Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p97
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 292039–296368

Stand-alone applications.                                                                                                                                                                                                              * Applications are interfaced.

      * The volume of data (transactions) is not significant.                                                                                                                                                                                  * The volume of data (transactions) is significant.

      * The application's functionality is not complex.                                                                                                                                                                                        * The application's functionality is complex as:

      * Each transaction is supported by original hard copy documentation.                                                                                                                                                                             + The application automatically initiates transactions; and

                                                                                                                                                                                                                                                       + There are a variety of complex calculations underlying automated entries.
IT application is likely not subject to risks arising from IT because:                                                                                                                                                                   IT application is likely subject to risks arising from IT because:

      * The volume of data is not significant and therefore management is not relying upon general IT controls to process or maintain the data.                                                                                                * Management relies on an application system to process or maintain data as the volume of data is significant.

      * Management does not rely on automated controls or other automated functionality.  The auditor has not identified automated controls in accordance with paragraph 26(a).                                                                * Management relies upon the application system to perform certain automated controls that the auditor has also identified.

      * Although management uses system-generated reports in their controls, it does not rely on these reports.  Instead, it reconciles the reports back to the hard copy documentation and verifies the calculations in the reports.

      * The auditor will directly test information produced by the entity used as audit evidence.

Other Aspects of the IT Environment that Are Subject to Risks Arising from the Use of IT

16.               When the auditor identifies IT applications that are subject to risks arising from the use of IT, other aspects of the IT environment are also typically subject to risks arising from the use of IT.  The IT infrastructure includes the databases, operating system, and network.  Databases store the data used by IT applications and may consist of many interrelated data tables.  Data in databases may also be accessed directly through database management systems by IT or other personnel with database administration privileges.  The operating system is responsible for managing communications between hardware, IT applications, and other software used in the network.  As such, IT applications and databases may be directly accessed through the operating system.  A network is used in the IT infrastructure to transmit data and to share information, resources and services through a common communications link.  The network also typically establishes a layer of logical security (enabled through the operating system) for access to the underlying resources.

17.               When IT applications are identified by the auditor to be subject to risks arising from IT, the database(s) that stores the data processed by an identified IT application is typically also identified.  Similarly, because an IT application's ability to operate is often dependent on the operating system and IT applications