109The auditor shall obtain an understanding of how the entity has responded to risks arising from IT.

109 The auditor shall obtain an understanding of how the entity has responded to risks arising from IT.

110 The use of IT affects the way that control activities are implemented. Ordinarily, the auditor considers whether the entity has responded adequately to the risks arising from IT by establishing effective general IT-controls and application controls. From the auditor’s perspective, controls over IT systems are effective when they maintain the integrity of information and the security of the data such systems process.

111 General IT-controls are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems. General IT-controls that maintain the integrity of information and security of data commonly include controls over the following:

• Data centre and network operations.
• System software acquisition, change and maintenance.
• Access security.
• Application system acquisition, development, and maintenance.

They are generally implemented to deal with the risks referred to in paragraph 72 above.

112 Application controls are manual or automated procedures that typically operate at a business process level. Application controls can be preventative or detective in nature and are designed to ensure the integrity of the accounting records. Accordingly, application controls relate to procedures used to initiate, record, process and report transactions or other financial data. These controls help ensure that transactions occurred, are authorised, and are completely and accurately recorded and processed. Examples include edit checks of input data, and numerical sequence checks with manual follow-up of exception reports or correction at the point of data entry.

Monitoring of Controls

113 The auditor shall obtain an understanding of the major types of activities that the entity uses to monitor internal control over financial reporting, including those related to those control activities relevant to the audit, and how the entity initiates corrective actions to its controls.

114 Monitoring of controls is a process to assess the effectiveness of internal control performance over time. It involves assessing the design and operation of controls on a timely basis and taking necessary corrective actions modified for changes in conditions. Those charged with governance and management accomplish monitoring of controls through ongoing activities, separate evaluations, or a combination of the two. Ongoing monitoring activities are often built into the normal recurring activities of an entity and include regular management and supervisory activities.

115 In many entities, internal auditors or personnel performing similar functions contribute to the monitoring of an entity’s activities. See ASA 610 Considering the Work of Internal Audit, for additional explanatory guidance. Management’s monitoring activities may also include using information from communications from external parties such as customer complaints and regulator comments that may indicate problems or highlight areas in need of improvement.