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 296104–299167

subject to risks arising from IT, the database(s) that stores the data processed by an identified IT application is typically also identified.  Similarly, because an IT application's ability to operate is often dependent on the operating system and IT applications and databases may be directly accessed from the operating system, the operating system is typically subject to risks arising from the use of IT.  The network may be identified when it is a central point of access to the identified IT applications and related databases or when an IT application interacts with vendors or external parties through the internet, or when web-facing IT applications are identified by the auditor.

Identifying Risks Arising from the Use of IT and General IT Controls

18.               Examples of risks arising from the use of IT include risks related to inappropriate reliance on IT applications that are inaccurately processing data, processing inaccurate data, or both, such as

           * Unauthorised access to data that may result in destruction of data or improper changes to data, including the recording of unauthorised or non-existent transactions, or inaccurate recording of transactions.  Particular risks may arise where multiple users access a common database.

           * The possibility of IT personnel gaining access privileges beyond those necessary to perform their assigned duties thereby breaking down segregation of duties.

           * Unauthorised changes to data in master files.

           * Unauthorised changes to IT applications or other aspects of the IT environment.

           * Failure to make necessary changes to IT applications or other aspects of the IT environment.

           * Inappropriate manual intervention.

           * Potential loss of data or inability to access data as required.

19.               The auditor's consideration of unauthorised access may include risks related to unauthorised access by internal or external parties (often referred to as cybersecurity risks).  Such risks may not necessarily affect financial reporting, as an entity's IT environment may also include IT applications and related data that address operational or compliance needs.  It is important to note that cyber incidents usually first occur through the perimeter and internal network layers, which tend to be further removed from the IT application, database and operating systems that affect the preparation of the financial report.  Accordingly, if information about a security breach has been identified, the auditor ordinarily considers the extent to which such a breach had the potential to affect financial reporting.  If financial reporting may be affected, the auditor may decide to understand, and test the related controls to determine the possible impact or scope of potential misstatements in the financial report or may determine that the entity has provided adequate disclosures in relation to such security breach.

20.               In addition, laws and regulations that may have a direct or indirect effect