In the process of conducting an IT Audit, the auditor needs to confirm whether a specific IT General Control (ITGC) is operating effectively. In order to verify this, a combination of procedures needs to be utilized. These include but are not limited to inquiry, observation, inspection of evidence obtained from the performance of the ITGC. The IT Auditor also needs to identify the critical controls. Critical controls can be identified by looking at applications that support controls for significant accounts with a higher risk of material misstatement.
The manual or automated nature of an ITGC can have an impact on the evidence available to support the functioning of the ITGC and the nature of the audit process needed to obtain reasonable assurance regarding whether the ITGC is operating effectively through period of the audit. It should be noted that in addition to evidence available regarding the performance of the ITGC, it is essential to obtain evidence regarding the effectiveness of the control as well.
The population to be used for selecting a sample and the evidence used to support automated ITGCs should be systematically generated from the relevant technology source. If system-generated evidence cannot be obtained, other additional procedures will be needed to verify the effectiveness of the controls.
It is possible that the same ITGC exists for multiple applications of the IT environment; here it might be possible to select a single testing sample for the entire population of items affected by the ITGC. While testing, one must consider that the testing is being conducted by process rather than by technology and therefore the sample selected must be consistent in that direction. This approach allows the auditor to lower the number of samples while still testing for relevant applications and other components of the IT environment.
The period over which ITGCs are to be tested will vary depending upon the type of ITGCs being tested, policies related to the ITGC as also the frequency with which the controls operate. For example, some controls operate continuously (e.g. password configuration settings applied to an application) while others operate periodically (User access reviews).
Conclusion:
While performing testing of ITGCs, it is important to note that if the auditor relies to a greater degree on the given ITGC, it will be essential for the auditor to obtain greater confidence that the given ITGC is operating appropriately and effectively through the audit period.
Be the first to rate this post
- Currently 0/5 Stars.
- 1
- 2
- 3
- 4
- 5