Document ID: chunk:federal_register_of_legislation:F2021C01250:reg:27:p14
Version: federal_register_of_legislation:F2021C01250
Segment Type: reg
Provision Reference: reg 27 (pt 14/23)
Character Range: 46680–49558

is functioning as intended (which could be done at the time the control is initially implemented or at some other date), the auditor may consider performing tests to determine that the control continues to function effectively.  Such tests may include testing the general IT controls related to the IT application.

A30.         Similarly, the auditor may perform tests of controls that address risks of material misstatement related to the integrity of the entity's data, or the completeness and accuracy of the entity's system-generated reports, or to address risks of material misstatement for which substantive procedures alone cannot provide sufficient appropriate audit evidence. These tests of controls may include tests of general IT controls that address the matters in paragraph 10(a). When this is the case, the auditor may not need to perform any further testing to obtain audit evidence about the matters in paragraph 10(a).

A31.         When the auditor determines that a general IT control is deficient, the auditor may consider the nature of the related risk(s) arising from the use of IT that were identified in accordance with ASA 315[6] to provide the basis for the design of the auditor's additional procedures to address the assessed risk of material misstatement. Such procedures may address determining whether:

           * The related risk(s) arising from IT has occurred. For example, if users have unauthorised access to an IT application (but cannot access or modify the system logs that track access), the auditor may inspect the system logs to obtain audit evidence that those users did not access the IT application during the period.

           * There are any alternate or redundant general IT controls, or any other controls, that address the related risk(s) arising from the use of IT. If so, the auditor may identify such controls (if not already identified) and therefore evaluate their design, determine that they have been implemented and perform tests of their operating effectiveness. For example, if a general IT control related to user access is deficient, the entity may have an alternate control whereby IT management reviews end user access reports on a timely basis. Circumstances when an application control may address a risk arising from the use of IT may include when the information that may be affected by the general IT control deficiency can be reconciled to external sources (e.g., a bank statement) or internal sources not affected by the general IT control deficiency (e.g., a separate IT application or data source).

Testing of indirect controls (Ref: Para. 10(b))

A32.         In some circumstances, it may be necessary to obtain audit evidence supporting the effective operation of indirect controls (e.g., general IT controls). As explained in paragraphs A29 to A31, general IT controls may have been identified