Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

During the audit of a company using an automated accounts payable system, the auditor finds that the vendor master file can be edited by an accounts clerk who also approves payment runs. No other compensating control exists. What is the most appropriate conclusion?

The auditor should treat it as a control deficiency in segregation of duties, reassess the risk of material misstatement, extend substantive procedures, and communicate it to those charged with governance under SA 265. Automation does not remove the risk, and resignation is not an automatic response.

  1. AThere is a deficiency in IT general or application controls relating to segregation of duties; the auditor should consider its effect on risk assessment, communicate it to those charged with governance, and extend substantive proceduresCorrect
  2. BNo action is required because automation of payment runs eliminates fraud risk
  3. CThe deficiency affects only internal audit and need not be communicated to management
  4. DThe auditor must immediately resign from the engagement

Explanation

Lack of segregation between master data maintenance and payment approval is a control deficiency. Under SA 265 it must be communicated in writing to those charged with governance if significant, and under SA 330 the auditor should respond with more substantive testing. Resignation is not required just because of a control deficiency.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

Practise Digital Auditing & AssuranceFree diagnostic mock

More Digital Auditing & Assurance questions