Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p52
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 153337–156318

other aspects of the IT environment (Ref: Para. 26(b))

Why the auditor identifies risks arising from the use of IT and general IT controls related to identified IT applications and other aspects of the IT environment

A166.      Understanding the risks arising from the use of IT and the general IT controls implemented by the entity to address those risks may affect:

           * The auditor's decision about whether to test the operating effectiveness of controls to address risks of material misstatement at the assertion level;
Example:

When general IT controls are not designed effectively or appropriately implemented to address risks arising from the use of IT (e.g., controls do not appropriately prevent or detect unauthorised program changes or unauthorised access to IT applications), this may affect the auditor's decision to rely on automated controls within the affected IT applications.

           * The auditor's assessment of control risk at the assertion level;
Example:

The ongoing operating effectiveness of an information processing control may depend on certain general IT controls that prevent or detect unauthorised program changes to the IT information processing control (i.e., program change controls over the related IT application).  In such circumstances, the expected operating effectiveness (or lack thereof) of the general IT control may affect the auditor's assessment of control risk (e.g., control risk may be higher when such general IT controls are expected to be ineffective or if the auditor does not plan to test the general IT controls).

           * The auditor's strategy for testing information produced by the entity that is produced by or involves information from the entity's IT applications;
Example:

When information produced by the entity to be used as audit evidence is produced by IT applications, the auditor may determine to test controls over system-generated reports, including identification and testing of the general IT controls that address risks of inappropriate or unauthorised program changes or direct data changes to the reports.

           * The auditor's assessment of inherent risk at the assertion level; or
Example:

When there are significant or extensive programming changes to an IT application to address new or revised reporting requirements of the applicable financial reporting framework, this may be an indicator of the complexity of the new requirements and their effect on the entity's financial report.  When such extensive programming or data changes occur, the IT application is also likely to be subject to risks arising from the use of IT.

           * The design of further audit procedures.
Example:

If information processing controls depend on general IT controls, the auditor may determine to test the operating effectiveness of the general IT controls, which will then require the design of tests of controls for such general IT controls.  If, in the same circumstances,