Cyber Risk in the Audit: IT General Controls and ISA 315

Cyber security is usually filed under IT risk, but for an external auditor it is an audit risk, and the standards have been explicit about it for several years. If an entity's financial reporting depends on systems, the auditor has to understand those systems and the controls over them. A ransomware incident or a compromise of a finance system is not just an operational problem for the client; it changes what the auditor can rely on. Our CPD course library covers audit, risk and controls in depth.

Where the requirement comes from

ISA 315 (Revised) requires the auditor to obtain an understanding of the entity's information system relevant to financial reporting, including the IT environment, and to identify risks arising from the use of IT. That is not an optional extra for technology clients. Any entity whose accounting records sit in software has an IT environment the auditor must understand.

The standard draws a distinction worth being precise about. Application controls operate inside a process, such as a three-way match on a purchase invoice. IT general controls sit underneath and make the application controls trustworthy. If the general controls fail, the application controls cannot be relied upon, however well designed they are.

The three ITGC areas, and what goes wrong in each

Access to programs and data. Who can get into the system, and what can they do once inside. Typical findings are shared administrator accounts, leavers who retain access, segregation-of-duties conflicts where one person can both create a supplier and approve a payment, and privileged access that nobody reviews.

Program change. How changes to systems are authorised, tested and moved into the live environment. The classic weakness is a developer who can write a change and deploy it without independent approval.

Program operations. Whether jobs run as intended, whether failures are detected, and whether backups exist and have been tested. The point of a backup test is not the backup; it is the restore.

What a cyber incident does to the audit

Treat a breach as a risk of material misstatement rather than a disclosure matter alone, and work through the consequences:

• Completeness and integrity of records. If an attacker had write access, or if systems were restored from backup, the auditor needs to establish what data was affected and whether the ledger is complete for the whole period.
• Reliance on controls. If general controls were compromised during the period, a controls-reliance approach may no longer be available, pushing the audit toward substantive testing with the budget consequences that follow.
• Accounting consequences. Provisions, contingent liabilities, impairment and insurance recoveries all come into play.
• Timing. An incident after the reporting date may be a subsequent event requiring disclosure, and in severe cases it bears on going concern.

Deficiencies identified along the way carry their own obligation. ISA 265 governs how internal control deficiencies are communicated to management and those charged with governance, and a significant deficiency in access controls is exactly the kind of finding it contemplates. We cover that process in communicating internal control deficiencies.

Practical questions that surface real weaknesses

Four questions tend to be more revealing than a controls questionnaire. When was privileged access last reviewed, and by whom? Can the person who writes a system change also approve its deployment? When was a restore last tested, as opposed to a backup last taken? And who in finance can change a supplier's bank details, with what second check?

That last one is where cyber risk and fraud risk meet, and it is the control that payment-diversion attacks are designed to defeat. Our guides on fraud risk and internal controls and assessing internal controls go further into the testing approach.

Frequently asked questions

Does a small audit still need ITGC work?

Understanding the IT environment is required regardless of size. What is proportionate differs; whether it is addressed at all does not.

Can an auditor rely on a service organisation's controls report?

A controls report over a service organisation can provide evidence, but the auditor still needs to consider its scope, period covered, and the complementary controls the report assumes the client operates.

Is cyber risk examinable in ACCA audit papers?

Controls over the IT environment and the auditor's response to risks arising from IT sit within the audit syllabus at both the Applied Skills and Strategic Professional levels, and scenario questions increasingly use technology-driven risks.

What the evidence looks like on file

Understanding the IT environment is a documentation exercise as much as an enquiry one, and a file that records only "discussed with IT manager" will not survive review. The working papers should show what the auditor did, not only what they were told.

For access controls that means a user listing as at a specific date, evidence of who authorised each privileged account, and a sample tested back to approval. Where a periodic access review is claimed to operate, the evidence is the completed review with the reviewer's name and date, plus what happened to the exceptions it raised. For change management it means selecting changes from the deployment log rather than from a list the client provides, and tracing each back to its authorisation and testing. For operations it means the restore test report, not the backup schedule.

Where general controls are found to be ineffective, the file needs to show the consequence: either an extended substantive approach, or a clear rationale for why the risk of material misstatement is nevertheless addressed. A deficiency recorded without a response is the finding most likely to be challenged.

How does this interact with an AI-enabled audit?

The same general controls underpin any analytics or automation the audit team relies on, and the data the tools consume must itself be complete and unaltered. We cover that overlap in our guide to AI in audit and ISA 315.