M/s TKR & Associates, Chartered Accountants, were conducting the statutory audit of Digital Solutions Ltd., a company operating in a highly…

At the conclusion of each audit, it is possible that there will be certain findings or exceptions in IT environment and IT controls of the company that need to be assessed and reported to relevant stakeholders including management and those charged with governance viz., Board of directors, Audit committee. Some points to consider are as follows: Are there any weaknesses in IT controls? What is the impact of these weaknesses on overall audit? Report deficiencies to management – Internal controls memo or Management letter. Communicate in writing any significant deficiencies to those Charged with governance. The auditor needs to assess each finding or exception to determine impact on the audit and evaluate if the exception results in a deficiency in internal control. A deficiency in internal control exists if a control is designed, implemented or operated in such a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis; or the control is missing. Evaluation and assessment of audit findings and control deficiencies involve applying professional judgement that include considerations for quantitative and qualitative measures. Each finding should be looked at individually and in the aggregate by combining with other findings/deficiencies. In the given case of Digital Solutions Ltd., the auditor should evaluate whether the identified weaknesses in user access controls, privileged user monitoring and change management controls constitute deficiencies in internal control and assess their impact on the audit. The findings should be evaluated both individually and collectively using professional judgement. Any deficiencies identified should be communicated to management through an Internal Controls Memo or Management Letter, while significant deficiencies should be communicated in writing to those charged with governance.