Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

CA Vivek audits Orchid Retail Ltd, which uses an automated tool that approves three-way matching of purchase orders, receipts and invoices without human review. Vivek has tested the application control once in the current year and found it operating effectively. The company made an unauthorised change to the matching tolerance logic in October, detected by Vivek only through the change-management log. Which conclusion is most appropriate?

Vivek cannot rely on the earlier test for the period after the unauthorised change. Automated control consistency depends on effective program change controls, so he should evaluate that deficiency and retest or extend procedures for the post-change period, reassessing control risk.

  1. AThe earlier test remains valid for the whole year since automated controls are always consistent
  2. BReliance on the automated control for the period after the change is not supported; Vivek should evaluate general IT controls over program changes, and retest or extend procedures for the post-change periodCorrect
  3. CAutomated controls need no testing in any year once tested
  4. DThe change affects only disclosures and not the audit approach

Explanation

Automated controls operate consistently only if the program and its related general IT controls, particularly change management, remain effective. An unauthorised change to the logic undermines evidence from the earlier test and indicates a general IT control deficiency. The auditor must retest or obtain further evidence for the period after the change and reconsider control risk.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

Practise Digital Auditing & AssuranceFree diagnostic mock

More Digital Auditing & Assurance questions