Source
KSB 315 (2022) — PIBR
The Polish Chamber of Statutory Auditors publishes the standard and implementation materials on identifying and assessing risks of material misstatement.
Open source
IT audit and controls
IT audit for KSB 315
We assess IT systems and controls relevant to the financial statement audit. For an engagement by an auditor or audit firm we agree the role of the auditor’s expert. For an engagement by the audited entity, the report is its material for the auditor. The statutory auditor decides how to use the findings.
Trusted by
Companies and institutions that need stable IT.
Sources and further reading
IT support for financial-statement audits
Poland’s KSB 315 standard concerns identifying and assessing risks of material misstatement in financial statements. Our work focuses on IT systems and controls relevant to that assessment. We work with statutory audit firms in Poland. We trace data through ERP and accounting systems, integrations and reports. We review general IT controls (ITGC), including access and privileged accounts, administration, changes and logs, alongside application controls such as data validation, transaction authorisation and segregation of duties. Backups, recovery, monitoring, incidents and continuity of financial processes are also considered.
Related services for firms and audited entities
Additional work is agreed separately. Shared material may support other reviews, but KSB 315, TrustGuard and NIS2, DORA or ISO 27001 assessments serve different purposes.
For statutory auditors
Wider support for audit firms, including IT services, training and handling client documentation. We can also agree support for AI-based automation.TrustGuard
Virtline’s programme for audit-firm security. It does not replace assessment of the audited entity’s IT under KSB 315.NIS2 audit
A separate assessment of cybersecurity requirements. Its scope does not follow automatically from a financial-statement audit.Backup and recovery
Backup and recovery planning and restore tests. Remedial work is kept separate from audits requiring independence.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity.
View Virtline’s certificateHow the KSB 315 audit works
The standard scope covers ITGC and application controls. S/M/L/XL variants differ in environment size, not audit scope. Extensions are discussed separately in a consultation.
01
Engagement and roles
We agree the entity, audit period, deadline and commissioning party. Work for the auditor is distinguished from material prepared for the audited entity. The author’s role and rules for delivery and use are agreed before work starts. The form requests a quotation.
02
Scope and independence
We agree systems, processes, controls and required material. We assign appropriate team skills and assess independence and potential conflicts of interest.
03
Interviews and checks
We speak with finance, IT and system owners, comparing procedures with configurations and records. We assess control design and implementation; the scope of operating-effectiveness tests is agreed with the statutory auditor.
04
Report and discussion
We deliver findings, the control matrix, evidence gaps and recommendations. We explain results and limitations so the statutory auditor can assess their usefulness for the audit.
Practical scope
What the statutory auditor receives
The report records work performed and its limitations. Audit-file material distinguishes findings relevant to financial reporting from other technical recommendations.
Financial processes, applications, data flows, integrations and reports with responsible contacts. We explain the possible impact of IT findings on financial data and continuity.
Control description, procedure or test performed, material used, result and limitations. We identify what could not be confirmed.
Gaps in logs, access reviews, change approvals, configurations and restore tests. We record what needs to be supplied and by whom.
Priorities, proposed owners, dates and review criteria for agreement with the entity and statutory auditor. We discuss technical conclusions with the auditor and management.
Roles in the audit
Virtline provides technical findings, not an audit opinion. The statutory auditor remains responsible for the opinion and assesses the material’s suitability. Before every engagement we assess conflicts, including prior design, implementation or repair of the systems and controls during the period under examination. Advice to the entity is separated from an independent assessment for the auditor. The passage of one year alone does not establish independence. A report does not guarantee an audit or oversight outcome.
Questions about KSB 315 support
Which systems can be included?
+
ERP and accounting systems, their databases, integrations and reports. Active Directory, Microsoft 365, VPN, file servers and backup may also be included where relevant to the processes under audit. We do not assume every system in the company needs reviewing.
Can the audit be performed remotely?
+
We normally work remotely. Isolated systems or the entity’s policies may require an on-site visit. We agree access to material, team interviews and verification methods. A questionnaire alone does not replace checking configurations and records.
What determines the cost and timing?
+
The standard form quotation depends on server count: S — 1–3, M — 4–6, L — 7–50, XL — over 50. Every variant has the same ITGC and application-control audit scope; only environment size differs. Extensions, including additional control operating-effectiveness tests, are agreed separately in a consultation. Timing depends on the availability of material and staff. The offer and contract are in Polish; the report can be in Polish or English, with no extra charge for choosing either language.
How do you support PANA or client queries?
+
We help the statutory auditor explain technical findings, relate them to the audit and identify missing material. Explanations cover the work performed, controls and their limitations. We do not replace the responses or professional judgement of the person responsible for the audit.
Define your KSB 315 support needs
Tell us the entity and audit period, financial processes, systems, server and site counts and reporting deadline. Provide the statutory auditor’s contact and known documentation gaps. Do not send passwords or audit files in the first message.
Define your KSB 315 audit scope