Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

During the audit of Ranjit Pharma Ltd, the auditor finds that the ERP has no formal process for approving changes to the pricing master; developers can move changes directly into production. Which conclusion is most appropriate?

Uncontrolled changes to production are a general IT controls deficiency. Automated application controls depend on such controls to operate consistently, so the auditor cannot rely on them without further testing and should reassess risk and increase substantive procedures, and communicate the deficiency appropriately.

  1. AApplication controls over invoicing are effective since the system calculates automatically
  2. BA deficiency exists in general IT controls over program change, which can undermine reliance on automated application controls and may require more substantive testingCorrect
  3. CThe matter is relevant only to the IT department and not to the audit
  4. DControl risk is assessed as low because changes are made by qualified developers

Explanation

Weak program change management is a general IT control deficiency. Because automated application controls depend on effective GITCs, the auditor cannot assume they operate consistently and should reassess risk and extend substantive procedures. Option A is wrong because automation does not assure consistent operation without sound GITCs.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

Practise Digital Auditing & AssuranceFree diagnostic mock

More Digital Auditing & Assurance questions