- Explain why IT general controls matter to a financial statement audit and an ICFR audit
- Identify the standards that govern IT risk under AICPA and PCAOB audits
- Describe the link between ITGCs, automated controls and system reports
- Outline where SOC reports enter the audit when a client outsources processing
Why IT controls are an audit topic
Almost every client now records transactions in a general ledger system, and many use separate applications for billing, payroll, inventory and treasury. Those systems calculate, post, summarize and report. When the auditor relies on what a system does, the auditor needs evidence that the system kept doing it correctly all year. That is the job of IT general controls (ITGCs).
AU-C 315, as amended by SAS No. 145 (effective for audits of periods ending on or after December 15, 2023), defines general IT controls as controls over the entity's IT processes that support the continued proper operation of the IT environment, including the continued effective functioning of information-processing controls and the integrity of information in the entity's information system. For issuer audits, AS 2110.B1 requires the auditor to understand how the company uses IT, how IT affects the financial statements, and the IT general controls that are important to the effective operation of automated controls.
The chain of reliance
Think of the audit evidence as a chain:
- A business risk (for example, revenue billed at the wrong price) is addressed by an automated control (the billing application pulls the price from an approved price table).
- The automated control keeps working only if nobody changes the program or the price table without approval, and only authorized people can update the table.
- The ITGCs (change management and access) provide that assurance.
If the ITGCs fail, the automated control may still have worked, but the auditor can no longer assume it did. The SEC's 2007 management guidance (Release 33-8810) makes the same point for issuers: ITGCs alone ordinarily do not address financial reporting risks, but the consistent operation of automated controls often depends on effective ITGCs.
The same chain applies to reports. A user of an aging report, a commission calculation or a journal entry listing needs the data and logic behind it to be complete and accurate. That is the information produced by the entity (IPE) problem covered in lesson 8.
What the track covers
| Lessons | Topic |
|---|---|
| 1 to 3 | IT environment, risks from IT, the four ITGC domains |
| 4 to 7 | Access, privileged access and segregation of duties, change management, IT operations |
| 8 to 9 | IPE and reports, application controls and benchmarking |
| 10 to 13 | SOC 1, SOC 2, SOC 3, Type 1 and Type 2, user auditor procedures, CUECs, subservice organizations, bridge letters |
| 14 | Evaluating ITGC deficiencies |
AICPA and PCAOB in parallel
Private company and not-for-profit audits follow the AU-C sections. AU-C 315 requires the auditor to identify the IT applications and other aspects of the IT environment that are subject to risks arising from the use of IT, then identify those risks and the general IT controls that address them. Issuer audits follow PCAOB standards: AS 2110 for risk assessment, AS 2201 for the integrated audit of internal control over financial reporting (ICFR), and AS 2601 for service organizations. AS 2201 says the identification of IT risks and controls is not a separate evaluation; it is part of the top-down approach.
The vocabulary differs slightly (AS 2601 still speaks of reports on controls "placed in operation"), but the logic is the same: understand the IT environment, find the risks, find the controls that address them, test the controls you rely on.
Where SOC reports fit
When a client outsources payroll, hosting or transaction processing, part of its information system sits at a service organization. The user auditor cannot test those controls directly in most cases, so the audit relies on a service auditor's report. AU-C 402 and AS 2601 tell the user auditor how to evaluate that report, including its period, its scope, the controls the user entity must operate itself, and any subservice organizations that were carved out.
How to use this track
Each lesson ends with a worked example and self-checks. Bring the ITGC testing matrix to lessons 3 to 7 and the service organization report review checklist to lessons 10 to 13. Start with the IT environment lesson if you are new to IT audit.
Why a price table matters: Harbor Point Distribution
Harbor Point Distribution invoices 40,000 orders a year. The billing application calculates each invoice from a price table that only two pricing analysts can update. Revenue is the largest account, and the audit team plans to rely on the automated price calculation instead of testing a large sample of invoices.
Step 1: the team tests the automated calculation once by tracing one invoice of each price type to the approved table. All agree.
Step 2: the team asks whether the result can be carried to the full year. That requires evidence that (a) the pricing program was not changed without approval during the year (change management) and (b) only the two analysts could change the price table (access).
Step 3: the access review shows that a former sales manager kept update rights to the price table for five months after changing roles.
Conclusion: the team cannot rely on the automated control for those five months without more work. It either tests the price table change log for that period to show no unauthorized changes were made, or it increases substantive testing of invoices for the affected months.
Self-check
Answer each question before you open the answer.
What do general IT controls support, according to the AU-C 315 definition?
Show answer
The continued proper operation of the IT environment, including the continued effective functioning of information-processing controls and the integrity of information in the entity’s information system.
Does testing an automated control once tell you it worked all year?
Show answer
Only if the ITGCs over that application (change management and access in particular) were effective for the period. Without effective ITGCs, a single test supports the control only at the point you tested it.
Which PCAOB standard governs the user auditor’s consideration of a service organization?
Show answer
AS 2601, Consideration of an Entity’s Use of a Service Organization. AU-C 402 is the AICPA counterpart for nonissuer audits.
Use it on the file
- GuideIT Audit Guide: ITGC Program, Testing Steps and Checklist for Financial Audits
- LessonThe IT environment and general IT controls under SAS 145
- TemplateITGC Testing Matrix: Access, Change and Operations
- StandardAU-C 315: Risk Assessment: SAS 145 Requirements and Common File Weaknesses
Sources
- AICPA, Statements on Auditing Standards currently effective (AU-C sections, including AU-C 315 as amended by SAS No. 145)
- PCAOB, Auditing Standards compilation including AS 1105, AS 2110, AS 2201, AS 2601 and AS 2605
- SEC Release No. 33-8810, Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting (2007)
Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error