The client runs on an ERP system. How do IT general controls affect your audit approach?

What the interviewer wants to hear

• ITGCs: access security, change management, operations and backups
• They support automated controls and system reports
• Weak ITGCs limit reliance on application controls and reports
• Tests access reviews, privileged users and change approvals
• Adjusts the approach with more substantive testing or report testing

Model answer

IT general controls are the foundation for relying on anything the system does automatically. They cover access security, such as who can create users or post entries; change management, meaning program changes are tested and approved; and IT operations like backups and job monitoring. If these are effective, I can rely on automated application controls, such as three-way matching or credit limits, and on system reports like the receivables ageing, with lighter testing. I would test them by reviewing user access lists and periodic access reviews, checking that privileged and super-user access is limited and logged, and sampling program changes for approval and testing. I also check that the audit trail feature, required for Indian companies’ accounting software, is enabled and not disabled during the year. If ITGCs are weak, I cannot rely on automated controls, so I test reports directly for completeness and accuracy and increase substantive testing.

More hard Auditor questions

• A client has made losses for three years and has a large loan repayment due in six months. How do you assess going concern?
• During the audit you find signs that a senior manager may be diverting payments to a vendor he controls. What do you do?
• Management refuses to book an audit adjustment you believe is material. How do you handle it?
• How would you audit management’s expected credit loss provision on trade receivables?
• You are the group auditor for an Indian parent with subsidiaries in the UAE audited by another firm. How do you plan and run the group audit?
• Related party transactions are a significant risk at a family-owned listed company. How would you audit them?
• The client’s CFO pressures you to sign the audit report today, but key evidence on a large provision is still pending. What do you do?
• How have you used, or would you use, data analytics to improve audit quality?
• Besides the main opinion, Indian statutory auditors report under CARO 2020 and on internal financial controls. How do you build this into the audit?