CA Inter FM + SM

Answer to any seven of the eight statements:

(a) INCORRECT. The overall audit strategy, as per SA 300 (Planning an Audit of Financial Statements), is a high-level plan that outlines the scope, timing, and direction of the audit, not a record of audit evidence. The audit strategy addresses matters such as significant industry developments and changes in regulatory requirements. The record of audit evidence is maintained separately in audit working papers/documentation. The statement confuses audit planning documentation with evidence documentation.

(b) INCORRECT. Key audit matters (KAM) are not a separate opinion, per SA 701 (Communicating Key Audit Matters in the Independent Auditor's Report). KAMs are matters of most significance during the audit, selected from those communicated to those charged with governance. They are disclosed in the auditor's report to provide greater transparency, but they do not constitute a separate opinion nor do they cover all material matters—only the most significant ones. The auditor continues to give a single overall opinion on the financial statements.

(c) CORRECT. Amortization represents the systematic allocation of the depreciable amount (cost less residual value) of an asset over its useful life, as per AS 26 (Intangible Assets). This is the standard definition for the periodic allocation of costs of intangible assets. The term "depreciable amount" is consistently used in Indian Accounting Standards for both tangible and intangible assets to denote the amount to be allocated over the useful life.

(d) CORRECT. Section 142(1) of the Companies Act, 2013 explicitly states that the remuneration of the auditor "shall be in addition to any facility provided to him." This means that facilities (such as office space, equipment, or other amenities) provided to the auditor are considered part of the overall remuneration package and are subject to the approval process outlined in the Act.

(f) INCORRECT. Analytical procedures are not mandatorily used in all stages of the audit by all auditors, per SA 520 (Analytical Procedures). SA 520 requires analytical procedures to be applied in the planning stage (to obtain an understanding of the entity and identify risk areas) and in the overall review stage (to form a conclusion on whether the financial statements are consistent with the auditor's understanding). However, their use in the substantive testing phase is at the auditor's discretion based on the nature of the assertion and audit evidence required. The statement is too absolute.

(g) CORRECT. In the case of co-operative societies, contribution to the Education fund is a charge on profits (i.e., an expense deducted before distributable profits) and not an appropriation of profit, as per the accounting principles and statutory requirements governing cooperative societies. It is a mandatory expense that reduces the profit available for distribution, not a post-profit allocation.

(h) INCORRECT. Integrated ERP systems (SAP, Oracle, etc.) are more complex and challenging to audit, not less, compared to off-the-shelf accounting software. ERPs involve extensive integration of multiple business functions, complex customizations, extensive user access controls, multiple interdependencies, and sophisticated IT controls. The audit scope and complexity increase significantly due to the need to evaluate system controls, access rights, automated processes, and data integrity across integrated modules. The statement is factually reversed.

Part (a): Six Common IT Risks Related to Core Banking System (CBS)

1. Data Security and Confidentiality Risk: CBS stores highly sensitive customer financial data. Unauthorised access, data breaches, or insider threats can compromise confidentiality. Weak access controls or poor encryption increase exposure to cyber-attacks and data theft.

2. System Availability and Downtime Risk: CBS is expected to operate 24×7. Any unplanned downtime due to hardware failure, software bugs, power outages, or network disruption can halt banking operations, affecting customer transactions and causing reputational and financial loss.

3. Data Integrity Risk: Incorrect, incomplete, or corrupted data can arise due to software errors, concurrent transaction processing failures, or improper reconciliation. Data integrity issues can lead to wrong account balances, failed settlements, and regulatory non-compliance.

4. Migration and Implementation Risk: Migrating from legacy systems to CBS involves complex data conversion. Risks include data loss during migration, incorrect mapping of old data to new formats, incomplete testing, and business disruption during cut-over, leading to errors in customer records.

5. Interface and Integration Risk: CBS is integrated with multiple external systems such as ATMs, internet banking, payment gateways (NEFT/RTGS/IMPS), and third-party applications. Failures or mismatches at these interfaces can result in failed transactions, duplicate postings, or data inconsistencies.

6. Change Management Risk: Frequent updates, patches, and upgrades to CBS carry the risk of introducing new bugs, disrupting existing functionality, or causing compatibility issues with integrated systems. Inadequate change control procedures can destabilise the production environment.

7. Disaster Recovery Risk (additional for reference): Absence of a robust Disaster Recovery Plan (DRP) or Business Continuity Plan (BCP) can result in permanent data loss and prolonged outages in case of a major disaster such as fire, flood, or cyberattack.

(Any six of the above may be presented in the exam for full marks.)

---

Part (b): Four Characteristics of Public Cloud

1. On-Demand Self-Service: Users can provision computing resources — such as server time, storage, and network bandwidth — automatically, without requiring human intervention from the service provider. Resources are available as and when needed through a web interface or API.

2. Broad Network Access: Public cloud services are accessible over the internet using standard mechanisms (e.g., web browsers, mobile apps, laptops). This ensures availability across a wide range of client platforms and geographic locations, enabling remote access by any authorised user.

3. Resource Pooling (Multi-Tenancy): The cloud provider pools computing resources to serve multiple consumers simultaneously using a multi-tenant model. Resources such as storage, processing, memory, and bandwidth are dynamically assigned and reassigned as per demand. Individual tenants generally do not have visibility into the exact physical location of their resources.

4. Measured Service (Pay-per-Use): Cloud systems automatically control and optimise resource use by leveraging metering capability. Resource usage (storage, processing, bandwidth) is monitored, controlled, and reported transparently. Consumers pay only for what they use, making it a cost-effective model aligned with actual consumption.

(a) Six Advantages of Cyber Laws (IT Act 2000)

The Information Technology Act, 2000 is the primary legislation governing cyber activities in India. It provides a legal framework for electronic commerce and addresses cyber-crimes. The key advantages are:

1. Legal Recognition of Electronic Records and Digital Signatures: The IT Act 2000 grants legal validity to electronic records and digital signatures under Section 5, enabling paperless transactions to have the same legal standing as paper-based documents.

2. Facilitation of E-Commerce and Online Transactions: The Act enables businesses and individuals to conduct commercial transactions electronically with confidence, as contracts formed online are legally enforceable. This reduces dependency on physical documentation.

3. Prevention and Punishment of Cyber Crimes: The Act defines offences such as hacking, identity theft, cyber fraud, and publishing obscene content, and provides for penalties under Sections 65 to 75, thereby deterring cyber criminals.

4. Protection of Privacy and Data: Cyber laws provide protection against unauthorized access to personal data and sensitive information. Section 43A mandates that corporates implement reasonable security practices to protect sensitive personal data, providing compensation for negligence.

5. Establishment of Regulatory Authorities: The Act provides for the appointment of a Controller of Certifying Authorities (CCA) and Adjudicating Officers to regulate digital signature certificates and resolve cyber disputes efficiently without lengthy court procedures.

6. Recognition of Electronic Contracts and Banking Transactions: The Act makes online banking, electronic fund transfers, and e-contracts legally valid. Amendments through the IT (Amendment) Act, 2008 further strengthened provisions relating to electronic payment systems and intermediary liability, giving confidence to financial institutions and users.

---

(b) Audit of Environmental Controls — Four Key Factors and Activities

Environmental controls are physical safeguards that protect IT infrastructure from natural and man-made threats. As an IS Auditor, the following four factors and activities require attention:

1. Fire Detection and Suppression Systems: The auditor must physically inspect the availability and functionality of fire detection systems (smoke detectors, heat sensors) and fire suppression equipment (sprinklers, gas-based suppression systems like FM-200). It must be verified that these systems are regularly tested, serviced, and that suppression agents are non-damaging to IT equipment. Placement near server rooms and data centres must be reviewed.

2. Air Conditioning and Temperature/Humidity Controls: IT equipment is sensitive to temperature and humidity fluctuations. The IS auditor should inspect whether dedicated precision air conditioning units (CRAC units) are installed, whether temperature and humidity are continuously monitored, whether alerts are set for threshold breaches, and whether backup cooling exists to prevent equipment failure during primary HVAC failure.

3. Physical Access Controls and Security: The auditor must verify that access to computer rooms, data centres, and server rooms is restricted to authorized personnel only. Controls to examine include: biometric access systems, CCTV surveillance, visitor logs, mantrap doors, and whether entry/exit records are maintained and reviewed regularly. Unauthorized access attempts should be logged and followed up.

4. Power Supply and Electrical Controls: Continuous and stable power supply is critical for IT operations. The IS auditor should review the availability of Uninterruptible Power Supplies (UPS), diesel generators, and voltage regulators. The auditor must check maintenance schedules of UPS and generators, adequacy of fuel stock, automatic switchover testing, and earthing/grounding of electrical systems to prevent equipment damage from power surges or outages.

Final Answer: Part (a) lists six statutory and practical advantages of Cyber Laws under the IT Act 2000, and Part (b) identifies fire controls, temperature management, physical access, and power supply as four critical areas in the audit of environmental controls.