Guide to Using International Standards on Auditing in - IFAC

130
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
In other cases, the link between pervasive and specific controls may be more direct. For example, some moni<strong>to</strong>ring
controls may identify control breakdowns in specific (business process) controls. Testing these moni<strong>to</strong>ring controls
for effectiveness might reduce (but not eliminate) the need for testing more specific controls.
Tests of pervasive controls (often referred <strong>to</strong> as entity-level and general IT controls) tend <strong>to</strong> be more subjective
(such as evaluating the commitment <strong>to</strong> integrity or competence), and therefore tend <strong>to</strong> be more difficult <strong>to</strong>
document than specific internal control at the business process level (such as checking <strong>to</strong> see if a payment
was authorized). As a result, the testing of entity-level and general IT controls is often documented with
memoranda <strong>to</strong> the file explaining the approach taken and the action steps (e.g., staff interviews, assessments,
review of employee files, etc.), along with supporting evidence.
This approach is illustrated in the following example.
Exhibit 10.5-2
Testing Pervasive (entity-level) Controls
Control Component = Control Environment
Risk Addressed
Controls
Identified
Control Design
Control
Implementation
Test of Controls
Effectiveness
Documentation
No emphasis is placed on need for integrity and ethical values.
Management requires all new employees <strong>to</strong> sign a form stating their agreement
with the firm’s fundamental values and understanding of the consequences for noncompliance.
Read the form <strong>to</strong> be signed by employees and ensure it does indeed address integrity
and ethical values.
Review one employee file <strong>to</strong> ensure there is a signed form, and consider what
evidence exists (such as discipline) that employees actually practice the values. This
could be based on a short interview with an employee.
Select a sample of employee files and ensure there are agreement forms on file and
they are signed by the employee. This would be supplemented by asking a sample of
employees some questions about the stated entity policies.
Prepare a memo that provides details of the employee files selected, and notes
from interviews (including the name of the person and the date) along with the
conclusions reached.
Some key fac<strong>to</strong>rs for the audi<strong>to</strong>r <strong>to</strong> consider when designing a test of controls are listed below.
Exhibit 10.5-3
Address
What Risk
of Material
Misstatement and
Assertion Is Being
Addressed?
Description
Identify the risk of material misstatement and the related assertion that would be
addressed by performing tests of control. Then consider whether audit evidence
about the relevant assertion can be best obtained by a performing tests of controls
or through substantive procedures.