Skip to content

ACCA Strategic Professional · Advanced Audit and Assurance (International) · Other current issues

Zephyr & Co is auditing Danube Retail plc, which was hit by a ransomware attack during the year. Systems were restored from backups, and no ransom was paid. Management says the incident had no financial reporting effect. Which action best reflects the auditor's responsibilities under ISAs?

The auditor should assess whether the ransomware incident affects the risks of material misstatement, such as data integrity, IT general controls, disclosures, provisions and going concern, and design suitable responses. Management's assertion alone is not sufficient evidence, and the incident is not outside the audit's scope.

  1. ARely on management's representation, as cyber incidents are outside the scope of an audit
  2. BAssess whether the incident affects risks of material misstatement, including data integrity, internal controls, disclosure and going concern, and respond accordinglyCorrect
  3. CReport the incident to the regulator immediately without discussing it with management
  4. DWithdraw from the engagement because ransomware makes the financial statements unauditable

Explanation

ISA 315 (Revised 2019) requires the auditor to understand the entity's use of IT and the risks arising from it. A ransomware attack may affect the reliability of data, general IT controls, provisions or contingencies, disclosures and going concern. The auditor therefore evaluates these effects rather than accepting management's assertion alone. Ignoring the incident is wrong because it may give rise to risks of material misstatement.

Did you get it right without looking?

One question tells you little. A timed set on Other current issues shows your real accuracy, how long you take and where you lose marks.

Practise Other current issuesFree diagnostic mock

More Other current issues questions