Evaluating Software Risk as Part of a Financial Audit

Yigal Rechtman, CPA, CFE, CISM, CITP

The attention standards setters have given to the computerized environment has varied over the years. Currently, references to information technologies (IT) are sprinkled around the margins of audit standards. Yet in most complex organizations (defined here as a work environment large enough to enable a degree of segregation of duties), the majority of an entity's internal controls are handled by IT. According to a GAo estimate, internal controls are approximately 80% performed in some way by a computerized feature (Standards for Internal Control in the Federal Government, November 1999, www.gao.gov/special.pubs/ai00021p.pdf). Reliance on IT controls has become more formally recognized under the Public Company Accounting Oversight Board's (PCAOB) Auditing Standards 2 and 5. AS5 requires the following: