IT evidence for financial audits: KSB 315

IT systems as sources of financial data

KSB 315 (Revised 2022) addresses identifying and assessing risks of material misstatement in financial statements. PIBR states that it applies to periods beginning on or after 1 January 2023, with early application permitted. IT systems and controls assessment supplies audit evidence; it does not replace the auditor’s judgement or audit opinion.

How IT supports the financial audit

IT explains whether financial data can be trusted. The auditor needs to understand source systems, access rights, changes, backups, logs, integrations and manual workarounds. Under KSB 315, weak IT controls can increase audit procedures, so evidence must be prepared before questions become urgent.

Why IT is part of the financial audit

KSB 315 is a Polish auditing standard for identifying and assessing risks of material misstatement. The statutory auditor determines which applications, IT risks and related controls matter to the engagement. It does not require an identical audit of every IT tool.

• Data sources, flows between systems, permissions and manual process workarounds are checked.
• Change controls, backups, administrative logs, role separation and reconciliation history are important.
• Weak IT controls may require different or additional procedures. Insufficient appropriate evidence may affect the audit opinion; the statutory auditor makes that assessment.

New challenges in financial audits

New financial audit challenges result from automation, cloud work, e-commerce integration, distributed spreadsheets, remote access and external IT providers. At the same time, well-organised systems provide the auditor with better evidence: history of changes, acceptance traces, logs, backup reports and consistent data sources.

What most often in­ter­ests the auditor

The auditor needs to know where financial data comes from, who can change it, how relevant controls operate and what evidence demonstrates their operation.

Financial audit evidence package

Evidence packages should identify each control’s period, source, scope, owner and known gaps. This supports evaluation; it does not guarantee shorter fieldwork or a particular audit opinion.

• Map of source systems: accounting, ERP, sales, warehouse, human resources, banking, e-commerce and integrations.
• Roles and permissions matrix with business owner, review date and list of privileged accounts.
• Register of changes in the configuration of important applications with the approval of the process owner.
• Evidence of backup and recovery of data relevant to reporting, including RTO, RPO and test result.
• Description of manual workarounds: exports to sheets, imports, corrections, reconciliations and version control.
• Remediation plan for identified gaps, with owners, dates and interim safeguards.

Decisions that should not be postponed until the end of the audit

The most difficult audit questions arise when it is not known who is responsible for data, permissions or a change in the system. It is worth resolving them before handing over the evidence package.

• Data owner: who confirms that the system is the source of data for a specific financial process.
• Access owner: who accepts roles, privileged accounts, exceptions and separation of duties.
• Change owner: who approves a configuration, integration, patch or manual process workaround.
• Backup owner: who confirms that the restoration includes data needed for reporting.
• Plan owner: who finalises the recommendations after the audit and reports progress to the board.

When is it worth engaging an external IT partner?

An IT partner helps finance and the auditor agree technical terminology, scope and evidence sources. Process owners still confirm data and decisions; technical support does not remove their role in the audit.

How do we start?

We start by briefly establishing the scope: what systems generate financial data, who owns the process, what questions the auditor asked and what evidence already exists. Then we prepare a list of deficiencies, priorities, owners and a plan to collect or improve materials.

IT risk map under KSB 315

A concise risk map should link each financial process to its application, owner, control and supporting evidence. This makes discussions with the auditor evidence-based: they rely on verifiable material rather than assertions.

• No separation of roles in accounting, sales or warehouse.
• Configuration changes without the approval of the process owner.
• Spreadsheet exports without version control or approval by the data owner.
• Former employee accounts or shared administrative accounts.
• Backup without recovery test of data critical for reporting.

How to prepare the environment before an audit

Preserve existing evidence for the period under audit. Document gaps, implementation dates of new controls and remediation. Do not present newly created documentation as proof that controls operated historically. Address urgent risks promptly.

• Identify the applications and databases that generate important financial data.
• Prepare a list of administrators, business owners, and privileged accounts.
• Export access reviews, change logs, backup schedules and recovery test results.
• Describe manual adjustments, integrations, and where data moves between systems.
• Determine the owner of each risk and the deadline for closing the recommendation.

Where ISO 27001 and TrustGuard help

ISMS and TrustGuard documentation may provide supporting material when its scope and period match the engagement. Certification does not replace evidence of specific controls operating or the statutory auditor’s judgement.

What does Virtline support look like?

We act as a technical partner for the auditor, management board and financial department. We translate IT risks into the language of control, collect evidence and indicate actions that actually reduce the risk of data errors. We rely on experience from audits, maintenance of IT environments and our own information security management system certified by TÜV NORD to PN-EN ISO/IEC 27001:2023-08. Virtline support helps shorten the path from auditor questions to verifiable answers.

• We document controls, responsibilities, exceptions and evidence so that the auditor, finance team and IT work from the same facts.
• Project experience helps identify which gaps are critical to your financial data and which can be addressed in a phased action plan.
• Audit and penetration-testing experience provides a practical look at systems, access, backup and technical risks.
• The TrustGuard programme supports the conversation about trust and orderly control in organisations serving demanding customers.
• After the audit, we can maintain controls in the IT outsourcing model, instead of leaving the client with a one-time list of recommendations.

What the client gets after work

We provide a map of systems, risks, controls and evidence gaps with action owners. Urgent access, backup and response gaps need prompt action. Reviews after 30/60/90 days track progress; they do not defer baseline protection.

• List of systems relevant to financial data, along with their owners and dependencies.
• Table of ITGC risks and application controls related to accounting processes.
• List of missing or weak evidence: logs, approvals, backup tests, changes, access reviews.
• Priority recommendations distinguishing between quick actions, process changes and project work.
• Materials for the auditor: technical answers, scope of evidence and decision owners.

When is it worth starting?

Preferably before the audit fieldwork starts or before a new ERP, accounting system, data warehouse or e-commerce integration goes live. You can then design controls before the audit reveals missing evidence.

• The company changes its financial and accounting system or integrates several data sources.
• The auditor asks about ITGC, application controls, logs or permissions.
• Financial data is prepared in multiple sheets outside the source system.
• There are no backup tests or access review history.
• Customers ask about ISO 27001, TrustGuard or security maturity.

Related services

If a financial audit reveals technical gaps, it is worth treating them as a plan to improve data security and reliability, rather than a one-off response to the auditor.

Prepare your IT for the financial audit

Define the technical support scope and available audit evidence.

Sources and further reading