Chapter 12: Digital Auditing & Assurance
1. General IT Controls (GITCs) vs Application Controls
In an automated environment, reliable financial reporting depends on the symbiotic functioning of infrastructure controls and transaction-level controls.
| Control Domain | Scope & Core Objectives | Typical Examples |
|---|---|---|
| 1. Data Centre & Network Operations | Ensure proper job scheduling, backup & recovery, system monitoring, disaster recovery planning (DRP). | Automated off-site backups, UPS tests, server logs review. |
| 2. Program Change Management | Ensure modifications to applications and systems are authorised, tested, approved, and migrated safely. | User Acceptance Testing (UAT), segregation of Dev and Prod environments. |
| 3. Access Security (Physical & Logical) | Prevent unauthorized access to systems and data; enforce Segregation of Duties (SoD). | Multi-factor authentication (MFA), password complexity, periodic access rights review. |
| Application Controls (Automated) | Enforce completeness, accuracy, and validity of individual business transactions. | Input checks (range, format, check digits), automated 3-way matching of PO-GRN-Invoice, duplicate checks. |
If General IT Controls (GITCs) are ineffective, the auditor cannot rely on automated application controls or system-generated reports (IPE — Information Produced by the Entity) without extensive manual substantive testing!
2. Data Analytics & CAATs Testing
Computer Assisted Audit Techniques (CAATs) and Data Analytics enable auditors to analyze 100% of transactions rather than relying solely on traditional audit sampling.
| Audit Area | Data Analytics Routine / Procedure |
|---|---|
| Journal Entry Testing (SA 240) | Filter entries posted on weekends/holidays, entries posted by unauthorized users, round-sum entries, entries ending in '999', entries to rarely used suspense accounts. |
| Revenue & Receivables | Three-way matching of Sales Order, Delivery Challan, and Invoice; recalculate sales discounts; analyze price variances; identify unbilled shipments. |
| Inventory Valuation | Recalculate FIFO/Weighted Average cost across millions of SKUs; identify negative stock balances; age inventory dynamically to assess NRV write-downs. |
| Vendor Payments & Fraud | Detect duplicate invoices (same invoice number, amount, or vendor bank account); identify split purchase orders designed to bypass authorization thresholds. |
3. Emerging Technologies in Auditing
| Technology | Role in Audit & Assurance | Specific Audit Risk to Evaluate |
|---|---|---|
| Artificial Intelligence & Machine Learning (AI/ML) | Anomaly detection in general ledgers; contract review using NLP (identifying lease terms under Ind AS 116); predictive revenue modeling. | "Black-box" algorithm bias, lack of explainability, data poisoning, training data inaccuracy. |
| Robotic Process Automation (RPA) | Automating repetitive audit workflows (extracting trial balances, sending automated bank confirmation requests, reconciling GL with sub-ledgers). | Bot credential misuse, lack of change control over bot scripts, unattended bot failure. |
| Blockchain & Distributed Ledger Tech (DLT) | Real-time triple-entry bookkeeping, smart contract execution, immutable transaction timestamps. | Smart contract bugs/vulnerabilities, consensus protocol failures, private key security. |
4. Cybersecurity & IT Audit Governance
Cybersecurity risks directly threaten the integrity, confidentiality, and availability of financial data. The auditor must assess:
1. Incident Response: Does the company have a documented Incident Response Plan tested regularly?
2. Ransomware & Breaches: Have any cyber attacks occurred during the year? Assess financial impact (fines, customer compensation, asset write-downs) and disclosure adequacy under SA 250 & Ind AS 37.
3. IT Governance: Alignment with recognized frameworks such as COBIT, ISO/IEC 27001, and NIST.