Understanding the Entity’s Use of InformUnderstanding the Entity’s Use of Information Technology in the Components of the Entity’s System of Internal Control

Understanding the Entity’s Use of Information Technology in the Components of the Entity’s System of Internal Control

1. An entity’s system of internal control contains manual elements and automated elements (i.e., manual and automated controls and other resources used in the entity’s system of internal control). An entity’s mix of manual and automated elements varies with the nature and complexity of the entity’s use of IT. An entity’s use of IT affects the manner in which the information relevant to the preparation of the financial report in accordance with the applicable financial reporting framework is processed, stored and communicated, and therefore affects the manner in which the entity’s system of internal control is designed and implemented. Each component of the entity’s system of internal control may use some extent of IT.

Generally, IT benefits an entity’s system of internal control by enabling an entity to:

• Consistently apply predefined business rules and perform complex calculations in processing large volumes of transactions or data;
• Enhance the timeliness, availability and accuracy of information;
• Facilitate the additional analysis of information;
• Enhance the ability to monitor the performance of the entity’s activities and its policies and procedures;
• Reduce the risk that controls will be circumvented; and
• Enhance the ability to achieve effective segregation of duties by implementing security controls in IT applications, databases and operating systems.

1. The characteristics of manual or automated elements are relevant to the auditor’s identification and assessment of the risks of material misstatement, and further audit procedures based thereon. Automated controls may be more reliable than manual controls because they cannot be as easily bypassed, ignored, or overridden, and they are also less prone to simple errors and mistakes. Automated controls may be more effective than manual controls in the following circumstances:

• High volume of recurring transactions, or in situations where errors that can be anticipated or predicted can be prevented, or detected and corrected, through automation.
• Controls where the specific ways to perform the control can be adequately designed and automated.

Understanding the Entity’s Use of Information Technology in the Information System (Ref: Para. 25(a))

1. The entity’s information system may include the use of manual and automated elements, which also affect the manner in which transactions are initiated, recorded, processed, and reported. In particular, procedures to initiate, record, process and report transactions may be enforced through the IT applications used by the entity, and how the entity has configured those applications. In addition, records in the form of digital information may replace or supplement records in the form of paper documents.