> For the complete documentation index, see [llms.txt](https://engyon.gitbook.io/engyon/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://engyon.gitbook.io/engyon/en/training/it-audit-training.md).

# Training IT Audit

In this module you will learn how to record applications, IT General Controls and application controls in Engyon. You will also see how these components relate to processes, risks and assurance.

In Engyon, it is possible to record processes, applications, application controls and IT General Controls (ITGCs) as data elements. This creates a clear connection between the work of the financial audit team and that of the IT auditor.

The transfer to the IT auditor usually begins with the processes and application controls identified by the audit team. From there, the IT auditor assesses whether the underlying application controls and ITGCs can be relied upon.

You can work from two sides in Engyon:

1. The audit team can first create processes and application controls. The IT auditor then assesses whether these can be relied upon.
2. The IT auditor can also start from the IT environment and applications. The applications can then be linked to processes and application controls.

> The usual flow starts with `Knowledge of the entity and its environment`. Risk factors are identified from this phase. This is followed by understanding the `internal control system`, the information system and communication. It is then determined which line items are relevant, which processes underlie these line items and which application controls are linked to these processes. From that point on, the IT auditor can zoom in further on the application controls, applications and underlying IT General Controls.

See also [Module 7: Understanding processes](/engyon/en/training/training-english/module-7-relevant-processes.md) for processes, applications and internal control measures from the audit team.

### Creating applications

You create applications within `Procedures` in the navigation bar on the left, specifically under the `IT environment` work step. They are then always also visible under `Entity insights`.

1. You create applications within the `IT organisation` work step. Click on the plus icon (<i class="fa-plus">:plus:</i>). When creating an application, fill in the name (e.g., Exact) and description. If desired, you can link the application directly to a process.

   > **PLEASE NOTE:** if the processes do not yet exist, you can create the link later.
2. Open the application you created to go to the application's detail screen (e.g., `Exact`).

#### Linking underlying ITGCs

ITGCs under an application determine where you record design, occurrence and operating effectiveness — only then can `Relying` turn green.

* Open the application and click on <kbd>manage supporting ITGCs</kbd>.
* Link an existing ITGC or create a new one.
* Create a new ITGC: fill in `Name` and `Description` and select the `Domain` (e.g., `Access rights management`).
* You now have the application (e.g., `Exact`) with the ITGC (e.g., `Management for Exact`) underneath it.

  > **PLEASE NOTE:** the conclusion is currently still **negative**. `Design`, `Occurrence` and `Operating effectiveness` have not yet been worked out, so you cannot yet rely on it.

From your Scope screen you can link to:

* `Processes`
* `IT-dependent controls`
* `Underlying IT General Controls` (the application is then underlying to the ITGCs)

#### Working out Design, Occurrence and Operating effectiveness

1. Open the ITGC (e.g., `Management for Exact`). You open a separate screen with the tabs `Design`, `Occurrence` and `Operating effectiveness` at the top right.

**Design**

2. Under `Design`, you have automatically received a procedure: `Design and occurrence of logical access security`. This contains standard questions — in this example for logical access management.
3. Perform the activities and mark the design under `Design conclusion` as `Not traceable`, `Not yet effective` or `Effective`.
4. Mark the design as `Effective`. A check mark now appears at `Design` at the top of the screen.

**Occurrence**

5. Work out the `Occurrence` tab in a similar way. The choice here is `Implemented` or `Not implemented`.

**Operating effectiveness**

6. In `Operating effectiveness`, it is optional to add self-created procedures by clicking on the plus icon (<i class="fa-plus">:plus:</i>).

   > **PLEASE NOTE:** these procedures do not come as standard; you create them yourself and they are specific to your client.
7. Mark the operating effectiveness conclusion as `Effective`.
8. Fill in `Design`, `Occurrence` and `Operating effectiveness` completely.

   > As soon as `Design`, `Occurrence` and `Operating effectiveness` are all effective, `Relying` automatically turns green.
9. Navigate back to the `Entity insights` screen. You can see the application `Exact` with the IT General Control below it by clicking on the magnifying glass icon (<i class="fa-magnifying-glass">:magnifying-glass:</i>). If you have only worked out the design, it will say `design effective` here (because occurrence and operating effectiveness have not yet been performed).

#### Working out a second ITGC domain (example: continuity)

1. Do the same for the `Continuity` domain. Click through; under `Design`, you will get the work step `Design and occurrence of continuity`, with specific questions about continuity.
2. Within `Procedures`, you can see via `Understanding IT processes` which additional procedures have been added under your application. This is how you build the tree further.

### The IT environment and the information system

In addition to the applications, you work out a number of general work steps. Answers to conditional questions determine which follow-up activities Engyon shows — this way the work aligns with the actual IT organisation.

1. In the `IT environment` procedure, questions are asked about, among other things, the IT vision, IT organisation and the AI policy. Here you have two work steps: `Information technology in the information system` and `IT organisation`. Depending on the input with which you answer the activities, the activities change.
2. Click through to `Information technology in the information system`; there are two activities there.

   * If you answer the second question with `No`, you will get a follow-up question.

   * If you answer the second question with `Yes`, additional procedures will appear in the follow-up work step `IT organisation`. Standard questions about how the management rights are structured will appear there.

   > In that case, you do not work out all applications individually, but record a general description.

### Linking processes and applications

In Engyon, you create processes and applications separately and then link them together. Consistent linking keeps processes, applications and internal controls in the audit aligned.

Within the `Initial risk assessment` work step, relevant processes are created. Processes are created after the risks have been identified. As a result, a risk can be linked directly to a process.

Go to `Entity insights` in your navigation. Here you can see the links between the processes and applications that have been made. Open a process that has already been created (e.g., Purchasing). Within this detail screen, you link applications by clicking on the link icon (<i class="fa-link">:link:</i>).

> **PLEASE NOTE:** linking works both ways. If you create an internal control measure from a process, you must select an application. If you create one from an application, you must select a process. This way the mutual relationships remain consistent.

### Relying on application controls within the risk assessment

How can the accountant rely on application controls within substantive procedures? This depends on the chosen model at the organisation or audit level.

#### Audit Risk Model

1. When a user has created a risk within the audit, you can assign a level of risk.

   > **PLEASE NOTE:** if no internal control is linked to the risk, the risk defaults to `High` and you cannot edit this.
2. Click on the risk and then on <kbd>Manage internal control</kbd>. Select the application control you want to link to the risk (e.g., `Exact`).
3. If the conclusion on your application control is still `Not effective`, you still cannot set the internal control risk to `Low` or `Medium`. Work out `Design`, `Occurrence` and `Operating effectiveness` first; only then is the risk no longer required to be `High`.

#### Assurance model

1. When a user has created a risk within the audit, you can obtain assurance from system-based procedures when you have linked an internal control to your risk.

   > **PLEASE NOTE:** if no internal control is linked to the risk, the assurance bandwidth you can obtain from system-based procedures is between 0.00 - 0.00.
2. Click on the risk and then on <kbd>Manage internal control</kbd>. Select the application control you want to link to the risk (e.g., `Exact`).
3. If the conclusion on your application control is `Effective`, you can obtain assurance from system-based procedures between 0.5 - 1.5.

### Finding connections

1. Go to the `Risk assessment` screen in your navigation on the left.
2. Select a risk. Engyon now highlights the application control linked to it; this makes the common thread visible.