Guide to Using International Standards on Auditing in - IFAC

47
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
4.6 Control Activities
Control activities are designed <strong>to</strong> ensure compliance with the firm’s established policies and procedures.
One possible way <strong>to</strong> design, implement, and moni<strong>to</strong>r quality control is <strong>to</strong> follow the PDCA (plan-do-check-act) process.
Each of the elements is described below.
Exhibit 4.6-1
Step
PLAN
DO
CHECK
ACT
Description
Establish the objectives and quality control processes necessary <strong>to</strong> deliver the
required outputs.
Implement the new processes, often on a small scale if possible.
Measure the new processes, and compare the results against the expected results <strong>to</strong>
ascertain any differences.
Analyze the differences <strong>to</strong> determine their cause. Each will be part of either one
or more of the P-D-C-A steps. Determine where <strong>to</strong> apply changes that include
improvement.
For example, a firm objective may be not <strong>to</strong> release the audit report until all queries and outstanding items
have been cleared. The required policy is that the final engagement report may not be released, filed, or
otherwise distributed until certain specified approvals have been obtained. Implementation of the policy
could be controlled through a final release process wherein a person verifies that all approvals have in fact
been obtained and documented. The effectiveness of the policy could be checked by periodic inspections of
the approval sign-offs. If deviations are identified, the reasons would be investigated, and appropriate action
such as discipline, training, or changes in the policy would be considered.
Control activities <strong>to</strong> address all policies and procedures would not be possible or cost-effective. Firms should
use professional judgment and their assessment of risk <strong>to</strong> determine what controls need <strong>to</strong> be implemented.
Control activities could be considered for:
• All the policies and procedures documented in the firm’s quality control manual;
• Office workflow policies;
• Operational policies and procedures; and
• Other personnel-related policies and procedures.
The scope for control-activity design would address all the quality control, ethical, and independence
requirements and the firm’s compliance with ISAs relevant <strong>to</strong> the audit.