136The consequences for further audit procedures of identifying such risks are described in ASA 330.

136 The consequences for further audit procedures of identifying such risks are described in ASA 330.

137 The understanding of the entity’s information system relevant to financial reporting enables the auditor to identify risks of material misstatement that relate directly to the recording of routine classes of transactions or account balances, and the preparation of a reliable financial report; these include risks of inaccurate or incomplete processing. Ordinarily, such risks relate to significant classes of transactions such as an entity’s revenue, purchases, and cash receipts or cash payments.

138 The characteristics of routine day-to-day business transactions often permit highly automated processing with little or no manual intervention. In such circumstances, it may not be possible to perform only substantive procedures in relation to the risk. For example, in circumstances where a significant amount of an entity’s information is initiated, recorded, processed, or reported electronically such as in an integrated system, the auditor may determine that it is not possible to design effective substantive procedures that by themselves would provide sufficient appropriate audit evidence that relevant classes of transactions or account balances, are not materially misstated. In such cases, audit evidence may be available only in electronic form, and its sufficiency and appropriateness usually depend on the effectiveness of controls over its accuracy and completeness. Furthermore, the potential for improper initiation or alteration of information to occur and not be detected may be greater if information is initiated, recorded, processed or reported only in electronic form and appropriate controls are not operating effectively.

139 Examples of situations where the auditor may find it impossible to design effective substantive procedures that by themselves provide sufficient appropriate audit evidence that certain assertions are not materially misstated include the following:

• An entity that conducts its business using IT to initiate orders for the purchase and delivery of goods based on predetermined rules of what to order and in what quantities and to pay the related accounts payable based on system-generated decisions initiated upon the confirmed receipt of goods and terms of payment. No other documentation of orders placed or goods received is produced or maintained, other than through the IT system.
• An entity that provides services to customers via electronic media (for example, an Internet service provider or a telecommunications company) and uses IT to create a log of the services provided to its customers, initiate and process its billings for the services and automatically record such amounts in electronic accounting records that are part of the system used to produce the entity’s financial report.