Important Questions

0. No. 1: The fundamental principle of an automated environment is the ability to

carry out business with
less manual intervention. Explain.
[MTP-March 19)
Or
Explain the meaning of automatedenvironment. Also discuss the key features of an automated
environment.
[RTP-May 19)
0. No. 2: Discuss the situations in which IT will be relevant to an audit,
[RTP-May 19|
Or
The auditor's responsibility includes reporting on Internal Financial Controls over Financial
Reporting which include and understanding IT environment of the company and relevant risks
and control. Mention any three situations where IT will be
relevant to an audit.
[Nov. 19 (3 Marks))
Q. No. 3: With the increasing adoption of information technology, business
today relles on software
systems andapplications more than ever. Many of these IT systems generate and
that is used in the preparation of financial statements of a company. The
process data
auditors also often rey
on the data and reports that are generated from these systems.
Explain stating clearly the
meaning of Automated environment with example. [RTP-Nov. 20]
6.2
Chapter6 Audit in an Automated Environment

N A When abustness operates n a more autonmated environment it is ltkely that we, as auditors, will
see several business functions and acttvitles happening within the systems. Bxplain which of the
aspectyouwill consider relevant as an auditor. [RTP-Nov. 18, Nov. 20; MTP-April 22)
Or
are likely to see several business
When abusiness operates tn a more automated environment, we
List down the bustness functions and
unctBons and activities happening within the systems. 21 (3 Marks)]
[Dec.
activities happening withln the systems. Explain giving
should consider relevance of IT in an audit of financlal statements,
No S The auditor [RTP-Nov, 21;MTP-Sep. 221
Teasons

mated Environment
 Important Questions
Na 6: List the points that an auditor should consider to obtain an understanding of the company's
automated environment. [May 18 (SMarks), RTP-Nov. 221
Or

Explain stating the points that an auditor should consider to obtain an understanding of the
company'sautomated environment. [MTP-March 22]
applying inquiry in combination with inspection gives the most effective and
efficient
0. No. 7: Generally,
combination is a matter of
audit evidence. However, which audit test to use, when and in what
automated
professional judgment. Discuss stating the different ways testing is performed in an
environment.
[MTP-0ct. 18]
could have an impact on the audit.
Q. No.8: Analyse how risks in the IT systemif not mitigated
[Nov.20 (3 Marks); MTP-Sep. 22]
the auditor when testing in an automated environment
0. No. 9: Discuss the common methods applied by JJan. 21 (4 Marks)]
isdone by him.
Objective of Data Center and Network Operations is to ensure that production systems are
Q. No. 10:
Discuss the activities performed by Data Center
processed to meet financial reporting objectives.
Network operations. Also explainthe meaning of General IT Controls in detail.
and [RTP-May 21]
auditor to
in an automated environment, it is not necessary for its
Q.No. 11: When the company is workiíng
automated environment and depends upon the professional judgment of the
understand its
whether gaining knowledge of company's IT systems is required or not. Do you
auditor as to [May 22 (3 Marks)]
?

agree with this statement?

"Program
objective and enlist the activities involved in the General IT Controls over
Q No. 12:Explain the [MTP-Oct. 22]
Change". control having IT environment? [RTP-Nov, 221
to the company's internal
Q No. 13: Which are specific risks relate to
environment, General IT controls are policies and procedures that
Q. No. 14:In an automated functioning of appllcation controls. One such area is
the effective
many applications and support security and what are the activities
incuded in it2
What is the objective of access
access security. [Nov. 22 (3 Marks)]

6.7
Chapter6 Audit in an Automated Environment
Important Question
Explain the meaning of Internal Financlal Controls clearly statíng reporting requirement (with
0.No.15:
reference to audit) on adequacy of internal financial controls. Also discuss about its (reporting
requirement on adequacy of internal financial controls) applicability on various types of
Companies. [RTP-May 22]

6.4- Data Analytics

ConceptofData Data analytics is an analytical process by which meaning information is generated and
Analytics prepared from raw system data using processes, tools, and techniques.
" In an automated environment, various insights can be extracted from operational,
financial, and other forms of electronic data internal or external to the organization
The data so extracted is useful for preparation of Management Information System (MIS)
reports and electronic dashboards that give a high-level snapshot of business
performance.
The data analytics methods used in an audit are known as Computer Assisted Auditing
Techniques or CAATs.
Data analytics can be used in testing of electronic records and data residing in IT systems
using spreadsheets and specialised audit tools viz., IDEA and ACL.
Application of In an automated environment, auditors can apply the concept of data analytics for several
Data Analytics aspects of an audit including the following:
Check completeness of data and population that is used in either test of controls or
substantive audit tests.
Selection of audit samples - random sampling systematic sampling.
Re-computation of balances - reconstruction of trial balance from transaction data.
Reperformance of mathematical calculations - depreciation, bank interest calculation.
Analysis of journal entries as required by SA 240.
Fraud investigation.
Evaluating impact of control deficiencies.

Steps involved in Step - 1 Understand Business Environment including IT.

using Data Step - 2 Defines the Objectives and Criteria against which subject matter will be
Analytics evaluated.

Step- 3 Identify Source and Format of Data

Step -4 Extract Data

Step - 5 Verify, Completeness, accuracy and Validity of extracted Data

Step -6 Apply Criteria on data extracted.

Step-7 Validate and Confirm results

Step - 8 Document the results and report the conclusions.

Important Question
Q. No. 16: Data analytics can be used in testing of electronicrecordsand data residing in IT systems using
enreadsheets and specialised audit tools viz., IDEA and ACL to perform check completeness of
6.9
Audit in an Automated

ExplChapatlenrs
Environment
data and populationthat is used in either test of controls or substantive audit tests, P
[RTP-May 20, MTP-Oct. 20,
detail stating allthe relevant points.
Or

While it is true that companies can benefit immensely from

the use of data analysis in
RTP-May21
increased proftability, better customer service, etc, Analyse various functions that
performed even by the auditor also using Data Analytics tools and techniques in the and
process to obtain good results. [Nov. 20 (4 Marksh
6.5- Assess and Report Audit Findings
Consideration Weaknesses identified in IT controls.
while assessing Impact of these weaknesses on overall audit.
the findings Reporting of deficiencies to management through Management Letter.
Communicate in writing any significant deficiencies to TCWGas per requirement of SA 284
Assessment of The auditor needs to assess each finding or exception to determine impact on the audit an
findings evaluate if the exception results in a deficiency in internal control.
As per SA 265, a deficiency in internal control exits if a control is designed, implemented r
operated in such a way that it is unable to prevent, or detect and correct, misstatements n
the financial statements on a timely basis; or the control is missing.
Evaluation and assessment of audit findings and control deficiencies involves applying
professional judgment that include considerations for quantitative and qualitatie
measures. Each finding should be looked at individually and in the aggregate by combinig
with other findings/deficiencies.

Important Questions
Q.No. 17:Foreceful Limited ís a company dealing in mobile spare parts and having its showrooms in almast
all the states in the country. For FY 2022-23, the company transferred its accounts from manual te
computerized system (SAP). PQR &Co, Chartered Accountants have specialization in the syste
audit and have been appointed as the system auditor. PQR &Co., at the end of the audit concudes
that there are certain findings or exceptions in T environment and IT controls of the company
which needs to be assessed and reported. Mention those points of consideration.
July 21(3 Marksl
Or
The Auditor of HK Limited completed the audit of the company in an automated environne
Management of the company requested the auditor to give an idea about any exceptions obsen
in IT environment that need to be assessed. How the auditor should consider this request
report in ight ofan audit perspective? [May22 (3Marks

6.6- Definitionof Important Terms

retrievalo
Applications Computer software programs that provide a medium for recording, storage and
business operations or transactions in electronic format.
effort
Automated An activity that is performed bya computer system and does not require manual
analysins
audit for
Computer. Assisted Collection of computer-based tools and techniques that are used in an
Audit Techniques data in electronic form toobtain audit evidence.
6.10
Audit in an Automated
Environment
Q. No. 18: With respect to audit in Important Questions Chapter 6
an automated
(a) CAATS environment, explain thefollowing:
(b) Data Analytics
(c) Database
(d) Information Systems
(e) Privileged access
Q. No. 19: With respect to audit in an automated [Nov.18 (5 Marks), MTP-May 2
() Data Processing
environment,explain the following: (any four)
(ii) ERP (Enterprise Resource
Planning)
(ii) General IT Control
(iv) Automated
(v) Direct Data change
Q. No. 20: With respect to audit in an automated
environment, explain the following: (any four)
[MTP-March 21
) Applications
(i) Control Deficiency
(iiü) Data Processing
(iv) Enterprise Resource Planning
(v) Software
Q. No. 21: With respect to audit in an [MTP-April 21
automated environment, explain the following:
) Applications
(ii) Automated
(ii) CAATS
(iv) Data Processing
(v) General (IT) Controls
Q. No. 22: With respect to audit in [RTP-May 22]
an automated
() CAATS environment, explain the following:
(ii) Data Analytics
(iii) Database
[MTP-Oct. 22

Objective Type Questions (True/False,

1 In an audit of
financial statements, the auditor should plan Correct/incorrect)
Ans.: Statement is incorrect.
response to all IT risks.
The auditor should plan
response to those IT risks that are
"all" IT risks. relevant to financial reporting anu
2 General IT controls support the functioning of
Ans.: Statement is correct.
Application controls.
General IT controls support the
controls. functioning of automated application controls and IT
depenu

6.12
Chapter6
3 Inquiry is often the most
efficient audit testing method, but least Audit in an Automated Environment
Ans.: Statement is correct. effective.
Inquiry is the most efficient
used in combination with audit test but it gives least audit evidence. Therefore, inquiry
other audit testing methods. should be
Snecialised audit tools like IDEA, ACL are required to Inquiry alone is not sufficient.

Ans.: Statement is incorrect.

perform data analytics.
Specialised audit tools are very useful, but not
analytics. always required or necessary to carry out data
More commonly available spreadsheet
carrying out data analytics.
applications like MS-Excel can also be effectively used for
5 During the assessment of Internal Controls, if the
auditor can test Compensating controls, he should
obtain evidence of other mitigating factors.
Ans.: Statement is incorrect.
If the auditor can test Compensating controls, he should obtain additional evidence that may be
required. Obtaining evidence of other mitigating factors is required when he can't test
compensating
controls during his assessment of the Internal Controls.
6 An automated environment basically refers to a business environment where the
processes,
operations, accounting except the decisions are carried out by using computer systemns.
Ans.: Statement is incorrect.
An automated environment basically refers to a business environment where the processes, operations,
accounting and even decisions are carried out by using computer systems
7 The Company auditor need not report on the efficacy of Internal Financial controls in his Audit Report
in the case ofa One Person Company.
Ans.: Statement iscorrect.
proviso to
AOne Person Company and Small Company are exempted from this requirement as per
Section 143(3) (1).
audit testing method gives the most
8 Generally, applying inguiry in combination with reperformance as
effective and efficient audit evidence
Ans.: Statement is incorrect.
inspection gives the most effective and efficient audit
Generally,applying inquiry incombination with
evidence.
automated environment is the ability to carry out business with less
9 The fundamental principle of an [MTP-March 18, Oct. 18, March 19]
system driven.
manual intervention and more
Ans.: Statement is correct.
out business with
automated environment is the ability to carry
The fundamental principle of an
and more system driven.
less manual intervention of automation i.e.. if a businese
The complexity of a business
environment depends on the level
complex.
is likely to be more
environment is more automated, it
process level
controls include manualcontrols only that operate ata business
10 Application [MTP-March 18, Aug. 18, 0ct. 18]
6.13
 Audit in an Automated Environment
Ans.: Statement is incorrect.
Chapter
Application controls are manual or automated procedures that typícally operate at abusinese
process level and apply to the processing of individual applications.
Application controls relate to procedures used to initiate, record, process and report transactions or
other financial data. These controls help ensure that transactions occurred are authorised, and are
completely andaccurately recorded and processed.
11 When auditing in an automated environmnent. inguiry is often the most efficient and effective aude
testing method. INov. 18 (2 Marks), MTP-Oct. Z1, Nov. 21
Ans.: Statement is incorrect.
should
Inquiry is the most efficient audit test but it gives least audit evidence. Therefore, inquiry
sufficient.
used in combination with other audit testing methods. Inguiry alone is not
ie., if a busine
12 The Complexity of a business environment depends on the level of automation
environment is more automated, it is likely to be less complex. [Jan. 21 (2 Marks
Ans.: Statement is incorrect:
The fundamental principle of an automated environment is the ability to carry out business with
less manual intervention and more system driven.
" The complexity of a business environment depends on the level of automation Le., if a businese
environment is more automated, it is likely to be more complex. If acompany uses an integrated
enterprise resource planning system (ERP) viz., SAP, Oracle etc., then it is considered more complex
to audit.
On the other hand, if acompany is using an off-the-shelf accounting software, then it is ikely to be
less automated and hence less complex environment.
13 objective ofr
With reference to General IT control, the ohiective of Data Center andNetwork Operations is to ensure
that systems are developed, configured andimplemented to meet financial reporting objectives.
MTP-Nov. 211
Ans.: Statement is incorrect.

Objective of "Data Center and Network Operations" is to ensure that production systems are
processed to meet financial reporting objectives.
To ensure that systems are developed, configured and implemented to meet financial reporting
objectives is covered within the function of "Application system acquisition, development, and
maintenance".

14 All automated environmentsare not complex. [MTP-Nov. 21|

Ans.: Statement is correct.
The complexity of an automated environment depends on various factors including the
nature ot
business,level of automation, volume of transactions, use of ERP and so on.
There could be environment where dependence on IT and automation is
relatively less or mini
and hence, considered less complex or even non-complex.
15 A combination of processes, tools and techniques that are used to tap vast
amounts of electronic aa
to obtain meaningful information is known as meaningful data. [MTP-March22
Ans.: Statement is incorrect.
Acombination of processes, tools and techniques that are used to tap vast amounts of electronic datt
obtain meaningful information is known as Data Analytics.
6.14
Chapter6
automated Audit in an Automated Environment
16 In an environment,
the relationship between the application controls and the General IT
controls over IT systems are not interrelated.
Ans.: Statement is incorrect. [Nov. 22 (2 Marks)]
These two categories of control over IT
systems are interrelated.
The relationship between the application
controls and the General IT Controls is such that General
IT Controls are needed to support the
functioning of application controls, and both are needed to
ensure complete and accurate information processing
through IT systems.

Sommary of Examination Weightage

Attempt Marks of Objective Marks of Subjective Topics Covered
Questions Questions
May 2018 5
Understanding of Automated Environment
Nov. 2018 2 5 Definitions of terms used
May 2019# 0 0

Nov. 2019# 0 3 Relevance of IT in audit

May 2020* Exams cancelled due to Covid-19
Nov. 2020# 0 4+3 DataAnalytics + Impact of IT Related Risks
Jan. 2021# 2 4 Commonly used Testing Methods
July 2021+ 2 3 Consideration while assessing the findings
Dec. 2021# 0 Business functions and activities
happening within the automated systems
May 2022# 0 3+3 Assess and Report Audit Findings +
Understanding of Automated Environment
Nov. 2022* 2 3 Objective of access security and its activities

"Marks are given only for descriptive part of the paper.