Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p93
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 281128–284083

of IT.  While emerging technologies may be seen to be more sophisticated or more complex compared to existing technologies, the auditor's responsibilities in relation to IT applications and identified general IT controls in accordance with paragraph 26(b)‒(c) remain unchanged.

Scalability

6.                   Obtaining an understanding of the entity's IT environment may be more easily accomplished for a less complex entity that uses commercial software and when the entity does not have access to the source code to make any program changes.  Such entities may not have dedicated IT resources but may have a person assigned in an administrator role for the purpose of granting employee access or installing vendor-provided updates to the IT applications.  Specific matters that the auditor may consider in understanding the nature of a commercial accounting software package, which may be the single IT application used by a less complex entity in its information system, may include:

           * The extent to which the software is well established and has a reputation for reliability;

           * The extent to which it is possible for the entity to modify the source code of the software to include additional modules (i.e., add-ons) to the base software, or to make direct changes to data;

           * The nature and extent of modifications that have been made to the software.  Although an entity may not be able to modify the source code of the software, many software packages allow for configuration (e.g., setting or amending reporting parameters).  These do not usually involve modifications to source code; however, the auditor may consider the extent to which the entity is able to configure the software when considering the completeness and accuracy of information produced by the software that is used as audit evidence; and

           * The extent to which data related to the preparation of the financial report can be directly accessed (i.e., direct access to the database without using the IT application) and the volume of data that is processed.  The greater the volume of data, the more likely the entity may need controls that address maintaining the integrity of the data, which may include general IT controls over unauthorised access and changes to the data.

7.                   Complex IT environments may include highly-customised or highly-integrated IT applications and may therefore require more effort to understand.  Financial reporting processes or IT applications may be integrated with other IT applications.  Such integration may involve IT applications that are used in the entity's business operations and that provide information to the IT applications relevant to the flows of transactions and information processing in the entity's information system.  In such circumstances, certain IT applications used in the entity's business operations may also be relevant to the preparation of the financial