The-Accountant-Jan-Feb-2018

Financial Reporting and Assurance
occurrence, completeness,
accuracy, cutoff, allocation
and classification of
financial statement
balances. If the integrity
and availability of data has
an issue, then, the financial
statement account balances
may not be complete,
accurate, may not have been
allocated or classified in
the correct financial period
or account/budget codes
and transactions may not
have occurred. Meanwhile,
confidentiality has a direct
link on the existence of
IT assets. If there is an
issue with physical access
controls of IT physical
assets, as a result, the IT
physical assets may not
have existed as at year end.
Linking IT audit
to financial audit
process
According to ISA 315,
the planning phase of a
financial audit process
requires an auditor to
understand the IT internal
control environment as
part of understanding the
entity. Significant risks
identified in this stage
are considered in risk of
material misstatements in
the financial statements.
These key risks identified
should be linked to
financial statements
balances and responses to
the identified risks should
be determined. This is in
accordance to ISA 330, the
auditor should determine
the appropriate responses
to the identified significant
risks.
Secondly, when
performing the audit
program, test of controls
and substantive test of
details should include a
response to the IT risk
assessment. Finally, audit
findings from IT audit
should be incorporated in
the management letter to
IT assertions
include
confidentiality,
integrity and
availability.
Confidentiality
entails restricted
access techniques
to ensure that
information and
information
resources are
only accessible to
those who have
been authorized.
the auditee. There should also be a linkage
of internal control weaknesses that arose
from significant IT risks identified.
Challenges of linking IT Audit
to Financial Audit process
There are challenges that have been
identified in linking IT audit to financial
statements audit. These include:
• Lack of integration of IT controls
weaknesses in the management letter;
• IT control weaknesses may not
have been reported or communicated
adequately and timely to financial
auditors;
• Lack of clear understanding of IT Audit
issues by Financial Auditors;
• Lack of clear understanding of
Financial Audit issues by IT Auditors;
• IT control weaknesses follow-up has
not been carried out beyond the planning
phase;
• The risk of material misstatement at the
financial statement level resulting from
IT control weaknesses is not addressed
during planning, fieldwork, audit
conclusion and audit reporting phases.
Connecting the dots…
The following are practical suggestions
of connecting the dots… between IT
audit and financial audit process:
• Risk assessments should also
include a rigorous IT risk assessment
at planning phase. The IT internal
control checklist should be filled
accurately with sufficient details to
identify significant IT risks that
would affect the financial audit
approach;
• Responses to significant IT risks
assessed during planning phase should
be documented throughout the audit
process, i.e. in the risk of material
misstatement, overall audit strategy,
audit plan/audit program, reliance on
key controls and audit procedures to
be performed working papers;
• IT controls weaknesses should be
reported accurately and timely to
financial auditors so that they can
be incorporated in the management
letter to the auditee;
• There is need for training for
financial auditors to understand
significant IT risks and how they can
affect their audit approach;
• There is need for training for IT
auditors to understand how significant
IT risks affect the financial statement
assertions and hence financial audit
approach;
• There is need for training for IT
auditors to understand how to report
IT controls weaknesses without using
IT jargon, so that they can be easily
understood;
• IT auditors need to collaborate more
with financial auditors throughout
the audit process; hence IT audit and
financial audit findings should be
reported jointly in one management
letter. The two teams should work as
one team;
• Financial audit findings that have
IT control weaknesses related-causes
should be escalated to IT auditor for a
complex IT audit to be carried out.
Conclusion
Going forward, in complex information
technology environments, audit
quality will be particularly determined
by financial statement auditors’ ability
to incorporate IT audit risk assessment
in their audit approach.
achendaeunice@gmail.com
JANUARY - FEBRUARY 2018 7