Join the waitlist
Track 16 of 19 · Specialized

IT general controls and SOC reports for auditors

How financial statement auditors identify risks arising from IT and test IT general controls, information produced by the entity and automated controls, and how they use SOC 1 reports as user auditors, including complementary user entity controls, subservice organizations and gap periods.

14 lessonsAbout 65 minAU-C 315 · AU-C 402 · AS 2201 · AS 2601 · SOC 1 · SOC 2
0 of 14 complete
Syllabus

For: Audit staff and seniors who document IT risk and controls, and IT audit staff who support financial audits.

  1. 01IT general controls and SOC reports: what this track covers and why it mattersWhy auditors test IT general controls, how ITGCs support automated controls and reports, and how SOC reports fit into a financial statement or integrated audit.5 min · worked example · 3 self-check questions
  2. 02Understanding the IT environment and identifying risks arising from ITHow AU-C 315 and AS 2110 require auditors to map IT applications, infrastructure and processes, and identify the risks from IT that general IT controls must address.5 min · worked example · 3 self-check questions
  3. 03The four ITGC domains: access, change management, operations and program developmentWhat each ITGC domain covers, the typical key controls in each, and how the domains map to the IT risks that threaten automated controls and reports.4 min · worked example · 3 self-check questions
  4. 04Testing user access: provisioning, terminations and periodic access reviewsHow to test new user provisioning, timely removal of access and periodic user access reviews, including completeness of the user listing and precision of the reviewer.5 min · worked example · 4 self-check questions
  5. 05Privileged access and segregation of duties in IT environmentsHow to identify and test privileged accounts at the application, database and system layers, and how to evaluate segregation of duties conflicts inside systems.4 min · worked example · 3 self-check questions
  6. 06Testing change management: program changes, configuration and emergency changesHow to test that changes to programs and configurations were authorized, tested and approved, with complete change populations and environment segregation.4 min · worked example · 3 self-check questions
  7. 07IT operations controls: job scheduling, interfaces, backups and incident managementHow to test operations controls that keep batch jobs and interfaces complete, protect data through backups, and resolve incidents affecting financial data.4 min · worked example · 3 self-check questions
  8. 08Information produced by the entity: testing the reports behind controls and substantive workHow to test the completeness and accuracy of system reports and spreadsheets used in controls and audit procedures, and how ITGCs and report logic testing fit together.4 min · worked example · 3 self-check questions
  9. 09Automated application controls and the benchmarking strategyHow to test automated application controls, why a test of one can be enough, and when AS 2201 permits a benchmarking strategy in later years.5 min · worked example · 3 self-check questions
  10. 10SOC 1, SOC 2 and SOC 3 reports, and Type 1 versus Type 2What each SOC report covers, who it is for, how Type 1 and Type 2 reports differ, and which report a financial statement auditor needs from a service organization.5 min · worked example · 3 self-check questions
  11. 11Using a SOC 1 report as the user auditor under AU-C 402 and AS 2601How the user auditor evaluates a SOC 1 report: service auditor competence, report period, scope, tested controls, exceptions and effect on risk.5 min · worked example · 3 self-check questions
  12. 12Complementary user entity controls and subservice organizations: carve-out vs inclusiveHow to identify and test CUECs relevant to your client, and how the carve-out and inclusive methods change what the user auditor must do about subservice organizations.5 min · worked example · 3 self-check questions
  13. 13Bridge letters and gap periods between a SOC 1 report and year-endHow to evaluate the gap between a SOC 1 report period and year-end, what a bridge letter is and is not, and which extra procedures fill the gap.5 min · worked example · 3 self-check questions
  14. 14Evaluating ITGC deficiencies and their effect on the auditHow to judge ITGC deficiency severity by linking it to the automated controls and reports it supports, testing compensating controls and setting the response.5 min · worked example · 4 self-check questions
For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required