This article was written by Garikai Nharara [IT Risk & Compliance Assistant Manager]
The traditional world of audit as we knew it simply no longer exists. Today the general ledger sits on a cloud hosted system, with complex databases, automated data transfers and audit trails consisting of millions of lines of code. Gone are the days of revenue recognition through Finance manually capturing entries; Now this process is triggered by a mouse click, processed through an API, and calculated by an algorithm. Consequently, we have reached a tipping point: you cannot deliver a high-quality financial audit without gaining assurance over the IT environment.
The necessary shift
Imagine a service delivery business that generates revenue based on time spent on client work, hours that need to be line manager approved and a system that tracks the delivery, that triggers the revenue realisation. The substantive audit testing approach verifies and reconciles total hours and expected revenue. However, if the time capture system has the incorrect charge out rates configured, coding errors that allow the bypassing of appropriate approvals and inaccurate revenue calculation logic due to unauthorised code changes, your manual verification of today’s revenue won’t tell you that the process is fundamentally broken because of the system.
Modern financial statements are just the output of highly integrated process & systems. If the internal logic of the system – be it the software that calculates tax, scripts that recognize revenue, systems that provide stock valuations, or automated journals for record and capture are flawed, then every single balance produced is a potential risk. A high-quality audit today must consider the full process, rather than just focusing on the output. Gaining comfort over the system logic provides a much higher level of assurance over millions of transactions than ever could be done, by manually sampling a few hundred invoices.
Compliant & Critical
Regulatory bodies around the globe such as PCAOB, FRC & IRBA have refined their probing during regulatory reviews, often finding deficiencies in an audit which are related to the IT landscape. The most common call outs being IT General Controls (ITGCs), which are the foundational elements for a strong IT controls landscape. Regulatory call outs pose significant risks beyond immediate fines; some long lasting consequences include reputational damage and in serve cases licensing restrictions.
The most critical of these areas is Access Management. The greatest risk to financial integrity is an unauthorized person having the “keys to the castle”. If a developer writes the code for a system and posts journals, occurrence is questionable, fraud risk skyrockets and completeness is compromised. Similarly, Change Management ensures that when system changes occur, thorough testing completed before system go-live. Without some of these foundational building blocks, the financial data is built and sits on risky ground. If an auditor is testing the financials but cannot prove who had access and what changes were made to the system, per ISA 315 (Revised 2019) they cannot rely on any of the data that system produces.
Planning around strong IT Controls
The common misconception is that IT audit specialists drain budgets and stretch engagements. The opposite is true. When an audit team identifies weak IT controls in a company, they lose reliance. This means that the data generated from the system cannot be trusted. Depending on where along the journey this is discovered, if ever, the audit team must pivot to manual testing. In addition to the increased risk exposure, this is the “Inefficiency tax” that must now be paid.
The late or worse still, absence of IT involvement, in today’s audit landscape often leads to scope creeps, unexpected changes in testing, pressure on frustrated client resources, and a higher likelihood of last-minute surprises that can lead to negative repercussions.
Navigating cloud
The move to cloud infrastructure has added another layer of complexity for many organisations. A complexity that many businesses do not fully comprehend and often pushed to the lower end of the priority list. While cloud solutions such as AWS have secure servers and generally secure measures, how the company configures its system is their responsibility.
With ERP systems like SAP or Oracle becoming more integrated, finance auditors cannot gain an understanding of the systems without IT specialist involvement. IT specialists go beyond the user interface to ensure the structural and functional components of the systems are reliable. They understand how data flows between different platforms and where leaks are likely to occur.
Value of early integration
The highest quality audits are those where IT specialists are embedded from day one. Early involvement during the planning phase shifts the approach from being a “reactive” exercise, fault finding after the fact, to a “proactive” approach.
When IT audit is central to the audit process, it provides stakeholders with a clear map of their IT financial risks. It identifies where systems are inefficient, where data is vulnerable, and where automation can be leveraged to make the audit smoother. IT audit is no longer a tick box exercise; it is a strategic necessity that ensures the financial statements’ audit is told accurately, efficiently, and securely.
