Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p54
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 158635–161398

applications as being subject to risks arising from IT.

Scalability

A170.      The extent of the auditor's understanding of the IT processes, including the extent to which the entity has general IT controls in place, will vary with the nature and the circumstances of the entity and its IT environment, as well as based on the nature and extent of controls identified by the auditor.  The number of IT applications that are subject to risks arising from the use of IT also will vary based on these factors.
Examples:

      * An entity that uses commercial software and does not have access to the source code to make any program changes is unlikely to have a process for program changes, but may have a process or procedures to configure the software (e.g., the chart of accounts, reporting parameters or thresholds).  In addition, the entity may have a process or procedures to manage access to the application (e.g., a designated individual with administrative access to the commercial software).  In such circumstances, the entity is unlikely to have or need formalised general IT controls.

      * In contrast, a larger entity may rely on IT to a great extent and the IT environment may involve multiple IT applications and the IT processes to manage the IT environment may be complex (e.g., a dedicated IT department exists that develops and implements program changes and manages access rights), including that the entity has implemented formalised general IT controls over its IT processes.

      * When management is not relying on automated controls or general IT controls to process transactions or maintain the data, and the auditor has not identified any automated controls or other information processing controls (or any that depend on general IT controls), the auditor may plan to directly test any information produced by the entity involving IT and may not identify any IT applications that are subject to risks arising from the use of IT.

      * When management relies on an IT application to process or maintain data and the volume of data is significant, and management relies upon the IT application to perform automated controls that the auditor has also identified, the IT application is likely to be subject to risks arising from the use of IT.

A171.      When an entity has greater complexity in its IT environment, identifying the IT applications and other aspects of the IT environment, determining the related risks arising from the use of IT, and identifying general IT controls is likely to require the involvement of team members with specialised skills in IT.  Such involvement is likely to be essential, and may need to be extensive, for complex IT environments.

Identifying other aspects of the IT environment that are