Photo by Jakub Żerdzicki on Unsplash
Digital systems allow transactions to be processed without physical documents visible to auditors. However, the absence of paper doesn't mean controls and audit evidence cannot be examined.
Auditors need to see how data is created, processed, stored, and protected. This is where the implementation of audit assertions help direct testing of information system risks.
Understanding the Concept of IT Audit in a Digital Transaction Environment
Digital transactions have different characteristics than manual processes. Most activities take place through applications, databases, networks, and automated mechanisms.
IT audit assist auditors in evaluating information technology controls related to security, processing integrity, and information reliability.
Testing should not focus solely on technology. Auditors also need to link these controls to assertions that support the reliability of the information. By applying appropriate audit assertions, auditors can more effectively evaluate both financial and operational information in a digital environment.
IT Audit Is: Testing System Controls Without a Physical Trace
IT audit is an inspection process that evaluates the control, security, and reliability of the information technology systems used by an organization.
In digital transactions, auditors don't always find evidence in the form of physical forms or signatures. Evidence can take the form of logs, configurations, transaction records, or system reports.
Some areas that may be of concern to the auditor include:
- User and administrator access rights.
- Application configuration changes.
- Transaction authorization process.
- Audit trail user activity.
- Application change management.
- Data backup and recovery process.
Such evidence helps the auditor understand whether the controls operated as designed and were reliable during the audit period.
Challenges of Verifying Management Assertions in Paperless Systems
Environment paperless changes the way auditors obtain and evaluate evidence in applying audit assertions. Transaction information may only be available in a database or application system, requiring auditors to adjust their testing approach.
This condition requires auditors to understand the data flow from when a transaction is created until it enters the report or system output.
Management assertions remain the basis for testing. Auditors can consider whether transactions are complete, accurate, actually occurred, and processed as required.
Testing also needs to consider the possibility of data changes, unauthorized access, or failure of automated controls.
Testing the Completeness and Accuracy Assertion of Digital Transactions
Photo by Vagaro on Unsplash
Completeness and accuracy are critical concerns when applying audit assertions when organizations process transactions through business applications. Both assertions require careful testing to ensure data integrity and accurate transaction processing.
Errors can occur due to configuration, integration between systems, processing failures, or inappropriate data changes.
Auditors need to determine procedures based on the risks and characteristics of the system being examined.
Strategy for Testing Completeness Assertions in System Data and Logs
The completeness assertion is a key focus in the application of audit assertions to digital systems. This assertion relates to the assurance that transactions or information that should have been recorded have been entered into the system completely and that nothing has been missed.
Auditors can compare source transactions with system records to find discrepancies or unrecorded transactions.
Testing may include:
- Compare transaction numbers sequentially.
- Match data sources with records in the application.
- Inspect system log for certain activities.
- Trace transactions from source to report.
- Identify gaps or duplications in transaction sequences.
These procedures need to be adapted to the application design and available data sources.
Auditors also need to ensure that log which is used as evidence has sufficient period, source, and information to support the test.
Ensuring Accuracy Assertions in Digital Financial Data Processing
The accuracy assertion is a critical component of applying audit assertions in a digital environment. The accuracy assertion concerns whether transactions are recorded and processed using accurate information and calculations in accordance with established business rules.
In digital systems, testing can be directed at business rules, application configurations, formulas, and processing results.
For example, auditors can test whether the system calculates transaction values according to established rules.
Auditors can also use reperformance to compare the results of system calculations with independent calculations.
If there is integration between systems, testing may include moving data from the source application to the next system.
This approach helps to find errors that may not be visible through just examining the final report.
Peran IT General Controls (ITGC) dan Application Controls
Assertion testing in information systems does not stand alone. Auditors need to understand the technological controls that support the reliability of application processes.
Two control groups that are often of concern are IT General Controls or ITGC and application controls.
ITGC is concerned with the general technological environment. Meanwhile, application controls focuses on the controls contained within a particular application process.
Both can support each other when the auditor assesses risks and determines testing procedures.
IT General Controls Audit for Access Security and System Governance
IT General Controls audit evaluate general controls that affect the organization's information technology environment.
Testing areas can include access management, system changes, IT operations, and application development or maintenance processes.
In access management, auditors can check whether:
- Access rights are granted based on job requirements.
- Access approval has been made by the authorities.
- User accounts that are no longer needed are disabled.
- Special access gets extra scrutiny.
- Changes to access rights are recorded and traceable.
Such controls are important because improper access can impact data reliability and transaction processes.
Implementation of Application Controls Internal Audit on Business Applications
Application controls audit internal focuses on the controls implemented within the application to ensure transactions are processed according to the rules.
Examples include input validation, transaction authorization, value limit checking, and control over data that does not meet requirements.
Auditors can test whether the controls are operating as designed and consistently throughout the audit period.
Testing can also use specific scenarios to see how the system responds to transactions that meet or violate the rules.
Test results help auditors determine whether application controls can be relied upon as part of audit procedures.
Synergy between ITGC and Application Controls in Supporting Audit Assertions
ITGC and application controls has a close relationship in the assessment of information system control.
For example, validation controls in an application may be well-designed. However, unauthorized program changes can impact the effectiveness of those controls.
On the other hand, a strong ITGC does not always ensure that every transaction rule in an application has been configured correctly.
Auditors need to consider both together to fully understand the risks. The application of audit assertions integrated with ITGC and application controls assessments ensures a comprehensive and effective evaluation of information system controls.
The relationship can be described as follows:
| Area Control | Testing Focus | Relation to Assertions |
| ITGC | System access and changes | Reliability of the processing environment |
| Application Controls | Transaction validation and processing | Completeness and accuracy |
| ITGC + Application Controls | Overall system integrity | Reliability of information |
Structured IT Audit Test Documentation Using Audithink
IT audit testing produces a variety of evidence, ranging from control examination results, screenshots, logs, to documentation of findings.
Without structured management, auditors may have difficulty tracing the relationships between risks, controls, procedures, evidence, and test results.
An audit management platform can help unify this information in one digital work environment.
Recording Control Tests and Issue Tracking on Digital Worksheets
Digital working papers help auditors document procedures, evidence, test results, and conclusions in a more structured manner.
Each test can be associated with a specific control or risk so that the process review become easier to trace.
Features issue tracking can also help monitor findings that require corrective action.
Information such as person in charge, status, deadline, and follow-up can be recorded in one flow.
This approach reduces reliance on separate documents and helps the audit team maintain documentation consistency.
Integration of IT Risk Mapping into the Organization's Risk Register
Technology risks don't always exist in isolation. System disruptions, unauthorized access, or control failures can impact business processes.
Therefore, the results of IT audits can be linked to risk register organizations to provide a more comprehensive picture of risk.
Mapping can include several pieces of information, such as:
- Risks and their causes.
- Affected business processes.
- Controls are already available.
- Auditor test results.
- Risk level.
- Follow-up plan.
- Person in charge of repairs.
This integration helps management see the relationship between technology findings and operational risks more clearly.
Conclusion and Solution of Audithink Audit Management Software
The application of audit assertions to information systems helps auditors assess the completeness, accuracy, and reliability of digital transactions through ITGC testing as well. application controls.
Audithink helps audit teams manage testing, documentation, risks, findings, and follow-up in a structured manner. Learn about the solution through Audithink or schedule an Audithink demo.
FAQ
What is an IT audit?
IT audit is the process of examining the control, security, and reliability of information technology used by an organization in carrying out business processes.
What is the relationship between audit assertions and information systems?
Audit assertions help auditors determine whether the information generated by the system is complete, accurate, valid, and in accordance with actual transaction conditions.
What is an IT General Controls audit?
ITGC audit is a test of general information technology controls, such as access management, system changes, IT operations, and technology environment security.
What is internal audit application controls?
Application controls audit internal is a test of controls in an application designed to ensure transactions are processed according to established rules.
Why do ITGC and application controls need to be tested together?
Both support each other. ITGC maintains the technological environment, while application controls control certain processes within the application.
How does Audithink help the IT audit process?
Audithink helps manage audit documentation, control testing, findings, risks, and follow-up through a digital audit management platform.
