TIAPS Module 1 Audit and Assurance workbook

IT controls may be manual, automated, or semi-automated. A useful article by AuditBoard
makes the distinction clear:
Automated controls are ideal in situations with high volume, uniform transactions. In
this case, there is little need for manual intervention or judgment. Automated controls
include the risk of relying on inaccurate systems and data or putting trust in an
inappropriate automation algorithm.
Manual controls are preferred when there is a need for human judgment. The need
for manual controls often arises when there is a low volume of transactions that
require discretion in deciding the outcome of the internal control process. Manual
controls run the risk of human error and intentional override.
A third control category also exists called semi-automated controls, sometimes
referred to as IT-dependent controls. With this type of automated control, human
intervention is still required, but the person’s action is dependent on the output for a
system. 66
In addition, the process of testing controls can be automated with significant benefits, as
described by EY:
• Increased operational efficiency (compared with manual controls and risk compliance
processes that may be “fragmented, siloed, and unsustainable.”)
• Reduced compliance costs associated with the manual effort, time, and errors.
• Improved controls assurance, allowing for high volume, high accuracy, and live
insights.
• Continuous controls improvement, making the shift “from controls testing as a
compliance exercise to a value-added program.” 67
The advanced tools described in Module 2 Good Governance, Managerial Accountability,
Developing Strategy, and Data Analysis section B.3.1, including data analytics, robotic
process automation, artificial intelligence, machine learning, deep learning networks, and
exploratory data analysis, can be used to enable automated controls testing.
C.3.3 Cybersecurity
IT is not just something that might fail through error, poor practice, and bad luck; it provides
a target for deliberate and often malicious attacks. The IIA Cybersecurity Toolkit provides a
checklist for undertaking cybersecurity audits of key areas to consider as part of the planning
and testing stages.
• Cybersecurity governance. (This is discussed in more detail in section A.4.)
• Inventory of information assets (hardware, software, and data).
66
Automated Controls Testing and SOX Testing, AuditBoard, 2016.
67
Automated Controls Testing: a stepping-stone to the future of internal audit, EY, 2021.
https://www.linkedin.com/pulse/automated-controls-testing-stepping-stone-future-internal-roffey/
67