ITGC Deficiency Evaluation: Why Understanding the Transaction Process is So Important

Over the years, we have noticed a common trend in IT audit issues in PCAOB inspection reports that can be grouped into two general topics:
- Inadequate scoping of IT systems for controls testing, and
- Evaluating Information Technology General Controls (ITGC) deficiencies.
Inadequate scoping of IT systems for controls testing generally happens because the audit engagement team does not have a complete understanding of how the systems process the transaction, miss scoping of important systems, and the related risk assessment falls short.
It is critical that the audit team understands which systems support important business processes through an integrated and thoughtful risk assessment. While the concept is simple, we often see cases where teams are not taking the time to properly understand and document the process with the company and the full audit team, including IT audit team members. Working as an integrated team is paramount to an effective risk assessment. Inadequate teaming can result in an incomplete list of key systems for ITGC testing or testing a set of systems that do not completely represent the true business process flow. This results in scoping and testing gaps.
The second most common IT-related finding, evaluating ITGC deficiencies, is often the result of team missing the full understanding of the systems when planning and performing a risk assessment. Once again, when audit teams have breakdowns in gaining a complete understanding of how the system processes the transaction, the information is not available to properly assess the impact of control deficiencies relating to systems.
As we approach the middle of Q2, interim testing and planning ITGC scoping for calendar year-end audits, now is the best time to discuss these points with your engagement team. Here are some of the ways firms and their engagement teams can start to address issues relating to incorrect systems in scope for control testing and the evaluation of ITGC deficiencies.
Align System Scoping with Risk Assessment
Engagement teams work hard to perform risk assessment procedures that are founded on their understanding of the flow of each set of business transactions. As you look to identify systems for control testing, be curious about the business you are auditing. Challenge teams to take that understanding one step further and truly dig deep into the systems and the data that supports the transactions being audited. This requires an integrated audit team member(s) with technical understanding of systems and how they process transactions that contain audit risks, especially significant risks.
As an integral part of risk assessment, scoping procedures should include:
- Specific names of applications in all audit documentation,
- All applications and modules used in the process,
- Documentation of a simple flow of the transactions,
- An understanding of the variations of processing transactions, and
- Non-core applications or bolt-on modules to an in-scope application.
Take Teaming to the Next Level with Joint Walkthroughs
The collective audit team (including IT auditors) must understand how the transaction makes its way through the processes. Usually a simple process flow, connecting each step of the process, will allow key controls to be easily identified along with what systems are supporting the flow and how data is captured and usually includes:
- Transaction path from cash to financial statement,
- Policies and procedures that apply,
- Employee interaction and notification, and
- The underlying technology enables each step along the way.
Our suggestion to capture the simple flow is to gather key team members for a whiteboard session. Start with the transaction (payment, shipment, sale, etc.) as one image/shape on the board. Then, ask the group, “What happens next?” adding on that action. After it is complete, circle back an ask, “How does the information move from one step to the next?” If these steps are repeated until the transaction makes it to the financial statements, it will help the engagement team see new areas or have a deeper understanding of what was previously documented. Through this exercise, teams benefit from a clear picture and can quickly identify the appropriate follow-up questions. As the team gains this understanding and asks more questions, we typically see new processes, interfaces, applications, and databases get introduced to the audit team. This complete picture is critical to the audit, and can confidently determine what should be scoped in and what could be scoped out.
Evaluate ITGC Deficiencies Against the “Integrated” Scoping and Risk Assessment
As the engagement team runs into control deficiencies, they will have a good understanding of how the issuer’s processes, policies, people, and procedures work to produce the financial statements. Consider responding by adjusting some audit procedures:
- Go back to documentation of why the deficient system was originally scoped in.
- Link the key controls that are dependent on the deficient system (it could be several processes).
- Tie in the original risks and “what could go wrong” analysis when the team planned the audit, with the evaluation of the ITGC deficiencies.
- Review the planning understanding, testing and conclusion to ensure a logical flow across the file.
The next time you purchase your morning coffee let your mind wonder and think like an IT auditor: How does that payment make its way to the financial statements of a large publicly-traded coffee shop? What are all the different systems used to support the processing of the actual payments and get the money to the bank and to the quarterly report?
About Johnson Global Advisory
Johnson Global partners with leadership of public accounting firms, driving change to achieve the highest level of audit quality. Led by former PCAOB and SEC staff, JGA professionals are passionate and practical in their support to firms in their audit quality journey. We accelerate the opportunities to improve quality through policies, practices, and controls throughout the firm. This innovative approach harnesses technology to transform audit quality. Our team is designed to maintain a close pulse on regulatory environments around the world and incorporate solutions which navigate those standards. JGA is committed to helping the profession in amplifying quality worldwide.
Visit www.johnson-global.com to learn more about Johnson Global.









