Two distinct IT environments require attention
SSQM1 requires appropriate technology to be obtained or developed, implemented, maintained and used for quality management and engagements. SSA315(Revised 2021) addresses the audited entity’s information systems and financial-statement and assertion-level risks. These are connected but different environments: a reliable firm tool does not prove a client system is reliable, and client control testing does not replace firm quality management. The guidance’s 2025 issue date and references to 2023 thematic work identify its context. Technology supports judgement and evidence rather than replacing accountability.
Identify all firm resources and functions
Inventory applications, infrastructure, processes and responsible people with process and tool owners. Practice systems include independence and rotation, background and conflict checks, archival and timesheets, resource planning, learning, performance appraisal and internal communication. Engagement resources include audit workflows, recalculation or reconciliation scripts, and extraction, validation or analytical tools. One application may serve multiple objectives. Include internally developed RPA/Python/SQL, purchased tools and network resources; understand design, local readiness and necessary modifications. Omitting shared conflict systems can miss incomplete corporate-family trees and non-assurance services that threaten independence.
Assess technology risks and approve suitable tools
Typical risks are inadequate pre-deployment evaluation, weak maintenance, unassessed external or network resources, unfamiliar users and cyber intrusion or changes. Responses include design/function certification, user acceptance tests across scenarios, pilots, access and change controls, helpdesk support, patches, feedback and adoption monitoring. Train users with workshops, guides, methodology and workpaper requirements, including where tools apply, correct operation and output interpretation. Review network controls and local duties, provider SOC reports, service levels, KPIs and issue trackers. Permit only evaluated and approved tools, and revisit controls after updates or replacement. Network provision does not transfer the firm’s responsibility.
Cyber safeguards cover devices, providers and continuity
The source’s examples include firewalls, VPNs, at-rest and in-transit encryption, intrusion prevention/detection, vulnerability and penetration testing, endpoint protection, anti-malware, restrictions on USB transfers and web file sharing, and email/web monitoring. Provider diligence can include information-security SOC reports and terms on updates and confidentiality. Awareness training and simulations, incident response, IT contingency, backups and recovery tests support continuity. These are illustrative controls, not a requirement to use every product listed. Firms that failed to identify cyber quality risks also omitted corresponding monitoring, leaving data confidentiality, reliability and operations exposed.
Test quality responses beyond enquiries
At minimum, monitoring covers key responses, additional high-risk responses, new or modified responses and prior-year exceptions. Inspect evidence, reperform or observe rather than merely ask owners or check approvals; calibrate samples to risk and control frequency. UAT review should establish complete functionality, representative cases and resolution before deployment. Ad-hoc installations require review of intended-use and security assessments and compliance with conditions such as authorised users and timing. Understand network testing scope, timing, extent and results to decide additional local monitoring and the annual SoQM effect.
Evaluate deficiencies and target the causes
Assess whether findings impair data integrity or application reliability, whether interdependencies make effects pervasive, and whether mitigating responses operate. Investigate root causes and develop immediate, interim and longer-term action. Revised risks and responses feed back into the quality system; remediation effectiveness depends on its relevance to the actual cause. The source refers to the 2023 Audit Regulatory Report and 2024 root-cause guidance for detail, without reproducing them. A signed approval or an unexamined network conclusion alone does not establish effective remediation.
Understand the client’s information flows and IT controls
Use enquiries, policy/process documents, flowcharts and transaction walkthroughs to understand initiation, recording, processing, correction and reporting. Identify applications, automated computations, reconciliations and three-way matches, and interfaces that affect completeness, accuracy and validity. General IT controls support continuing application-control operation. The three domains cover access provisioning/removal/review, privilege and passwords; development or change testing, approval, duty separation and migration; and operations including backup, recovery and scheduling. Highly automated e-commerce, finance, telecom and gaming models may have greater risks where complex controls bear substantial reliance.
Assess cyber incidents and choose an appropriate audit response
Consider cyber controls, AI/machine learning/blockchain use, system changes, IT review findings and incidents at the client or its providers. For a breach, understand events, assess relevant controls and possible reporting effects, design further procedures and evaluate disclosures. SSA330 control tests are required where reliance is planned or substantive work alone cannot supply sufficient evidence. If GITCs fail, assess compensating controls addressing the same risks and substantive evidence of whether risks materialised, then revise strategy if reliance remains unsupported. For system-generated evidence, test report-preparation controls and relevant applications, or perform substantive procedures on inputs and outputs.
Evaluate outsourced services and SOC evidence
Under SSA402, understand service organisations integrated into financial reporting, including custody, e-commerce hosting, cloud services and smart-contract execution. Type 1 or Type 2 SOC reports can help, but assess the service auditor’s competence and independence, reporting dates or periods, relevant applications and controls, and complementary user-entity controls. A bridging letter may be needed for a period gap; the guidance does not say that a letter automatically proves control effectiveness. Qualifications or deficiencies affect strategy and procedures. Outsourcing does not eliminate the need for sufficient relevant evidence.
Gaming case: cash checks alone may miss automated transactions
AppZ allows earned tokens, equipment redemptions, cash purchases and player-to-player trades. The auditor checked cash receipts and used reasonableness analytics for non-cash activity. Additional considerations are controls over non-cash flows, data volume and complexity, redemption/purchase/trading prices, automated computations, report logic and parameters. Given the automated model, substantive procedures alone may be insufficient. The case poses necessary evaluation questions; it does not supply a final opinion or declare every gaming audit must use the same tests.
Retail case: include web and mobile interfaces
The retailer added web in 20X1 and mobile in 20X2 alongside stores, with self-collection or delivery and cash rebates for later purchases. SystemZ integrated these channels, and an IT specialist examined its controls. The scope still needs to consider the web/mobile applications: transaction volume, pricing and rebates, interface complexity, and significant changes to the web system from 20X1 to 20X2. Testing only the central system may miss risks in transaction initiation and data transfers. The 20X dates are illustrative placeholders rather than actual launch years.
Digital-transformation support described in 2025
The cited 2025 AE survey reported a 7% rise in entities using at least two technology solutions; the document does not label it a seven-percentage-point change. It describes Enterprise Singapore’s EDG and PSG for qualifying innovation/productivity projects, accountancy-sector PSG support for audit/practice management and analytics, and IMDA’s CTO-as-a-Service consultants with no-cost advice tailored to business needs. These are programmes described at the publication date, not guaranteed current eligibility or funding rates. Investment should address capability and quality risks, rather than adopt tools without controls.
Official source
This article independently explains the substantive contents of the official PDF, including the relevant conditions, procedures and annexes. The linked document remains the authoritative source for its original wording, and later changes should be checked separately.
Read the official PDF ↗