Back to all posts

Case Study

Technical FAQs

As part of our file reviews we normally raise question on how the audit team documented their understanding of the IT environment and IT controls. We have developed a Case Study: AM-TM-IM Ltd. – Electrical Goods Wholesaler to assist audit engagement team with this. The case study will be published in 2 articles. The first article focuses on Key Risks Specific to ITGCs, potential walkthrough questions and a Sample Control Matrix.

 

Case Study: AM-TM-IM Ltd. – Electrical Goods Wholesaler

Business Overview

AM-TM-IM Ltd. is a UK-based wholesaler specializing in electrical components, appliances, and industrial-grade equipment. They source products from over 500 suppliers across Europe and Asia. Their Supplier Management Database (SMD) is central to operations—it tracks supplier credentials, product specifications, pricing agreements, delivery schedules, warranty terms, and compliance certifications (e.g., CE marking, RoHS).

 

Audit Focus: ITGCs Over the Supplier Database

Key Risks Specific to Electrical Goods:

  • Incorrect supplier data could lead to non-compliant products being sold (e.g., missing safety certifications)
  • Unauthorized pricing changes could distort margins and financial reporting
  • Loss of supplier data could disrupt procurement and warranty claims

 

Walkthrough Questions for AM-TM-IM

Access Controls

  • Who approves access to the SMD, especially for procurement and compliance teams?
  • Are there separate roles for viewing vs. editing supplier data?
  • How is access revoked when staff leave or change roles?
  • Do all user accounts have unique log in and password?
  • Are there any generic user accounts?
  • What are the password restrictions (minimum length, complexity, password history etc)
  • Is there audit logging for changes to pricing and certification fields?
  • Are system administration users restricted to few key individuals and segregated from the business operation staff?
  • Are there any individuals with privileged access? If so, what are the changes they can make?
  • In addition, are there any logs for all the changes effected by the privileged users?
  • Are logs retained for a sufficient period?
  • Are logs protected from tampering?
  • Are alerts triggered for unauthorized access or unusual activity?

Change Management

  • How are updates to supplier profiles (e.g., new certifications, pricing changes) approved?
  • Is there a formal workflow for adding new suppliers or modifying existing ones?
  • Is there a documented matrix showing who can approve what types of changes?
  • Are program changes authorised and monitored?
  • Are changes tested before being pushed to the live database?

Backup & Recovery

  • How frequently is the SMD backed up, and where are backups stored?
  • Has AM-TM-IM tested restoring supplier data after a simulated outage?
  • Are backups encrypted and protected from unauthorized access?

IT Operations

  • Are logs maintained for changes to supplier pricing and compliance fields?
  • Who reviews these logs, and how often?
  • Is there a documented incident response plan for database breaches or corruption?
  • Are post- incident reviews conducted and documented?

GDPR

  • Is the entity aware of the GDPRE regulation and understand it applies to them?
  • Does the entity have suitable controls to protect personal data from unauthorised access?

 

Sample Control Matrix for AM-TM-IM Ltd.

Control Area Control Description Design Assessment Implementation Evidence Conclusion
Access Control Role-based access to SMD with monthly reviews Adequate Access logs, HR offboarding checklist Implemented
Change Management Supplier updates require dual approval and testing Adequate Change request forms, test logs Implemented
Backup & Recovery Daily encrypted backups stored offsite and tested quarterly Adequate Backup logs, restoration test reports Implemented
Audit Logging Logs maintained for pricing and certification changes Adequate Monthly log review reports signed by IT manager Implemented

 

Auditor’s Next Steps

  • Document walkthroughs and control matrix in AM-TM-IM’s audit workpapers
  • Use D&I assessment to inform risk of material misstatement
  • Tailor substantive procedures (e.g., supplier confirmation, pricing validation) based on control reliance