GITCs: The Auditor’s POV

Revised CAS 315 is the fundamental standard in performing audits and identifying and assessing the risk of material misstatement. The standard has been modernized to include the requirement for an auditor to understand a client’s IT environment and identify the risks arising from the use of IT. This can pose a significant challenge for auditors who have not been trained in IT.

This course has been designed to consider IT risks and GITCs from the auditor’s point of view. In the session, auditors will develop an approach to gaining a deeper understanding of their client’s IT landscape by enabling them to ask the right questions. We will explore various aspects of a client’s IT environment including applications, infrastructure and processes and their impact on the audit. We will also discuss GITC concepts, how GITC risks relate to the IT environment and when design and implementation of GITCs is required.

The primary objective of this course is to equip auditors, even those without formal IT training, with the tools and knowledge to assess the IT environment, and the risks arising from the use of IT, effectively. Practical insights, real-world case studies, and documentation guidance will be provided to bridge the gap between auditing and IT expertise.

By the end of the session, participants will be able to:

• Identify the components of an entity’s IT environment including applications, infrastructure and processes
• Link CAS 315 terminology to the client’s IT environment
• Appreciate the components of General IT Controls
• Discuss risks arising from the use of IT with their clients
• Identify when the design and implementation of GITCs is required
• Document the client’s IT environment along with the risk arising from the use of IT

Instructor(s): Kirsten Albo, FCPA, FCA, ICD.D, President of ASK KSA Consulting Inc.