Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p96
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 289192–292907

tools are not typically identified as IT applications in the context of paragraph 26(b).  Designing and implementing controls around access and change to end-user computing tools may be challenging, and such controls are rarely equivalent to, or as effective as, general IT controls.  Rather, the auditor may consider a combination of information processing controls, taking into account the purpose and complexity of the end-user computing involved, such as:

           * Information processing controls over the initiation and processing of the source data, including relevant automated or interface controls to the point from which the data is extracted (i.e., the data warehouse);

           * Controls to check that the logic is functioning as intended, for example, controls which 'prove' the extraction of data, such as reconciling the report to the data from which it was derived, comparing the individual data from the report to the source and vice versa, and controls which check the formulas or macros; or

           * Use of validation software tools, which systematically check formulas or macros, such as spreadsheet integrity tools.

Scalability

15.               The entity's ability to maintain the integrity of information stored and processed in the information system may vary based on the complexity and volume of the related transactions and other information.  The greater the complexity and volume of data that supports a significant class of transactions, account balance or disclosure, the less likely it may become for the entity to maintain integrity of that information through information processing controls alone (e.g., input and output controls or review controls).  It also becomes less likely that the auditor will be able to obtain audit evidence about the completeness and accuracy of such information through substantive testing alone when such information is used as audit evidence.  In some circumstances, when volume and complexity of transactions are lower, management may have an information processing control that is sufficient to verify the accuracy and completeness of the data (e.g., individual sales orders processed and billed may be reconciled to the hard copy originally entered into the IT application).  When the entity relies on general IT controls to maintain the integrity of certain information used by IT applications, the auditor may determine that the IT applications that maintain that information are subject to risks arising from the use of IT.
Example characteristics of an IT application that is likely not subject to risks arising from IT                                                                                                                                         Example characteristics of an IT application that is likely subject to risks arising from IT
      * Stand-alone applications.                                                                                                                                                                                                              * Applications are interfaced.

      * The volume of data (transactions) is not significant.                                                                                                                                                                                  * The volume of data (transactions) is significant.

      * The application's functionality is not complex.                                                                                                                                                                                        * The application's functionality is complex as:

      * Each transaction