G-Tech Solutions Ltd. is a large multinational corporation engaged in providing cloud-based financial services. The company's operations are heavily…

The auditor has to determine whether the entity's risk assessment process considers cybersecurity risks. While planning the audit in accordance with SA 315, key aspects CA Harsh would evaluate in identifying the entity's risk assessment process relating to cybersecurity are: Entity should conduct a periodic risk assessment & develop a management strategy which identifies cybersecurity risks around IT system failure affecting the entity's primary business or potential loss of data or inability to access data as required, risk of unauthorized access to the IT network.The entity should maintain and periodically review an inventory of their information assets- i.e., Asset Management (e.g., intellectual property, patents, copyrighted material, trade secrets and other intangibles).The entity should classify and prioritize protection of their information assets based on sensitivity and business value and periodically review the systems connected to the network on which digital assets reside.From the governance perspective management should review how cybersecurity risks affect internal controls over financial reporting. In case of adverse attack how management is going to assess the impact on the recoverability of financial data and impact on revenue recognition.Management needs to identify if any established a risk-based cybersecurity program can be leveraged (e.g. NIST, ISO etc.).To determine overall responsibility for cybersecurity in the business environment, entity should establish roles and responsibilities over cybersecurity (CISO, CIO). Further the risk assessment should be discussed with those charged with governance (e.g., the Audit Committee or Board of Directors). Since G-Tech Solutions Ltd. is highly dependent on proprietary software applications, automated revenue recognition systems and sensitive financial databases, the cybersecurity environment assumes significant importance from an audit perspective. Further, the attempted unauthorized access incident indicates the possibility of heightened cybersecurity risks. Therefore, CA Harsh should carefully evaluate the adequacy and effectiveness of the entity's cybersecurity risk assessment process, governance framework and related internal controls to identify risks of material misstatement and determine the nature, timing and extent of further audit procedures.