Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

Sundaram Textiles Ltd runs its sales and inventory on an ERP. While planning the audit, CA Meera finds that the company's IT environment is stable, uses packaged software with no source-code changes, and has few interfaces. Which approach to understanding IT under SA 315 (Revised) is most appropriate?

The auditor should understand the IT environment, identify the relevant applications and the risks arising from IT, and scale the work to its complexity. Even a simple packaged ERP cannot be ignored, but a source-code review or reliance on vendor brochures is neither required nor adequate.

  1. ASkip IT understanding entirely because the software is packaged
  2. BUnderstand the IT environment and identify IT applications and related risks arising from IT, scaling the effort to its complexityCorrect
  3. CPerform a full forensic review of the ERP source code
  4. DRely on the vendor's brochure as sufficient evidence of general IT controls operating effectively

Explanation

SA 315 (Revised) requires the auditor to understand the entity's use of IT and identify IT applications, other aspects of the IT environment and risks arising from IT. The depth depends on complexity, so a simple environment needs less work, but it cannot be skipped. A source-code review is unnecessary, and vendor literature is not evidence of control operation.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

Practise Digital Auditing & AssuranceFree diagnostic mock

More Digital Auditing & Assurance questions