Advanced Auditing, Assurance and Professional Ethics · Materiality, Risk Assessment and Internal Control

Manual and Automated Controls and IT Risks (SA 315) for CA Final Audit

Updated 5 October 2026 · Fact-checked

Under SA 315 (Revised 2019), an entity's internal control uses manual elements, automated elements, or both. You must understand which it uses, because each carries different risks. Solve questions by naming the control type, its characteristics, the IT risk it creates, and the effect on your risk assessment and audit response.

Understand Manual and Automated Controls and IT Risks

Every entity's internal control is a mix of manual and automated elements. A manual control is performed by a person, such as a supervisor reviewing a bank reconciliation or a manager approving a purchase order. An automated control is performed by the IT system, such as a system check that blocks a payment above a credit limit or a three-way match of order, receipt and invoice.

The mix matters because the two behave differently. Manual controls suit situations that need judgment, such as large, unusual or non-recurring transactions, and where errors are hard to define or predict. They are more easily bypassed, ignored or overridden, and they are less reliable. They are also more prone to simple human error and inconsistency. Manual controls may be less suitable for high-volume or recurring transactions.

Automated controls suit high-volume, recurring transactions, and situations where errors can be predicted and prevented by programmed logic. They are generally more reliable if the IT environment is well controlled, because the system applies the same logic every time. But they depend on the IT environment working properly.

Use of IT also creates risks. Examples: reliance on systems or programs that process data inaccurately, or that process inaccurate data, or both; unauthorised access to data that may destroy data or change it improperly, including recording unauthorised or non-existent transactions; unauthorised changes to data in master files; unauthorised changes to systems or programs; failure to make necessary changes to systems or programs; inappropriate manual intervention; and potential loss of data or inability to access data as required.

To manage these risks, entities use IT general controls (ITGCs) and application controls. ITGCs are controls over the IT environment that support the effective functioning of application controls. They cover access, program change, program development and IT operations. Application controls are controls within a process that deal with the integrity of transactions and data, such as input validation and automated calculations. If ITGCs are weak, you cannot rely on automated application controls without more testing.

Key rules to remember

Manual control: when suitable: Judgment needed + large, unusual or non-recurring items + hard-to-predict errors → manual; Also useful where control activities are needed in changing circumstances. Weakness: easier to bypass, override or make errors; less reliable.
Automated control: when suitable: High volume + recurring items + predictable errors → automated; Applies the same logic consistently, if the IT environment is effective. Risk: it fails everywhere if programming or access is compromised.
Reliance chain: Effective ITGCs → reliable application controls → reliable automated processing and information; Weak ITGCs undermine automated controls and system-generated reports.
ITGC areas: Access security | Program change | Program development | IT operations; These support the continued effective operation of application controls.
Core IT risk themes: Inaccurate processing | Unauthorised access | Unauthorised changes (data, master files, programs) | Failure to change | Manual intervention | Data loss; Use these as a checklist when a case describes an IT system.

How to solve Manual and Automated Controls and IT Risks questions

Use this method for any case or written question on manual versus automated controls and IT risks.

1Read the case and list each control described. Mark each as manual, automated, or IT-dependent manual (a person reviewing a system report).
2State the characteristics of that control type: reliability, consistency, risk of override or error, suitability for the transaction type.
3Identify the IT risks the facts point to: unauthorised access, unauthorised changes, incorrect processing, data loss, or inappropriate manual intervention.
4Link the risk to the control: say which ITGC or application control should address it, and whether it appears missing or weak.
5Assess the effect on risk of material misstatement: weak ITGCs raise the risk at the assertion level and limit reliance on automated controls and system reports.
6State the audit response: test ITGCs, test the application control (often once if ITGCs are effective), test report accuracy and completeness, or use substantive procedures.
7Conclude clearly in provision, facts, conclusion form, and mention communication of significant deficiencies to those charged with governance where relevant.

Quickest way: Type, risk, response in three lines

When to use it: Use for short MCQs and for 4 to 5 mark written answers when time is tight.

Line 1: label the control (manual or automated) and give one characteristic that fits the facts.
Line 2: name the IT risk from the case (access, change, processing, data loss, override).
Line 3: give the audit response: test ITGCs first, then application control or extra substantive work.
For MCQs, eliminate options that say automated controls are always reliable or manual controls are always weaker. Both statements are over-claims.

Common mistakes in Manual and Automated Controls and IT Risks

Saying automated controls are always more reliable than manual controls.
Students remember consistency and forget the dependence on the IT environment.
Fix: Write that automated controls are generally more reliable only if ITGCs are effective. Weak ITGCs undermine them.
Saying manual controls are useless or should never be relied on.
Over-simplifying the comparison.
Fix: Manual controls suit judgment areas and unusual or non-recurring transactions. The point is they are more prone to error and override, not that they cannot be relied on.
Mixing up ITGCs and application controls.
Both are called IT controls.
Fix: ITGCs relate to the IT environment (access, change, development, operations) and support application controls. Application controls work within a process on transactions and data.
Listing IT risks without linking them to the case facts.
Memorised lists are written out as a dump.
Fix: Pick only the risks the facts support and quote the fact, for example a developer who also has access to the live system.
Testing an automated control once and relying on it without checking ITGCs.
Students know automated controls are consistent and stop there.
Fix: State that one test may be enough only when ITGCs are effective, since they ensure the control is not changed without authorisation.
Ignoring system-generated reports used in manual controls.
The control looks manual, so IT seems irrelevant.
Fix: If a person reviews an exception report, the report's completeness and accuracy also matters. Treat it as IT-dependent.

Worked examples

Example 1

Case: Sunrise Traders Ltd has a high volume of daily sales invoices. Its ERP automatically blocks an invoice if the customer's outstanding balance would exceed the approved credit limit. The credit manager manually approves any exception. During planning, you find that the IT team head and two junior staff share one administrator login, and program changes are made directly in the live environment without approval. Discuss the auditor's assessment of the controls and the implication.

Show the solution

Classify the controls: the credit-limit block is an automated application control. The credit manager's approval of exceptions is a manual control, used for non-routine cases needing judgment.
Characteristics: the automated block suits high-volume recurring sales and applies the same rule each time if the IT environment is effective. The manual approval suits exceptions but is open to override and error.
IT risks from the facts: the shared administrator login creates unauthorised access risk and weakens accountability. Direct changes to live programs without approval create the risk of unauthorised changes to programs and master data, such as credit limits.
Link to controls: access security and program change ITGCs appear deficient. As ITGCs are ineffective, the automated credit-limit control cannot be assumed to work consistently, because someone could change the limit or program without detection.
Effect on risk assessment: the risk of material misstatement for existence and valuation of receivables and occurrence of revenue is higher. The auditor should not rely on the automated control without additional evidence.
Audit response: evaluate and test the ITGC deficiencies, directly test whether credit limits and program logic were altered, and increase substantive procedures such as receivables confirmations and cut-off testing.
Communicate the significant deficiencies in ITGCs to those charged with governance and management in writing.

Answer: The credit block is an automated application control and the exception approval is a manual control. Weak access and change controls undermine the automated control, so the auditor should not rely on it, should assess higher risk for revenue and receivables, perform extended substantive procedures, and communicate the deficiencies.

Example 2

MCQ case: An auditor of a retail chain notes that the point-of-sale system calculates GST and totals automatically. ITGCs over access and program changes were tested and found effective, and the auditor tested the GST calculation logic for one transaction in the prior year, with no change in the program since. Which statement is most appropriate? (A) The auditor must test the automated calculation on a large sample of transactions each year. (B) The auditor may be able to limit testing of the automated calculation because of consistent processing and effective ITGCs. (C) The auditor cannot rely on any automated control. (D) The auditor should rely on the control without testing ITGCs.

Show the solution

Identify the control: the GST calculation is an automated application control for high-volume recurring transactions.
Automated controls apply the same logic each time unless the program is changed.
The facts say ITGCs over access and program change are effective, and no program change has occurred. So the risk of the logic being altered is low.
Option A ignores consistency and effective ITGCs, so it asks for unnecessary testing.
Option C is wrong because the facts support reliance.
Option D is wrong because ITGCs must be evaluated, not skipped.
Option B reflects the correct reasoning: with effective ITGCs, limited testing of the automated control may be enough, subject to verifying that no change was made.

Answer: Option B.

Exam tips

In a case with an IT system, scan for access, change, and override facts. The examiner usually plants one or two and expects you to link them to a risk.
Answer in provision, facts, conclusion form: state the SA 315 principle, apply the case facts, then conclude on reliance and audit response.
Avoid absolutes such as always or never in MCQs. Options that say automated controls are always reliable or manual controls are never reliable are usually wrong.
For 'distinguish' questions, give two or three points each side in a short table-like list: reliability, suitability, risk of override, dependence on ITGCs.
Add the communication step: significant deficiencies in ITGCs go to those charged with governance (SA 265).

Practice questions from Materiality, Risk Assessment and Internal Control

Manual and Automated Controls and IT Risks: frequently asked questions

What is the difference between manual and automated controls under SA 315?

Manual controls are performed by people and suit judgment areas and unusual transactions, but are easier to bypass and more error-prone. Automated controls are performed by IT systems and suit high-volume recurring transactions, and are generally more consistent if the IT environment is effective.

What is the difference between IT general controls and application controls?

ITGCs are controls over the IT environment, such as access, program change, development and operations, that support the effective functioning of application controls. Application controls operate within a business process and deal with the integrity of transactions and data, for example input validation or automated calculations.

Can an auditor rely on an automated control after testing it once?

Sometimes, but only if ITGCs are effective and the program has not been changed. Effective ITGCs give comfort that the control continues to operate consistently. If ITGCs are weak, you need additional testing or substantive procedures.

What are the main risks arising from the use of IT?

Key risks include inaccurate processing or inaccurate data, unauthorised access, unauthorised changes to data, master files or programs, failure to make necessary changes, inappropriate manual intervention, and loss of data or inability to access it. In a case, pick the ones the facts support.