We are assuming the following:

During our external IT audit control interim testing, three control failures were identified.

1. Security and Access Logical

1) Control Objective => Policies and procedures are in place to prevent the improper use, disclosure, modification, or loss of critical financial data that would adversely affect the reliability of financial reporting.

ITGC Control Failure #1 => Users are required to change passwords every 120 days.

2. Security and Access Physical

1) Control Objective => Policies and procedures are in place to prevent the improper use, disclosure, modification, or loss of critical financial data that would adversely affect the reliability of financial reporting.

ITGC Control Failure #2 => Only authorized personnel are allowed to access computer facilities. Access logs are regularly reviewed.

3. Computer Operations Data Backup

1) Control Objective => Policies and procedures are in place to prevent the loss or corruption of critical financial data that would adversely affect the reliability of financial reporting.

ITGC Control Failure #3 => Programs and data are regularly and appropriately backed up and available in the event of an emergency

These three ineffective ITGCs affect the nature, timing, and extent of substantive and control procedures that the IT auditor performs to address the risks that financial statement amounts, or disclosures are materially misstated.

I. Please explain in some detail the impact of ineffective ITGCs on:

How the nature of the testing changes from the interim testing procedures to the year-end testing procedures.

The most appropriate timing of the year-end testing procedures.

How the extent of the year-end testing procedures will be impacted.

II. How could the auditor substantively test the three ineffective ITGCs to provide reasonable assurance that the financial statements are free of material misstatements?

Assume that the auditor concludes that all three ITGC processes are ineffective for the full year for a financial statement audit.