## Audit Approach in an Automated Environment
The audit approach in an IT environment follows four phases:
---
### Phase 1: Risk Assessment
- Identify significant accounts and disclosures
- Apply qualitative and quantitative risk considerations
- Identify relevant financial statement assertions (FSA)
- Identify likely sources of misstatement
- Consider risks arising from use of IT systems
---
### Phase 2: Understand and Evaluate Controls
- Document understanding of business processes using flowcharts / narratives
- Prepare Risk and Control Matrices (RCM)
- Understand design of controls by performing walkthroughs of end-to-end processes
- Consider entity-level controls and segregation of duties
- Evaluate General IT Controls (GITC) and Application Controls
---
### Phase 3: Test Operating Effectiveness
- Assess Nature, Timing, and Extent (NTE) of control testing
- Assess reliability of source data and completeness of population
- Testing of key reports and spreadsheets
- Sample testing of control evidence
- Consider competence and independence of staff performing controls
---
### Phase 4: Reporting
- Evaluate control deficiencies identified
- Classify as significant deficiencies or material weaknesses
- Advise on remediation of control weaknesses
- Issue Internal Controls Memo (ICM) or Management Letter
- Communicate significant deficiencies in writing to those charged with governance
- Issue Auditor's Report
---
### Key Tools by Phase
| Phase | Key Deliverable/Tool |
|---|---|
| Risk Assessment | Risk register, FSA mapping |
| Understand and Evaluate | Flowcharts, narratives, RCM, walkthroughs |
| Test Operating Effectiveness | Sample testing, data analytics (CAATs) |
| Reporting | Management letter, ICM, Auditor's report |