Understanding the IT environment and identifying risks arising from IT

In this lesson you will

Define the IT environment and risks arising from the use of IT under AU-C 315
Identify which IT applications are in scope based on the controls the auditor identified
List the risks from IT described in AS 2110.B4
Document an IT environment map that links applications to significant accounts

Start with the definitions

AU-C 315 defines the IT environment as the IT applications and supporting IT infrastructure, as well as the IT processes and personnel involved in those processes, that an entity uses to support business operations and achieve business strategies. It defines risks arising from the use of IT as the susceptibility of information-processing controls to ineffective design or operation, or risks to the integrity of information in the entity's information system, due to ineffective design or operation of controls in the entity's IT processes.

Read those two definitions together and the scoping logic follows: you care about the IT environment only to the extent it supports controls and information you use in the audit.

The scoping sequence in AU-C 315

AU-C 315 works in steps:

AU-C 315 tells the auditor which controls to identify as identified controls (AU-C 315.27), for example controls over significant risks, controls over journal entries, and controls the auditor plans to test.
Based on those controls, identify the IT applications and other aspects of the IT environment that are subject to risks arising from the use of IT.
For those applications and aspects, identify the related risks arising from the use of IT and the entity's general IT controls that address them.
For each identified control, evaluate design and determine whether it has been implemented.

The order matters. You do not inventory every system the client owns. You start from the controls and information that matter to your audit and work outward.

What the IT environment map should show

A useful map for a mid-size client has one row per in-scope application:

Application	Accounts supported	Automated controls or reports relied on	Database	Operating system	Hosted where
General ledger system	All	Journal entry listing, trial balance	Vendor-managed	Vendor-managed	Cloud service provider
Billing application	Revenue, receivables	Price calculation, aging report	In-house	In-house	Client data center
Payroll service	Payroll expense, accruals	Gross-to-net calculation	Service organization	Service organization	Service organization

The "hosted where" column tells you early whether you will need a SOC 1 report.

Risks arising from IT in AS 2110

AS 2110.B4 requires the auditor to understand specific risks to ICFR resulting from IT and lists examples: reliance on systems or programs that inaccurately process data, process inaccurate data, or both; unauthorized access to data that might result in destruction of data or improper changes, including recording unauthorized or nonexistent transactions; IT personnel gaining access privileges beyond those needed for their duties, which breaks down segregation of duties; unauthorized changes to data in master files; unauthorized changes to systems or programs; failure to make necessary changes to systems or programs; inappropriate manual intervention; and potential loss of data or inability to access data as required.

Each example maps to a domain. Inaccurate processing and failed changes point to change management and program development. Unauthorized access and excessive privileges point to access controls. Data loss points to IT operations.

Layers: application, database, operating system, network

Risks can arise at more than one layer. A user who cannot post a journal entry in the application may still be able to update the ledger table directly in the database. For each in-scope application, ask who has direct database access, who has administrator rights to the operating system, and how access is authenticated at the network layer. Do not stop at the application screen.

Smaller and less complex IT environments

For a client running a packaged accounting system with no ability to change source code, change management risk is lower, but access risk is not. Packaged systems still have administrator accounts, configurable settings (approval limits, posting periods) and user setups. The auditor still identifies the risks and the general IT controls that address them; the documentation is shorter, not absent.

Documenting the conclusion

Your file should show, for each in-scope application, the risks arising from IT you identified, the general IT controls that address each risk, and your evaluation of design and implementation. Link this work to the AU-C 315 risk assessment and carry the results into your control risk assessment.

Worked example

Scoping applications for Larkspur Medical Supply

Larkspur Medical Supply uses five systems: a general ledger system, a warehouse management application, a third-party payroll service, a customer relationship tool and an email system.

The audit team identified these controls under AU-C 315.27: the automated three-way match in the warehouse application (inventory and payables), controls over journal entries in the general ledger, and a monthly review of an inventory reserve report generated by the warehouse application.

Applying the requirement to identify IT applications subject to risks arising from the use of IT, the in-scope applications are the general ledger system and the warehouse application. The payroll service processes a significant class of transactions, so the team also brings it into the understanding of the information system and plans to obtain a SOC 1 report. The customer relationship tool and email system support no identified control or report and are out of scope.

Applying the requirement to identify risks arising from the use of IT and the related general IT controls to the warehouse application, the team identifies three risks: unauthorized change to the match tolerance setting, unauthorized access to vendor master data, and inaccurate aging logic in the reserve report. The related general IT controls are change approval for configuration changes, quarterly access review of vendor master rights, and approval and testing of changes to the report logic.

Conclusion: two applications and one service organization in scope, with three ITGC risks documented for the warehouse application.

Self-check

Answer each question before you open the answer.

Does AU-C 315 require the auditor to inventory and assess every system the client uses?
Show answer
No. AU-C 315 ties scoping to the controls identified under AU-C 315.27. The auditor identifies the IT applications and other aspects of the IT environment that are subject to risks arising from the use of IT based on those controls.
Name three risks from IT listed in AS 2110.B4.
Show answer
Any three of: systems that process data inaccurately or process inaccurate data; unauthorized access to data; IT personnel with access beyond their duties; unauthorized changes to master file data; unauthorized changes to systems or programs; failure to make necessary changes to systems or programs; inappropriate manual intervention; potential loss of data or inability to access data. Each is a way IT can undermine the controls or information the audit relies on.
Why look beyond the application layer?
Show answer
Because a user blocked in the application screen may still change data through direct database access or administrator rights at the operating system level. An access control tested only at the application layer leaves those paths untested.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error