CA Neha is auditing Rich Hotels Ltd., which processes vendor master modifications through email requests. Approvals are routed through an automated…

CA Final · Advanced Auditing, Assurance and Professional Ethics · MTP · January 2026
CA Neha is auditing Rich Hotels Ltd., which processes vendor master modifications through email requests. Approvals are routed through an automated workflow. The entity does not use multi-factor authentication for email accounts. Recently, the company suffered a fraud where a spoofed email led to unauthorized changes in vendor bank details and inappropriate disbursement of funds. Based on the above situation, which risk arising from usage of IT should the auditor primarily consider?
(A) Data loss or data corruption due to inadequate cybersecurity controls
(B) Unauthorized changes to IT applications or other aspects of the IT environment
(C) Unauthorized access to data resulting in improper changes to master data
(D) Inappropriate manual intervention leading to inaccurate recording of transactions

Suggested Answer and Working Notes:

Correct Answer: Option (C)

Unauthorized access to data resulting in improper changes to master data

Topics: Standard on Auditing (SA), Digital Auditing & Assurance, Quality Control

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic