Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

Sundaram & Co., chartered accountants, audit Kaveri Textiles Ltd, which runs a bespoke ERP. During planning, the engagement team plans to rely on automated three-way matching of purchase orders, goods receipt notes and supplier invoices to restrict payments. Which is the most appropriate auditor response under SA 315 (Revised) and SA 330 on this automated control?

The auditor should test the automated matching control with limited re-performance and also evaluate general IT controls over program changes and access. Automated controls run consistently unless altered, so effective ITGCs support a small test; assuming reliability without ITGC evaluation is not acceptable.

  1. ATest the automated control once by re-performing the matching on a sample and then assess whether general IT controls over program changes and access are effective, to conclude it operates consistently throughout the periodCorrect
  2. BIgnore the control because automated controls cannot be tested and perform only substantive procedures
  3. CTreat the control as effective for the full year simply because it is automated, with no testing of IT general controls
  4. DTest the control on a large sample of 60 transactions every quarter, as automated controls are as variable as manual ones

Explanation

Automated controls operate consistently unless the program is changed, so a test of one or few instances can suffice if effective general IT controls (change management, access) are also established. Assuming effectiveness without testing ITGCs is wrong because the program could have been altered. Large quarterly samples are unnecessary for a consistent automated control.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

More Digital Auditing & Assurance questions