72IT also poses specific risks to an entity’s internal control, including the following:

72 IT also poses specific risks to an entity’s internal control, including the following:

• Reliance on systems or programs that are inaccurately processing data, processing inaccurate data, or both.
• Unauthorised access to data that may result in destruction of data or improper changes to data, including the recording of unauthorised or non-existent transactions, or inaccurate recording of transactions. Particular risks may arise where multiple users access a common database.
• The possibility of IT personnel gaining access privileges beyond those necessary to perform their assigned duties thereby breaking down segregation of duties.
• Unauthorised changes to data in master files.
• Unauthorised changes to systems or programs.
• Failure to make necessary changes to systems or programs.
• Inappropriate manual intervention.
• Potential loss of data or inability to access data as required.

73 Manual aspects of systems may be more suitable where judgement and discretion are required such as for the following circumstances:

• Large, unusual or non-recurring transactions.
• Circumstances where errors are difficult to define, anticipate or predict.
• In changing circumstances that require a control response outside the scope of an existing automated control.
• In monitoring the effectiveness of automated controls.

74 Manual controls are performed by people, and therefore pose specific risks to the entity’s internal control. Manual controls may be less reliable than automated controls because they can be more easily bypassed, ignored, or overridden and they are also more prone to simple errors and mistakes. Consistency of application of a manual control element cannot therefore be assumed. Manual systems may be less suitable for the following:

• High volume or recurring transactions, or in situations where errors that can be anticipated or predicted can be prevented or detected by control parameters that are automated.
• Control activities where the specific ways to perform the control can be adequately designed and automated.

75 The extent and nature of the risks to internal control vary depending on the nature and characteristics of the entity’s information system. Therefore in understanding internal control under paragraphs 52 and 109 of this Auditing Standard, the auditor needs to consider whether the entity has responded adequately to the risks arising from the use of IT or manual systems by establishing effective controls.

Limitations of Internal Control

76 Internal control, no matter how well designed and operated, can provide an entity with only reasonable assurance about achieving the entity’s financial reporting objectives. The likelihood of achievement is affected by limitations inherent to internal control. These include the realities that human judgement in decision-making can be faulty and that breakdowns in internal control can occur because of human failures, such as simple errors or mistakes. For example, if an entity’s information system personnel do not completely understand how an order entry system processes sales transactions, they may erroneously design changes to the system to process sales for a new line of products. On the other hand, such changes may be correctly designed but misunderstood by individuals who translate the design into program code. Errors also may occur in the use of information produced by IT. For example, automated controls may be designed to report transactions over a specified amount for management review, but individuals responsible for conducting the review may not understand the purpose of such reports and, accordingly, may fail to review them or investigate unusual items.

77 Additionally, controls can be circumvented by the collusion of two or more people or inappropriate management override of internal control. For example, management may enter into side agreements with customers that alter the terms and conditions of the entity’s standard sales contracts, which may result in improper revenue recognition. Also, edit checks in a software program that are designed to identify and report transactions that exceed specified credit limits may be overridden or disabled.

78 Smaller entities often have fewer employees which may limit the extent to which segregation of duties is practicable. However, for key areas, even in a very small entity, it can be practicable to implement some degree of segregation of duties or other form of unsophisticated but effective controls. The potential for override of controls by the owner-manager depends to a great extent on the control environment and in particular, the owner-manager’s attitudes about the importance of internal control.

Control Environment