What it is
For a financial statement audit, backup, recovery and incident response matter because they protect the completeness and availability of the accounting records, and because a ransomware event or payment fraud can have direct financial effects.
The checklist covers policy, backups, restore testing, cyber controls and incident handling, and then turns to the effect on the engagement: risk assessment, contingencies and subsequent events, going concern and communication of deficiencies. A technical assessment needs a qualified IT specialist.
When to use it
- Understanding a client’s IT environment during planning.
- After a client reports a cyber incident or system failure.
- As a self-assessment for a finance team preparing for an audit.
What’s inside
- RPO and RTO and policy ownership
- Backup copies, encryption and SaaS data
- Restore tests and the disaster recovery plan
- MFA, patching, training and payment change controls
- Effect on risk assessment, contingencies and going concern
Standard cited
This template follows AU-C 315 / AU-C 570 / AU-C 250. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 315 explained, AU-C 570 explained, AU-C 250 explained.
Questions
Is a backup enough if it has never been restored?
No. A restore test is the evidence that the backup works. Record the system, the date, the data restored and the time taken, and compare with the RTO.
Does a cyber incident affect the audit?
It can. Evaluate the effect on the reliability of records, on losses and contingencies (ASC 450) and on subsequent events, and consider whether laws on data protection or breach notification matter to the statements (AU-C 250).
Can an auditor certify the client’s cybersecurity?
No, not in a financial statement audit. The auditor understands IT risks relevant to the statements. A separate engagement and an IT specialist are needed for a security assessment.
Related templates
- ITGC and User Access Review Checklist (Financial Statement Audit)
- Going Concern Evaluation Memo (AU-C 570 / ASC 205-40)
- Risk Register
Last updated 11/05/2026. All free templates.