[section separator="true"]
[section-item 9]
[row]
[column 12]
[toc-this]
Principles
We take account of information technology (IT) – computers, storage, networking and other physical devices, infrastructure and processes – in our work throughout the audit process.
During the annual work programme process, we consider whether it is necessary to propose an IT audit as a separate task.
For all other audit tasks, as part of our risk assessment, we assess the impact of IT on the [multi-link title="objectives%20of%20the%20audit" link_1="%2Faware%2FPA%2FPages%2FPlanning%2FDeveloping-audit-questions.aspx" title_1="Objectives%20PA" link_2="%2Faware%2FCA%2FPages%2FConcepts%2FObjectives-of-compliance-audit.aspx" title_2="Objectives%20CA" link_3="%2Faware%2FFA%2FPages%2FConcepts%2FObjectives-of-reliability-audits.aspx" title_3="Objectives%20FA" /]
. We then determine whether to cover IT risks as part of the audit.
Instructions
When getting to know the audit area, determine the extent to which the audit subject is impacted by IT, and how critical they are to the reliability, regularity or performance of the processes and/or transactions.
To perform this assessment, consider the extent to which the audit objectives are affected if:
- the auditee is highly dependent on IT systems for the operation of the area in question;
- audit work is likely to be based on data sourced from, or reliant on data extracted from IT systems;
- the audit area includes complex processing and dataflows involving one or more IT systems and/or controls; and
- the audit area depends critically on IT system availability, responsiveness, security, storage, etc.
ISA 315, Appendix 5: Considerations for Understanding Information Technology (IT) provides further details on performing this assessment. A positive response to one or more of the points above may indicate that the audit area is significantly impacted by IT. If you consider that this is likely to affect the audit objectives, ask for an [link new-window title="initial%20assessment" link="%2Faware%2FGAP%2FPages%2FIT-Audit-deciding.aspx" /]
by the DATA team’s IT audit experts, who will determine the type and extent of IT audit work that is feasible and should prove useful to address the risks identified. Some of this work could also be done in part or in whole by members of the audit team qualified to do so. Include the proposed IT audit work in the [multi-link title="task%20plan" link_1="%2Faware%2FGAP%2FPages%2FCA-FA%2FPlanning%2Ftask-plan-audit-programme.aspx" title_1="Compliance%20and%20financial" link_2="%2Faware%2FPA%2FPages%2FPlanning%2Ftask-plan.aspx" title_2="Performance" /]
.
[/toc-this]
[/column]
[/row]
[/section-item]
[section-item 3]
[row]
[column 12][/column]
[/row]
[row]
[column 12]
[toc fixed="true" selectors="h2%2Ch3" class="basic-toc" /]
[/column]
[/row]
[/section-item]
[/section]
