The IT environment and general IT controls under SAS 145

• Identify IT applications and other aspects of the IT environment subject to risks from IT.
• Describe the three IT processes that general IT controls address.
• Scale the IT understanding for a less complex entity.

Definitions

AU-C 315.12 defines:

• IT environment. The IT applications and supporting infrastructure, plus the IT processes and personnel involved, used to support operations and achieve strategies. IT applications include data warehouses and report writers. Infrastructure is the network, operating systems and databases. IT processes manage access, program changes or changes to the environment, and IT operations.
• General IT controls (GITCs). Controls over the entity's IT processes that support the continued proper operation of the IT environment, including the continued effective functioning of information-processing controls and the integrity of information.
• Risks arising from the use of IT. Susceptibility of information-processing controls to ineffective design or operation, or risks to the integrity of information in the information system, due to ineffective controls in the IT processes.

What SAS 145 requires

Understand the IT environment as part of the information system. AU-C 315.19(a)(i) requires understanding how the business model integrates IT. AU-C 315.25(a)(iv) requires understanding the IT environment relevant to information flows. The IT environment documentation guide walks through it.

Identify applications and risks. AU-C 315.28 requires you, based on the controls identified under AU-C 315.27, to identify the IT applications and other aspects of the IT environment subject to risks arising from IT. AU-C 315.29 requires you to identify, for those applications, the related risks arising from IT and the GITCs that address them.

Evaluate GITCs. AU-C 315.30 applies to GITCs identified under .29(b): evaluate design and determine implementation.

Which applications are in scope

Start from the identified controls and the information you rely on. An application is in scope when:

• it performs automated controls you identified;
• it produces reports you use as audit evidence or that management uses in identified controls; or
• it maintains data integrity for significant classes or balances.

A cloud accounting package used by a five-person company may still be in scope if you use its aging report to select confirmations. A standalone spreadsheet used for a key estimate is part of the IT environment too.

The three GITC areas

Not every GITC is relevant. Identify the ones that address the specific risks arising from IT for in-scope applications. A commercial package where the entity cannot change code has little program change risk, but access risk remains, especially when the bookkeeper has administrator rights.

Scaling

For a less complex entity with packaged software, limited users and no ability to modify code, the understanding can be short: list the applications, who has access and with what rights, how updates are applied, and how data is backed up. Then evaluate whether any risks arising from IT affect identified controls or information you use. The understanding cannot be skipped; its documentation can be brief.

For complex environments with custom code, interfaces and multiple databases, an IT audit specialist is often needed (AU-C 300.12).

Common findings

• No identification of IT applications at all.
• Automated controls relied on without GITC testing.
• System reports used as evidence with no consideration of IT risks to their integrity.
• Administrator access held by the person who records entries, with no evaluation.

The ITGC testing matrix covers each area.

Scoping IT at a small nonprofit