Skip to content

CA Intermediate · Auditing and Ethics · Audit of Banks

The statutory auditor of a bank branch notices that several staff members have access to modify interest rates in the core banking system (CBS) without maker-checker approval. Which is the most appropriate audit response?

The auditor should treat the missing maker-checker control as an IT control deficiency, assess its effect on the risk of material misstatement in interest income, and increase substantive procedures such as recomputing interest. Relying on the system or reducing samples would be wrong, and a full misstatement cannot be assumed.

  1. AIgnore the matter because CBS controls are the responsibility of the IT vendor
  2. BTreat it as a control deficiency in the IT environment, assess its effect on the risk of material misstatement in interest income, and extend substantive procedures such as recomputing interestCorrect
  3. CConclude that the financial statements are misstated by the full interest income
  4. DReduce the audit sample size because the system is automated

Explanation

Weak access and authorisation controls in the CBS undermine reliance on system-generated interest calculations. The auditor should assess the effect on the risk of material misstatement and extend substantive testing, such as recomputing interest on a sample of accounts. Ignoring it or reducing the sample is inappropriate, and concluding that the whole interest income is misstated has no basis without evidence.

Did you get it right without looking?

One question tells you little. A timed set on Audit of Banks shows your real accuracy, how long you take and where you lose marks.

Practise Audit of BanksFree diagnostic mock

More Audit of Banks questions