Page 129 - Auditing Standards

As of December 15, 2017

.B4 The auditor should obtain an understanding of specific risks to a company's internal control over
financial reporting resulting from IT. Examples of such risks include:

Reliance on systems or programs that are inaccurately processing data, processing inaccurate data,
or both;

Unauthorized access to data that might result in destruction of data or improper changes to data,
including the recording of unauthorized or non-existent transactions or inaccurate recording of

transactions (particular risks might arise when multiple users access a common database);

The possibility of IT personnel gaining access privileges beyond those necessary to perform their
assigned duties, thereby breaking down segregation of duties;

Unauthorized changes to data in master files;

Unauthorized changes to systems or programs;

Failure to make necessary changes to systems or programs;

Inappropriate manual intervention; and

Potential loss of data or inability to access data as required.

.B5 In obtaining an understanding of the company's control activities, the auditor should obtain an

understanding of how the company has responded to risks arising from IT.

.B6 When a company uses manual elements in internal control systems and the auditor plans to rely on,
and therefore test, those manual controls, the auditor should design procedures to test the consistency in the

application of those manual controls.

Footnotes (AS 2110 - Identifying and Assessing Risks of Material Misstatement):

1 Paragraphs .05-.08 of AS 1101, Audit Risk.

2 Terms defined in Appendix A, Definitions, are set in boldface type the first time they appear.

3 AS 2401, Consideration of Fraud in a Financial Statement Audit, discusses fraud, its characteristics, and

the types of misstatements due to fraud that are relevant to the audit, i.e., misstatements arising from fraudulent
financial reporting and misstatements arising from asset misappropriation. Also, AS 2410, Related Parties,
requires the auditor to perform procedures to obtain an understanding of the company's relationships and
transactions with its related parties that might reasonably be expected to affect the risks of material misstatement
of the financial statements.

126