Moby Manufacturing Ltd. has substantially automated its accounting and production processes. During the audit of the financial year 2026–27, CA Neha…

CA Final · Advanced Auditing, Assurance and Professional Ethics · MTP · November 2026
Moby Manufacturing Ltd. has substantially automated its accounting and production processes. During the audit of the financial year 2026–27, CA Neha observed the following: The company's IT team made certain changes to the payroll application directly in the live environment without following the prescribed approval and testing procedures. The company has recently upgraded its inventory software, but certain branches continue to use the older version, resulting in errors while transferring inventory data between systems. In certain situations where the automated system could not process transactions, employees were permitted to override system-generated entries manually without independent review or proper documentation. The company experienced a ransomware incident in which certain financial and customer data became inaccessible and some files were found to be corrupted. The backup arrangements were also found to be inadequate. Based on the above observations, identify and briefly explain the four risks arising from the use of IT that CA Neha should consider while planning the audit of Moby Manufacturing Ltd.

Suggested Answer and Working Notes:

The following IT-related risks arise in the given case: Risk of unauthorised changes to IT applications/environment: Changes made directly to the live payroll application without proper approval and testing may result in unauthorised or inappropriate changes, which may adversely affect the processing and reliability of data. System integration and compatibility risk: Different versions of inventory software are being used by different branches. Incompatibility between systems may result in incorrect transfer or processing of data, bugs or errors in integrated systems. Risk of inappropriate manual intervention: Allowing employees to override system-generated entries without independent review creates a risk of inappropriate manual intervention, which may result in errors or unauthorised transactions being processed. Risk of data loss or data corruption: The ransomware incident and inadequate backup arrangements indicate a risk of loss or corruption of financial and other sensitive data. Such incidents may also expose the entity to fraud, cybersecurity and business-continuity risks.

Topics: Digital Auditing & Assurance

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic