Para 3.22.12 — MSO (Audit)
Original Rule Text
3.22.12 After completing the preliminary evaluation of the computer systems, the auditor has to decide whether it would be more appropriate to adopt the system-based audit approach or the direct substantive testing approach. The aspects to be borne in mind in arriving at the decision are the following:
(i) results of the preliminary evaluation;
(ii) extent to which reliance can be placed on any work carried out by the internal audit wing of the auditee organisation;
(iii) nature of any constraints, such as the absence of any audit trail, and the practicability of testing;
It has also to be borne in mind that effective compliance testing of key computer controls may be difficult necessitating the use of large samples to test each control.
- A. Direct Substantive Testing
What This Means
After the preliminary evaluation, the auditor must decide between two approaches: system-based audit (examining and testing controls within the system) or direct substantive testing (testing actual transactions for correctness). The decision depends on the preliminary evaluation results, reliability of internal audit work, and practical constraints such as the absence of audit trails.
This explanation was generated with AI assistance for educational purposes. Always refer to the official gazette notification for authoritative text.
Key Points
- 1Two audit approaches: system-based audit or direct substantive testing
- 2Decision follows the preliminary evaluation
- 3Results of preliminary evaluation guide the choice
- 4Extent of reliance on internal audit work affects the decision
- 5Practical constraints like absence of audit trails must be considered
- 6Compliance testing of computer controls may require large samples
Practical Example
After evaluating a computerised pension processing system, the auditor finds that the system has no audit trail — once data is processed, intermediate steps cannot be reconstructed. The internal audit wing has not audited the system in three years. Given these constraints, the auditor decides to use direct substantive testing, selecting a sample of 500 pension cases to manually verify calculations rather than trying to test system controls.
This explanation was generated with AI assistance for educational purposes. Always refer to the official gazette notification for authoritative text.
Frequently Asked Questions
What is the difference between system-based audit and substantive testing?▼
What is an audit trail in computerised systems?▼
Can both approaches be combined?▼
This explanation was generated with AI assistance for educational purposes. Always refer to the official gazette notification for authoritative text.