IT environment and high-level scoping form for planned substantive audits

Entity name:
Date of financial statements:

When to use this form

This form is required for audit engagements planning to perform fully substantive audits.

Purpose
This form is used to document the IT applications and relevant additional IT environment components (database management software, operating
systems and network software) relevant to significant classes of transactions (SCOTs) and to determine the applicable IT processes.

Complete one column for each IT application relevant to one or more SCOTs. Add more columns if needed.

The process determinations made using this form support the information input into the “Identify IT processes and relate them to IT applications” screen
in Canvas Form 233 Understand the effect of the entity’s use of IT.

Guidance
IT applications, related IT environment components and other relevant information are discussed in IT 2 [Pre Dec 2022: IT 4.1]

Attach this document to the Milestone - IT Summary task in Scope and Strategy in EY Canvas. We sign off this form in EY Canvas to evidence the
preparation, review and approval of this form.

Form 231GL-B (14 June 2022)

 1 2 3
IT application name (if developed in house) or product
used
Database software used by the IT application
Operating system
Network software
IT application description
Is a service organization used as part of operating or
maintaining any the above IT environment components?

If yes, indicate the service organization name

If yes, explain service organization involvement

Is any part of the IT application vendor-supplied and If yes, the manage vendor- If yes, the manage vendor-
maintained through the issuance of updates by the supplied changes IT process supplied changes IT process
vendor? applies to this IT application. applies to this IT application.

If yes, does the entity do any programming to add on If yes, the manage entity- If yes, the manage entity-
to vendor-supplied programs, or to create or maintain programmed changes IT process programmed changes IT process
custom reports or interfaces? applies to this IT application. applies to this IT application.

Is any part of the IT application created and maintained

If yes, the manage entity- If yes, the manage entity-
by the entity (including its contractors) (e.g., additional
programmed changes IT process programmed changes IT process
functionality, reports, interfaces with other IT applies to this IT application. applies to this IT application.
applications)?
The manage security settings IT The manage security settings IT
process presumptively applies to process presumptively applies to
Is one or more of the IT environment components
Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes
secured by settings (including passwords)? is selected, add explanation at the is selected, add explanation at the
bottom of the form. bottom of the form.

The manage user access IT The manage user access IT

process presumptively applies to process presumptively applies to
Do users (including privileged users) have access to one
Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes
or more of the IT environment components? is selected, add explanation at the is selected, add explanation at the
bottom of the form. bottom of the form.

If yes, the job scheduling and If yes, the job scheduling and
Is the operation of programs in an IT application
monitoring IT process applies to monitoring IT process applies to
scheduled and monitored by the IT department? this IT application. this IT application.

2 of 9
Note: It is likely that the entity is using the same set of IT
processes for all the identified IT applications and IT
environment components. When inputting the IT processes
into the “Identify IT processes and relate them to IT
applications” screen in Canvas Form 233 Understand the
effect of the entity’s use of IT, assume that each IT process
(manage vendor-supplied changes, manage entity-
programmed changes, manage security settings, manage user
access, and job scheduling and monitoring) are common to all
IT applications to which they apply (i.e., input each process
only once and relate all appropriate IT applications to that IT
process) unless we have been told otherwise. When we
document the understanding of the IT processes we may find
our assumption of common processes is not correct and we
update EY Canvas and our procedures accordingly.

3 of 9
 3 4 5 6 7

If yes, the manage vendor- If yes, the manage vendor- If yes, the manage vendor- If yes, the manage vendor-
supplied changes IT process supplied changes IT process supplied changes IT process supplied changes IT process
applies to this IT application. applies to this IT application. applies to this IT application. applies to this IT application.

If yes, the manage entity- If yes, the manage entity- If yes, the manage entity- If yes, the manage entity-
programmed changes IT process programmed changes IT process programmed changes IT process programmed changes IT process
applies to this IT application. applies to this IT application. applies to this IT application. applies to this IT application.

If yes, the manage entity- If yes, the manage entity- If yes, the manage entity- If yes, the manage entity-
programmed changes IT process programmed changes IT process programmed changes IT process programmed changes IT process
applies to this IT application. applies to this IT application. applies to this IT application. applies to this IT application.

The manage security settings IT The manage security settings IT The manage security settings IT The manage security settings IT
process presumptively applies to process presumptively applies to process presumptively applies to process presumptively applies to
this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes
is selected, add explanation at is selected, add explanation at is selected, add explanation at is selected, add explanation at
the bottom of the form. the bottom of the form. the bottom of the form. the bottom of the form.

The manage user access IT The manage user access IT The manage user access IT The manage user access IT
process presumptively applies to process presumptively applies to process presumptively applies to process presumptively applies to
this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes
is selected, add explanation at is selected, add explanation at is selected, add explanation at is selected, add explanation at
the bottom of the form. the bottom of the form. the bottom of the form. the bottom of the form.

If yes, the job scheduling and If yes, the job scheduling and If yes, the job scheduling and If yes, the job scheduling and
monitoring IT process applies to monitoring IT process applies to monitoring IT process applies to monitoring IT process applies to
this IT application. this IT application. this IT application. this IT application.

4 of 9
5 of 9
 7 8 9 10 11

If yes, the manage vendor- If yes, the manage vendor- If yes, the manage vendor- If yes, the manage vendor-
supplied changes IT process supplied changes IT process supplied changes IT process supplied changes IT process
applies to this IT application. applies to this IT application. applies to this IT application. applies to this IT application.

If yes, the manage entity- If yes, the manage entity- If yes, the manage entity- If yes, the manage entity-
programmed changes IT process programmed changes IT process programmed changes IT process programmed changes IT process
applies to this IT application. applies to this IT application. applies to this IT application. applies to this IT application.

If yes, the manage entity- If yes, the manage entity- If yes, the manage entity- If yes, the manage entity-
programmed changes IT process programmed changes IT process programmed changes IT process programmed changes IT process
applies to this IT application. applies to this IT application. applies to this IT application. applies to this IT application.

The manage security settings IT The manage security settings IT The manage security settings IT The manage security settings IT
process presumptively applies to process presumptively applies to process presumptively applies to process presumptively applies to
this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes
is selected, add explanation at is selected, add explanation at is selected, add explanation at is selected, add explanation at
the bottom of the form. the bottom of the form. the bottom of the form. the bottom of the form.

The manage user access IT The manage user access IT The manage user access IT The manage user access IT
process presumptively applies to process presumptively applies to process presumptively applies to process presumptively applies to
this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no Yes
is selected, add explanation at is selected, add explanation at is selected, add explanation at is selected, add explanation at
the bottom of the form. the bottom of the form. the bottom of the form. the bottom of the form.

If yes, the job scheduling and If yes, the job scheduling and If yes, the job scheduling and If yes, the job scheduling and
monitoring IT process applies to monitoring IT process applies to monitoring IT process applies to monitoring IT process applies to
this IT application. this IT application. this IT application. this IT application.

6 of 9
7 of 9
 11 12

If yes, the manage vendor- If yes, the manage vendor-

supplied changes IT process supplied changes IT process
applies to this IT application. applies to this IT application.

If yes, the manage entity- If yes, the manage entity-

programmed changes IT process programmed changes IT process
applies to this IT application. applies to this IT application.

If yes, the manage entity- If yes, the manage entity-

programmed changes IT process programmed changes IT process
applies to this IT application. applies to this IT application.

The manage security settings IT The manage security settings IT

process presumptively applies to process presumptively applies to
this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no
is selected, add explanation at is selected, add explanation at
the bottom of the form. the bottom of the form.

The manage user access IT The manage user access IT

process presumptively applies to process presumptively applies to
this IT application (i.e., yes). If no Yes this IT application (i.e., yes). If no
is selected, add explanation at is selected, add explanation at
the bottom of the form. the bottom of the form.

If yes, the job scheduling and If yes, the job scheduling and
monitoring IT process applies to monitoring IT process applies to
this IT application. this IT application.

8 of 9
9 of 9