CA Final – Advanced Auditing & Professional Ethics Additional Questions for Practice (Chapter 4)

4
Chapter Audit in Automated Environment

Q.1 A Company is using ERP for all its business processes including Procurement, Sales, Finance
and Reporting. You are required to explain the Statutory Auditor’s approach to identify the
risks associated with the IT systems. [Study Material – ICAI]
Ans.: Auditor’s Approach to identify the risks associated with the IT System:
 The Auditor should understand and document each of the business processes in form of
narratives and/or flowcharts.
 The next process will be to identify areas/events that can lead to risks, viz. manual
Invoicing and accounting once goods are dispatched could lead to incorrect Invoicing and
accounting and hence is a ‘risk’.
 The Auditor should also analyse the risks i.e. the impact it will have if materializes. Next
will be prioritization in terms of probability of how often the risks will materialize.
Q.2 CA Vipin has been appointed as Statutory Auditor by IG Insurance Co. Ltd. for 3 of its
branches for the F.Y. 2020-21. Insurance Company is using a software called "Applied Epic"
wherein all transactions (policy issuance, premium receipts, expense of insurance
company, incomes, assets and liabilities) are recorded and financial statements generated
at the end of the financial year. CA Vipin not technically equipped and well versed with
technology, decided to follow traditional manual auditing approach and started the audit.
He is of the view that understanding and using the auditee's automated environment is
optional and not required. Do you agree with the approach and views of CA Vipin?
[Nov. 20 – New Syllabus (4 Marks)]
Ans.: Understanding the IT Environment:
As required by SA 315, auditor is required to obtain an understanding of the entity and its
environment as a part of Risk Assessment procedure to identify and assess Risk of Material
Misstatements. In an automated environment, auditor is required to obtain an understating of
the following:
1. Applications being used by the entity;
2. IT infrastructure components for each of the application;
3. Organisation structure and governance;
4. Policies, procedures and processes followed;
5. IT risks and controls.
The auditor is required to document the understanding of a company’s automated
environment as per SA 230.
Conclusion: The approach of CA Vipin is not correct considering the above-mentioned
requirements of SA 315 and SA 230.
© All rights reserved
Law stated in this publication is upto 31.10.2020 and is relevant for May 2021 Exams and onwards.
Disclaimer:
Every effort has been made to avoid errors or omissions in this publication. In spite of this, errors may creep in.
Any mistake, error or discrepancy noted may be brought to our notice which shall be taken care of in the next
edition. No part of this publication may be reproduced or copied in any form or by any means.

©CA. Pankaj Garg www.altclasses.in Page 1