FRN Ltd. is a technology-driven company where most transactions such as sales, purchases, and inventory movements are processed through an automated…

CA Intermediate · Auditing and Ethics · MTP · May 2026
FRN Ltd. is a technology-driven company where most transactions such as sales, purchases, and inventory movements are processed through an automated ERP system. The auditor observed that the company relies heavily on system-based processing, with minimal manual intervention. During the audit, it was noted that certain General IT Controls (GITCs), particularly relating to access controls and change management, are either not in place or are ineffective. The auditor is required to evaluate the effectiveness of controls and decide on appropriate audit procedures in such an automated environment. Explain the testing methods to be used by the auditor in an automated environment and the course of action where GITCs are ineffective.

Suggested Answer and Working Notes:

There are basically four types of audit tests that should be used, namely inquiry, observation, inspection and reperformance. Inquiry is the most efficient audit test but it also gives the least audit evidence. Hence, inquiry should always be used in combination with any one of the other audit testing methods. Inquiry alone is not sufficient. Reperformance is most effective as an audit test and gives the best audit evidence. However, testing by reperformance could be very time consuming and least efficient most of the time. Generally, applying inquiry in combination with inspection gives the most effective and efficient audit evidence. However, which audit test to use, when and in what combination is a matter of professional judgement and will vary depending on several factors including risk assessment, control environment, desired level of evidence required, history of errors/misstatements, complexity of business, assertions being addressed etc. The auditor should document the nature of test (or combination of tests) applied along with the judgements in the audit file. In the context of FRN Ltd., while testing in an automated environment, some of the more common methods are as follows: Obtain an understanding of how an automated transaction is processed by doing a walkthrough of one end-to-end transaction using a combination of inquiry, observation and inspection.Observe how a user processes transactions under different scenarios.Inspect the configuration defined in an application. Where the general IT controls are not existing or existing but ineffective, the auditor should assess the impact of IT risks and complexity of the automated environment in which the business operations take place and plan alternative audit procedures in order to rely on the system-based information. This may include performing additional substantive procedures and reducing reliance on automated controls. Thus, the auditor should apply an appropriate combination of audit testing methods based on professional judgement and, in case of ineffective GITCs, design alternative procedures to obtain sufficient and appropriate audit evidence.

Topics: Risk Assessment and Internal Control, Audit Documentation

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic