In a financial statement audit, "IT audit" rarely means a standalone technology review. It means the work needed to understand how the client's systems produce the numbers, to identify the risks that come from using those systems, and to test the IT controls the audit relies on. Since SAS 145 revised AU-C 315, that work is more explicit even for small clients on cloud accounting software.
This guide covers the scope of IT work in a financial audit, a step-by-step ITGC program, a simplified approach for small clients and a checklist. It does not cover standalone IT audits for security certification, which follow other frameworks.
What is an IT audit in a financial statement audit?
It is the part of the audit that deals with the entity's use of IT in its financial reporting. AU-C 315, as revised by SAS 145 and effective for audits of periods ending on or after December 15, 2023, has the auditor obtain an understanding of the entity's information system and IT environment. For controls the auditor identifies as relevant, the auditor:
- identifies the IT applications and other aspects of the IT environment that are subject to risks arising from the use of IT
- identifies the risks arising from the use of IT
- identifies the general IT controls that address those risks
- evaluates the design of those general IT controls and determines whether they have been implemented
If the auditor plans to rely on the operating effectiveness of controls that depend on IT, general IT controls are tested too. If the auditor does not plan to rely on controls, the work is the understanding and the evaluation of design and implementation for the controls the standard requires. The IT general controls entry has the definition.
IT applications, general IT controls and application controls
| Term | Meaning | Example |
|---|---|---|
| IT application | A program or set of programs used to initiate, process, record or report transactions or information | Accounting software, payroll system, billing system |
| IT environment | The applications plus the supporting infrastructure and processes | Database, operating system, network, cloud hosting, IT staff |
| General IT controls (ITGCs) | Controls over the IT environment that support the continued operation of applications and the integrity of data | Access management, change management, IT operations |
| Application controls | Automated or manual controls within a business process | System-enforced three-way match, automated tax calculation |
The application controls entry gives more examples. An application control that depends on a system is only as reliable as the ITGCs behind it. If anyone can change the tax table in production without approval, a one-time test of the tax calculation proves nothing about the rest of the year.
The ITGC domains
Most ITGC programs organize the work into four areas.
- Access to programs and data. User provisioning, termination, privileged access, authentication, periodic access review and segregation of duties. See user access review and segregation of duties.
- Program change management. How changes to applications and configurations are requested, approved, tested, migrated and monitored. See change management.
- IT operations. Job scheduling, backup and recovery, incident management, and monitoring.
- Program development. Controls over new systems and migrations. Often limited to data conversion testing when the client has moved systems in the year.
ITGC test program
- Scope the applications. List the applications used for significant classes of transactions, account balances and disclosures, and flag the ones where controls will be relied on or where reports from the system are used as audit evidence.
- Document the environment. For each in-scope application: where it runs (on-premises or cloud), who administers it, who hosts it, who has developer access, and which service organizations are involved.
- Identify risks arising from IT. Typical risks: unauthorized access to data, inappropriate changes to data or programs, failure to process data correctly, and data loss.
- Map ITGCs to risks. Identify the control that addresses each risk, including those at service organizations.
- Evaluate design and implementation. Inquiry and walkthrough, and inspection of configuration or policies, for each ITGC.
- Test operating effectiveness where reliance is planned, using the selection approach for the control's frequency. See the control testing guide.
- Assess deficiencies. If an ITGC fails, determine the effect on automated controls and system reports that depend on it, and the need for more substantive work. Evaluate severity under AU-C 265. See ICFR and deficiency evaluation.
- Document the conclusion and the link to the substantive plan.
The ITGC testing matrix and the ITGC test plan provide working layouts.
Typical tests by domain
| Domain | Test | Evidence |
|---|---|---|
| Access | Compare the active user list to the HR list of current employees and roles | User list, HR list |
| Access | Inspect terminated users for access after the termination date | Termination dates, last log-in and disable dates |
| Access | Review privileged and administrator accounts and who approved them | Admin list, approvals |
| Access | Test that periodic user access review took place and exceptions were resolved | Review evidence, tickets |
| Change | Select changes from the change log and inspect request, approval and testing before release | Tickets, approvals |
| Change | Test that the person who developed a change did not also migrate it to production | Release logs |
| Operations | Inspect backup job results and a restore test | Job logs, test record |
| Operations | Review incident logs for events that affect financial data | Incident log |
Use the user access review checklist and the backup, recovery and incident response checklist for detail.
Reports and data from the system
Reports used as audit evidence, such as an aging or a list of journal entries, are information produced by the entity. The auditor tests the completeness and accuracy of the report or the underlying data, or tests the controls over their preparation. See the IPE testing worksheet.
Service organizations and cloud systems
When a payroll provider, hosted application or other vendor runs part of the system, controls at the vendor may be the ITGCs. The auditor can rely on a SOC 1 report where it covers the relevant controls, subject to the evaluation described in the SOC 1 and AU-C 402 guide. A SOC 2 report addresses security and related criteria and helps with understanding but does not address controls over financial reporting; see SOC 1 vs SOC 2 vs SOC 3.
A scaled approach for small clients
Most small clients run off-the-shelf software with few users. A proportionate approach looks like this:
- The relevant applications are a few: the accounting system, payroll service, bank portals and key spreadsheets.
- The risks centre on access to post entries or change vendor and employee master data, and on spreadsheet integrity.
- The ITGCs are mostly access controls plus reliance on the vendor.
- If the auditor does not plan to rely on controls, document the understanding, the evaluation of design and implementation for the required controls, and the substantive response.
Even for a small client, ask who has administrator rights and whether anyone who left still has access.
Worked example (illustrative): user access test
The client's accounting application has 14 active users. The auditor compares the list to the HR roster.
- Two of the 14 are not on the roster. One is a former bookkeeper terminated on August 30, 2026 whose account was disabled on October 16, 2026. That is 47 days after termination: 31 days from August 30 to September 30, plus 16 more to October 16.
- The auditor reviews the audit log for the account. There was no activity after the termination date. The second unrostered user is a vendor support account used for a software update, approved by the controller.
- Conclusion: a deficiency in the termination control, with no evidence of misuse. The auditor evaluates it under AU-C 265 as a control deficiency, mitigated by the log review, and concludes the termination control cannot be relied on until it operates promptly. The auditor extends journal entry testing to entries posted by that user's ID. See audit trail testing.
IT audit checklist
- IT applications relevant to financial reporting listed
- Hosting and service organizations identified, with SOC reports obtained where used
- Administrator and privileged users listed and approved
- User list agreed to current employees, with terminations tested
- Change management process understood and a sample of changes tested if relying on automated controls
- Backup and recovery process understood, and any incidents during the year considered
- Reports used as evidence tested for completeness and accuracy
- Cybersecurity incidents or ransomware events during the year inquired about and their effect on the books considered (see the cybersecurity risk entry)
- Deficiencies evaluated and communicated
Frequently asked questions
Does every audit need IT general controls testing?
No. ITGCs are tested when the auditor plans to rely on controls that depend on IT, or where substantive procedures alone cannot provide sufficient appropriate evidence. Every audit includes the understanding of the IT environment.
What are the four ITGC areas?
Access to programs and data, program change management, IT operations, and program development.
Is an IT audit the same as a SOC 2 examination?
No. A SOC 2 is an attest report on a service organization's controls relevant to trust services criteria. An IT audit in a financial audit supports the opinion on the financial statements.
What if a client has no IT staff?
The IT environment is still assessed. For small clients the risks are usually access and spreadsheet integrity, and the work is scaled to match.
Sources
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as revised by SAS No. 145)
- AICPA, AU-C Section 330; AU-C Section 402; AU-C Section 265
- AICPA, SAS No. 145, effective date for periods ending on or after December 15, 2023
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error