Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

While auditing Kaveri Pharma Ltd., the auditor intends to rely on an automated three-way match control (PO, GRN, invoice) in the ERP. Management confirms that no changes were made to the program or its configuration during the year, and the auditor tested the control once at the start of the year, finding it effective. General IT controls over program change and access were tested and found effective. What is the most appropriate conclusion?

The auditor can reduce further testing of the automated control. Such controls operate consistently unless the program is changed, and effective general IT controls over program changes and access give assurance on that consistency. Random-failure testing, a fixed sample size, or excluding IT controls would all be incorrect.

  1. AThe auditor must test the automated control at least monthly because automated controls fail randomly
  2. BThe auditor can reduce the extent of further testing of that automated control, as effective general IT controls support its consistent operationCorrect
  3. CThe auditor cannot rely on the control unless a sample of 60 transactions is tested
  4. DThe auditor should ignore the control since IT controls are outside the scope of a financial statement audit

Explanation

Automated controls operate consistently unless the program changes. When effective general IT controls over changes and access are established, the auditor may limit repeat testing of the automated control. Monthly testing is a manual-control approach and no fixed sample of 60 is prescribed. IT controls relevant to financial reporting are within audit scope.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

Practise Digital Auditing & AssuranceFree diagnostic mock

More Digital Auditing & Assurance questions