How an IT audit is scoped
Start from the risks that matter to the objective, then work down to the systems and controls that address them:
- Understand the business process and the significant accounts or objectives involved
- Identify the relevant applications and infrastructure supporting them
- Evaluate ITGCs for those systems (weak ITGCs undermine everything above them)
- Test automated application controls and key reports
- Conclude on whether reliance is appropriate
IMPORTANT — information produced by the entity (IPE): When a control or audit procedure relies on a system-generated report, the auditor must test the report's completeness and accuracy — typically by validating the report logic/parameters and agreeing data back to source. An untested report is not reliable evidence, however official it looks.
Computer-assisted audit techniques (CAATs)
| Technique | How it works |
|---|---|
| Test data | Auditor's fictitious transactions are run through the client's system to see if controls reject them |
| Integrated test facility (ITF) | A dummy entity inside the live system so test transactions process alongside real ones |
| Parallel simulation | Auditor's own program reprocesses real client data and results are compared |
| Embedded audit modules | Code within the application continuously flags transactions meeting audit criteria |
| Generalized audit software | Extract, sort, total, and analyze full data populations; identify duplicates, gaps, and outliers |
EXAMPLE: Using generalized audit software, an auditor tests 100% of disbursements for duplicate invoice numbers, payments to vendors added within the last 30 days, and round-dollar payments just under approval thresholds — patterns a sample would likely miss.
Reporting IT findings usefully
A well-written finding states the condition (what is), the criteria (what should be), the cause, the effect/risk, and a practical recommendation — then ties the risk back to a business consequence rather than a purely technical one.
EXAM TIP: Testing 100% of a population removes sampling risk but not nonsampling risk — the extract could be incomplete, or the criteria could be wrong. Always validate the completeness of the data set first.