CPA Exam — AUDAssessing Risk and Developing a Planned ResponseHard
An auditor is developing an overall audit plan for a client that has recently transitioned from on-premise servers to a fully cloud-based enterprise resource planning (ERP) system. This transition represents a significant change in the client's information technology environment. The auditor should specifically consider this change as increasing the inherent risk related to:
- AThe valuation of the client's investment in software licenses.
- BThe physical security of the client's hardware assets.
- CThe completeness and accuracy of data migration.
- DThe client's ability to recruit qualified IT personnel.
Show answer & explanationAnswer & explanation
Correct answer: C. The completeness and accuracy of data migration.
Migrating to a new ERP system, especially a fully cloud-based one, inherently carries a high risk that data from the old system is not completely or accurately transferred to the new system. This can lead to material misstatements in financial reporting, regardless of controls, thus increasing inherent risk.
Why the other options are wrong
- A. The valuation of software licenses might change with a cloud transition (e.g., subscription vs. perpetual), but the more pervasive inherent risk directly impacting financial reporting is the integrity of the data being processed by the new system.
- B. Moving to cloud-based systems typically reduces the client's responsibility for physical security of hardware, shifting it to the cloud provider, thus reducing this particular risk for the client.
- D. While IT personnel needs change, the inherent risk related to the ERP transition itself is primarily about the data and system integrity, not the client's recruitment capabilities.
Inherent Risk (System Implementation/Migration)
New system implementations or data migrations introduce inherent risks related to data integrity, completeness, and accuracy due to complexity and potential unforeseen issues.
- Data conversion/migration is a critical, error-prone step.
- Integration with other systems can be complex.
- Initial system setup and configuration can contain errors.
Memory trick: Cloud migration means 'DATA' 'INTEGRITY' is at 'RISK'.