Page 172 - Auditing Standards

As of December 15, 2017

operation of an automated application control should be reestablished. To determine when to reestablish a
baseline, the auditor should evaluate the following factors -

The effectiveness of the IT control environment, including controls over application and system
software acquisition and maintenance, access controls and computer operations.

The auditor's understanding of the nature of changes, if any, on the specific programs that contain the

controls.

The nature and timing of other related tests.

The consequences of errors associated with the application control that was benchmarked.

Whether the control is sensitive to other business factors that may have changed. For example, an
automated control may have been designed with the assumption that only positive amounts will exist

in a file. Such a control would no longer be effective if negative amounts (credits) begin to be posted
to the account.

Appendix C - Special Reporting Situations

Summary Table of Contents

.C1 Report Modifications

.C16 Filings Under Federal Securities Statutes

Report Modifications

.C1 The auditor should modify his or her report if any of the following conditions exist.

a. Elements of management's annual report on internal control are incomplete or improperly presented,

b. There is a restriction on the scope of the engagement,

c. The auditor decides to refer to the report of other auditors as the basis, in part, for the auditor's own
report,

d. There is other information contained in management's annual report on internal control over financial
reporting, or

e. Management's annual certification pursuant to Section 302 of the Sarbanes-Oxley Act is misstated.

.C2 Elements of Management's Annual Report on Internal Control Over Financial Reporting Are
Incomplete or Improperly Presented. If the auditor determines that elements of management's annual report

169