CAQ Issues Emerging Technologies, Risk, and the Auditor’s Focus: A Resource for Auditors, Audit Committees, and Management

June 2019

caq_emerging_technologies_risk_auditors_focus_2019-05.jpgDownload PDF Version

Technology will continue to disrupt business, and stakeholders need to respond with innovative ideas for success. The auditor has the responsibility to opine on management’s financial statements while the audit committee has the responsibility to oversee the financial reporting process. It is important that these stakeholders collaborate and share their unique perspectives in evaluating the impact of technology on financial reporting to identify and mitigate the risk of any unintended consequences on financial reporting that technology implementation may bring about. Mitigating these risks will require maintained professional skepticism by those involved; together with an increased reliance on risk assessment, processes and internal control over financial reporting (ICFR). The CAQ has released Emerging Technologies, Risk and the Auditor’s Focus: A Resource for Auditors, Audit Committees, and Management to highlight the financial reporting implications of the evolving use of technology together with the benefits, risks, and associated auditor considerations.


The CAQ published Emerging Technologies, Risk and the Auditor’s Focus tool to assist stakeholders – auditors, management, and audit committees - in understanding what key technology risks to look for, the impact of emerging technologies on business, and how auditors will likely evaluate whether management is properly assessing the impact of emerging technologies on ICFR. This tool builds on the previously released 2018 CAQ Emerging Technologies: An Oversight Tool for Audit Committees.

Emerging Technologies – Risk Assessment and the Audit

The CAQ has identified examples of technology risks for stakeholder review together with the following three recommended areas for auditors to focus on when performing its assessment of risks and controls and designing appropriate auditing procedures.



Technology Impact – Potential Areas of Auditor Focus

To be effective, the auditor must understand the business, the industry, and the operating environment of the company. The evolution of technology has brought about several new variables that need to be investigated and understood. Specifically, auditors will consider changes in the business and industry, including implementation of new technology - both directly and indirectly, and how those changes impact controls and oversight. The CAQ lays out three main areas where auditors may potentially focus:
How Technology Affects a Company's Business How Technology Affects ICFR How Technology Affects Audit Committee Oversight
•New activities or changes in processes due to technology
•Changes in the way the entity's systems are developed and maintained
•Impact of new technology on how the organization obtains, generates and uses information to support internal control
•Impact new technology has on identification and assessment of risks relevant to the achievement of control objectives
•Impact of new technology on ICFR
•Management's risk assessment process and the completeness of control activity considerations
•Consideration of indirect effects of new technology
•Impact of new technology on fraud risk assessment
•Level of oversight over the financial reporting process and ICFR
•Level of involvement of internal audit
•Communication protocols in place for the audit committee to obtain information

Key Technology Developments – The Basics and Auditor Implications

Finally, the CAQ outlines the basics of specific emerging technologies and the associated audit implications to each:
Emerging Technolog The Basics Auditor Implications
The internet of things (IoT) and peripheral systems The concept of connecting any device (or components of machines) to the internet, each other, other devices
  • Shift from reliance on manual controls to scoping in the evaluation of design and operating effectiveness of new automated systems and controls.
  • Impact that consumer facing tools (e.g. credit card payment via mobile device) can have on the flow and transactions and introduce new risks
  • Consideration of the volume of transactions and processes associated with all e-commerce streams
Al used in monitoring business operations Learning machines use advanced algorithms to predict activity and manage business processes (e.g. projecting inventory levels, managing cash flow)
  • Understand how the use of AI affects the flow of transactions including report generation or analytics
  • Consider whether AI is making decisions or being utilized by management as part of the decision-making process
  • Understand any shift in monitoring activity from management to AI (e.g. predictive analytics), where the reliance exists and what controls exist
  • Understand internal audit’s utilization of AI in oversight, and how current and new risks are being addressed
Smart contracts A computer code running on top of a blockchain containing a set of rules in which the parties to the contract agree to interact with each other
  • Identify where smart contracts are being used and determine if they could be a key ICFR control that should be tested
Al potential use in developing accounting estimates AI may be used to calculate estimates and may further incorporate data not previously used or identify correlations not previously known
  • Continue to assess traditional risks of completeness and accuracy of data as well as overall methodology, which may be the area most impacted in the shift to AI

While emerging technologies bring great opportunities, associated risks and potential unintended consequences need to be considered. Auditors and all stakeholders alike will need to ensure they maintain a questioning mind and healthy skepticism when evaluating these new risks. Continued collaboration between stakeholders increases the likelihood of a successful outcome.

Next Steps

We encourage audit committees, management, and our audit professionals to remain abreast of guidance and resources being issued relative to corporate governance and dialogue regularly about such matters throughout the audit process. Please stay tuned for additional thought leadership and educational opportunities from BDO’s Center for Corporate Governance and Financial Reporting.