Audit in an Automated Environment: Notes | Auditing and Ethics for CA Intermediate PDF Download

 Page 1


 
 
LEARNING OUTCOMES 
 
 
AUDIT IN AN AUTOMATED 
ENVIRONMENT 
 
After studying this chapter, you will be able to: 
? Understand the meaning of an Automated environment. 
? Understand the relevance of IT in an audit. 
? Learn how to perform an understanding of an Automated environment and 
documenting the same. 
? Identify the various risks in Automated environment and the corresponding 
controls. 
? Gain knowledge of internal financial controls as per regulatory
requirements. 
? Recognize the way data analytics can be used in an audit. 
? Learn to assess and report audit findings. 
CHAPTER 
6 
Page 2


 
 
LEARNING OUTCOMES 
 
 
AUDIT IN AN AUTOMATED 
ENVIRONMENT 
 
After studying this chapter, you will be able to: 
? Understand the meaning of an Automated environment. 
? Understand the relevance of IT in an audit. 
? Learn how to perform an understanding of an Automated environment and 
documenting the same. 
? Identify the various risks in Automated environment and the corresponding 
controls. 
? Gain knowledge of internal financial controls as per regulatory
requirements. 
? Recognize the way data analytics can be used in an audit. 
? Learn to assess and report audit findings. 
CHAPTER 
6 
 
 
6.2 
 
AUDITING AND ASSURANCE 
 
Think on the following:  
Confirmation of  a Movie ticket online   
Online payment of taxes or bills  
Internet Banking & use of Debit & Credit Cards 
Using an ATM to withdraw cash  
Office meetings through Video-conferencing  
All these are the fruits we reap from “Modern Technology and Automated 
Computer Systems”. With the increasing adoption of information technology, 
business today rely on software systems and applications more than ever. Many of 
these IT systems generate and process data that is used in the preparation of 
?nancial statements of a company. The auditors also often rely on the data and 
reports that are generated from these systems. In this context, it is critical to 
understand the IT speci?c risks that could potentially impact the integrity and 
reliability of ?nancial transactions and data ?owing through a company’s systems. 
In this chapter, we will learn about the need, relevance and approach to be 
adopted when performing an audit in an Automated environment that is driven 
by IT systems and applications that are used in the preparation of ?nancial 
statements of a company. We will see how the work performed with respect to 
Automated environment ?ts into the overall ?nancial statement audit process. We 
will also understand how data analytics can become useful in an audit. 
Finally, we will look at how to assess audit ?ndings and report them to the 
stakeholders. 
1. WHAT IS AN AUTOMATED ENVIRONMENT? 
Let us ?rst understand what the term “Automated Environment” means. An 
automated environment basically refers to a business environment where the 
processes, operations, accounting and even decisions are carried out by using 
computer systems – also known as Information Systems (IS) or Information 
Technology (IT) systems. Nowadays, it is very common to see computer systems 
being used in almost every type of business. 
 
Page 3


 
 
LEARNING OUTCOMES 
 
 
AUDIT IN AN AUTOMATED 
ENVIRONMENT 
 
After studying this chapter, you will be able to: 
? Understand the meaning of an Automated environment. 
? Understand the relevance of IT in an audit. 
? Learn how to perform an understanding of an Automated environment and 
documenting the same. 
? Identify the various risks in Automated environment and the corresponding 
controls. 
? Gain knowledge of internal financial controls as per regulatory
requirements. 
? Recognize the way data analytics can be used in an audit. 
? Learn to assess and report audit findings. 
CHAPTER 
6 
 
 
6.2 
 
AUDITING AND ASSURANCE 
 
Think on the following:  
Confirmation of  a Movie ticket online   
Online payment of taxes or bills  
Internet Banking & use of Debit & Credit Cards 
Using an ATM to withdraw cash  
Office meetings through Video-conferencing  
All these are the fruits we reap from “Modern Technology and Automated 
Computer Systems”. With the increasing adoption of information technology, 
business today rely on software systems and applications more than ever. Many of 
these IT systems generate and process data that is used in the preparation of 
?nancial statements of a company. The auditors also often rely on the data and 
reports that are generated from these systems. In this context, it is critical to 
understand the IT speci?c risks that could potentially impact the integrity and 
reliability of ?nancial transactions and data ?owing through a company’s systems. 
In this chapter, we will learn about the need, relevance and approach to be 
adopted when performing an audit in an Automated environment that is driven 
by IT systems and applications that are used in the preparation of ?nancial 
statements of a company. We will see how the work performed with respect to 
Automated environment ?ts into the overall ?nancial statement audit process. We 
will also understand how data analytics can become useful in an audit. 
Finally, we will look at how to assess audit ?ndings and report them to the 
stakeholders. 
1. WHAT IS AN AUTOMATED ENVIRONMENT? 
Let us ?rst understand what the term “Automated Environment” means. An 
automated environment basically refers to a business environment where the 
processes, operations, accounting and even decisions are carried out by using 
computer systems – also known as Information Systems (IS) or Information 
Technology (IT) systems. Nowadays, it is very common to see computer systems 
being used in almost every type of business. 
 
 
 
6.3 
 
 AUDIT IN AN AUTOMATED ENVIRONMENT 
Example 
Think about how banking transactions are carried out using ATMs (Automated 
Teller Machines), or how tickets can be purchased using “apps” on mobile phones, 
etc. In these examples, you can see how these computer systems enable us to 
transact business at any time and any day. 
Some of the key features of an automated environment are as follows: 
1.1 Key features of an Automated Environment 
The fundamental principle of an automated environment is the ability to carry out 
business with less manual intervention and more system driven. The complexity of 
a business environment depends on the level of automation i.e., if a business 
environment is more automated, it is likely to be more complex. 
 
If a company uses an integrated enterprise resource planning system (ERP) viz., 
SAP, Oracle etc., then it is considered more complex to audit. On the other hand, 
if a company is using an o?-the-shelf accounting software, then it is likely to be 
less automated and hence less complex environment. 
Example 
Similarly, there are several other aspects that an auditor should consider to 
determine the level of automation and complexity of a business environment 
which we will look at in the following sections. 
Page 4


 
 
LEARNING OUTCOMES 
 
 
AUDIT IN AN AUTOMATED 
ENVIRONMENT 
 
After studying this chapter, you will be able to: 
? Understand the meaning of an Automated environment. 
? Understand the relevance of IT in an audit. 
? Learn how to perform an understanding of an Automated environment and 
documenting the same. 
? Identify the various risks in Automated environment and the corresponding 
controls. 
? Gain knowledge of internal financial controls as per regulatory
requirements. 
? Recognize the way data analytics can be used in an audit. 
? Learn to assess and report audit findings. 
CHAPTER 
6 
 
 
6.2 
 
AUDITING AND ASSURANCE 
 
Think on the following:  
Confirmation of  a Movie ticket online   
Online payment of taxes or bills  
Internet Banking & use of Debit & Credit Cards 
Using an ATM to withdraw cash  
Office meetings through Video-conferencing  
All these are the fruits we reap from “Modern Technology and Automated 
Computer Systems”. With the increasing adoption of information technology, 
business today rely on software systems and applications more than ever. Many of 
these IT systems generate and process data that is used in the preparation of 
?nancial statements of a company. The auditors also often rely on the data and 
reports that are generated from these systems. In this context, it is critical to 
understand the IT speci?c risks that could potentially impact the integrity and 
reliability of ?nancial transactions and data ?owing through a company’s systems. 
In this chapter, we will learn about the need, relevance and approach to be 
adopted when performing an audit in an Automated environment that is driven 
by IT systems and applications that are used in the preparation of ?nancial 
statements of a company. We will see how the work performed with respect to 
Automated environment ?ts into the overall ?nancial statement audit process. We 
will also understand how data analytics can become useful in an audit. 
Finally, we will look at how to assess audit ?ndings and report them to the 
stakeholders. 
1. WHAT IS AN AUTOMATED ENVIRONMENT? 
Let us ?rst understand what the term “Automated Environment” means. An 
automated environment basically refers to a business environment where the 
processes, operations, accounting and even decisions are carried out by using 
computer systems – also known as Information Systems (IS) or Information 
Technology (IT) systems. Nowadays, it is very common to see computer systems 
being used in almost every type of business. 
 
 
 
6.3 
 
 AUDIT IN AN AUTOMATED ENVIRONMENT 
Example 
Think about how banking transactions are carried out using ATMs (Automated 
Teller Machines), or how tickets can be purchased using “apps” on mobile phones, 
etc. In these examples, you can see how these computer systems enable us to 
transact business at any time and any day. 
Some of the key features of an automated environment are as follows: 
1.1 Key features of an Automated Environment 
The fundamental principle of an automated environment is the ability to carry out 
business with less manual intervention and more system driven. The complexity of 
a business environment depends on the level of automation i.e., if a business 
environment is more automated, it is likely to be more complex. 
 
If a company uses an integrated enterprise resource planning system (ERP) viz., 
SAP, Oracle etc., then it is considered more complex to audit. On the other hand, 
if a company is using an o?-the-shelf accounting software, then it is likely to be 
less automated and hence less complex environment. 
Example 
Similarly, there are several other aspects that an auditor should consider to 
determine the level of automation and complexity of a business environment 
which we will look at in the following sections. 
 
 
6.4 
 
AUDITING AND ASSURANCE 
2. RELEVANCE OF ‘IT’ IN AN AUDIT 
When a business operates in a more automated environment it is likely that we will 
see several business functions and activities happening within the systems. 
Consider the following aspects instead of: 
? Computation and Calculations are automatically carried out (for example, 
bank interest computation and inventory valuation). 
? Accounting entries are posted automatically (for example, sub-ledger to GL 
postings are automatic). 
? Business policies and procedures, including internal controls, are applied 
automatically (for example, delegation of authority for journal approvals, 
customer credit limit checks are performed automatically). 
? Reports used in business are produced from systems. Management and 
other stakeholders rely on these reports and information produced (for 
example, debtors ageing report). 
? User access and security are controlled by assigning system roles to users 
(for example, segregation of duties can be enforced e?ectively). 
Companies derive bene?t from the use of IT systems as an enabler to support 
various business operations and activities. Auditors need to understand the 
relevance of these IT systems to an audit of ?nancial statements. 
While it is true that the use of IT systems and automation bene?t the business by 
making operations more accurate, reliable, e?ective and e?cient, such systems 
also introduce certain new risks, including IT speci?c risks, which need to be 
considered, assessed and addressed by management. 
To the extent that it is relevant to an audit of ?nancial statements, even auditors 
are required to understand, assess and respond to such risks that arise from the 
use of IT systems. 
[Note: Students may refer SA 315 – Identifying and assessing the risks of 
material misstatement through understanding the entity and its environment 
for detailed understanding] 
In an audit of ?nancial statements, the primary focus is around those risks that are 
relevant to ?nancial reporting. However, there could be other non-audit assurance 
engagements that auditors maybe involved wherein the area of focus could 
include those IT risks relevant to company’s compliance and business operations in 
Page 5


 
 
LEARNING OUTCOMES 
 
 
AUDIT IN AN AUTOMATED 
ENVIRONMENT 
 
After studying this chapter, you will be able to: 
? Understand the meaning of an Automated environment. 
? Understand the relevance of IT in an audit. 
? Learn how to perform an understanding of an Automated environment and 
documenting the same. 
? Identify the various risks in Automated environment and the corresponding 
controls. 
? Gain knowledge of internal financial controls as per regulatory
requirements. 
? Recognize the way data analytics can be used in an audit. 
? Learn to assess and report audit findings. 
CHAPTER 
6 
 
 
6.2 
 
AUDITING AND ASSURANCE 
 
Think on the following:  
Confirmation of  a Movie ticket online   
Online payment of taxes or bills  
Internet Banking & use of Debit & Credit Cards 
Using an ATM to withdraw cash  
Office meetings through Video-conferencing  
All these are the fruits we reap from “Modern Technology and Automated 
Computer Systems”. With the increasing adoption of information technology, 
business today rely on software systems and applications more than ever. Many of 
these IT systems generate and process data that is used in the preparation of 
?nancial statements of a company. The auditors also often rely on the data and 
reports that are generated from these systems. In this context, it is critical to 
understand the IT speci?c risks that could potentially impact the integrity and 
reliability of ?nancial transactions and data ?owing through a company’s systems. 
In this chapter, we will learn about the need, relevance and approach to be 
adopted when performing an audit in an Automated environment that is driven 
by IT systems and applications that are used in the preparation of ?nancial 
statements of a company. We will see how the work performed with respect to 
Automated environment ?ts into the overall ?nancial statement audit process. We 
will also understand how data analytics can become useful in an audit. 
Finally, we will look at how to assess audit ?ndings and report them to the 
stakeholders. 
1. WHAT IS AN AUTOMATED ENVIRONMENT? 
Let us ?rst understand what the term “Automated Environment” means. An 
automated environment basically refers to a business environment where the 
processes, operations, accounting and even decisions are carried out by using 
computer systems – also known as Information Systems (IS) or Information 
Technology (IT) systems. Nowadays, it is very common to see computer systems 
being used in almost every type of business. 
 
 
 
6.3 
 
 AUDIT IN AN AUTOMATED ENVIRONMENT 
Example 
Think about how banking transactions are carried out using ATMs (Automated 
Teller Machines), or how tickets can be purchased using “apps” on mobile phones, 
etc. In these examples, you can see how these computer systems enable us to 
transact business at any time and any day. 
Some of the key features of an automated environment are as follows: 
1.1 Key features of an Automated Environment 
The fundamental principle of an automated environment is the ability to carry out 
business with less manual intervention and more system driven. The complexity of 
a business environment depends on the level of automation i.e., if a business 
environment is more automated, it is likely to be more complex. 
 
If a company uses an integrated enterprise resource planning system (ERP) viz., 
SAP, Oracle etc., then it is considered more complex to audit. On the other hand, 
if a company is using an o?-the-shelf accounting software, then it is likely to be 
less automated and hence less complex environment. 
Example 
Similarly, there are several other aspects that an auditor should consider to 
determine the level of automation and complexity of a business environment 
which we will look at in the following sections. 
 
 
6.4 
 
AUDITING AND ASSURANCE 
2. RELEVANCE OF ‘IT’ IN AN AUDIT 
When a business operates in a more automated environment it is likely that we will 
see several business functions and activities happening within the systems. 
Consider the following aspects instead of: 
? Computation and Calculations are automatically carried out (for example, 
bank interest computation and inventory valuation). 
? Accounting entries are posted automatically (for example, sub-ledger to GL 
postings are automatic). 
? Business policies and procedures, including internal controls, are applied 
automatically (for example, delegation of authority for journal approvals, 
customer credit limit checks are performed automatically). 
? Reports used in business are produced from systems. Management and 
other stakeholders rely on these reports and information produced (for 
example, debtors ageing report). 
? User access and security are controlled by assigning system roles to users 
(for example, segregation of duties can be enforced e?ectively). 
Companies derive bene?t from the use of IT systems as an enabler to support 
various business operations and activities. Auditors need to understand the 
relevance of these IT systems to an audit of ?nancial statements. 
While it is true that the use of IT systems and automation bene?t the business by 
making operations more accurate, reliable, e?ective and e?cient, such systems 
also introduce certain new risks, including IT speci?c risks, which need to be 
considered, assessed and addressed by management. 
To the extent that it is relevant to an audit of ?nancial statements, even auditors 
are required to understand, assess and respond to such risks that arise from the 
use of IT systems. 
[Note: Students may refer SA 315 – Identifying and assessing the risks of 
material misstatement through understanding the entity and its environment 
for detailed understanding] 
In an audit of ?nancial statements, the primary focus is around those risks that are 
relevant to ?nancial reporting. However, there could be other non-audit assurance 
engagements that auditors maybe involved wherein the area of focus could 
include those IT risks relevant to company’s compliance and business operations in 
 
 
6.5 
 
 AUDIT IN AN AUTOMATED ENVIRONMENT 
addition to ?nancial reporting risks. 
Examples of such non-audit assurance engagements are internal audits, IT audits, 
pre-implementation reviews, data migration audits, third party assurance. 
With the introduction of the Companies Act 2013, there is greater emphasis given to 
internal ?nancial controls (IFC) from a regulatory point of view.  Directors and those 
charged with governance (including Board of directors, Audit committee) are responsible 
for the implementation of internal controls framework within the company. The auditors’ 
responsibilities now include reporting on Internal Financial Controls over Financial 
Reporting which include and understanding IT environment of the company and 
relevant risks & controls. We will learn more about IFC in further sections of this chapter. 
Given below are some situations in which IT will be relevant to an audit, 
? Increased use of Systems and Application software in Business (for example, 
use of ERPs) 
? Complexity of transactions has increased (multiple systems, network of 
systems) 
? Hi-tech nature of business (Telecom, e-Commerce). 
? Volume of transactions are high (Insurance, Banking, Railways ticketing). 
? Company Policy (Compliance). 
? Regulatory requirements - Companies Act 2013 IFC, IT Act 2008. 
? Required by Indian and International Standards - ISO, PCI-DSS, SA 315, SOC, 
ISAE. 
? Increases e?ciency and e?ectiveness of audit. 
In some of the above situations it is likely that carrying out audit using traditional 
substantive audit procedures may be di?cult or even not feasible if the company 
prepares, records and conducts majority of business activities through IT systems 
only. 
On the other hand, many companies may use less complex IT systems including 
desktop based accounting or spreadsheets. In such situations, the relevance of IT 
to an audit could be less. However, the auditor is still required to carry out at 
least an understanding the IT environment of the company and document the 
same. 
Another area where IT can be relevant to audit is by using data analytics using 
computer assisted audit techniques (CAATs). By using data analytics, it is possible