Guide to Using International Standards on Auditing in - IFAC

52
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Paragraph #
315.4(c)
Relevant Extracts from ISAs
Internal control—The process designed, implemented and maintained by those charged
with governance, management and other personnel <strong>to</strong> provide reasonable assurance about
the achievement of an entity’s objectives with regard <strong>to</strong> reliability of financial reporting,
effectiveness and efficiency of operations, and compliance with applicable laws and
regulations. The term “controls” refers <strong>to</strong> any aspects of one or more of the components of
internal control.
315.12 The audi<strong>to</strong>r shall obtain an understanding of internal control relevant <strong>to</strong> the audit. Although
most controls relevant <strong>to</strong> the audit are likely <strong>to</strong> relate <strong>to</strong> financial reporting, not all controls that
relate <strong>to</strong> financial reporting are relevant <strong>to</strong> the audit. It is a matter of the audi<strong>to</strong>r’s professional
judgment whether a control, individually or in combination with others, is relevant <strong>to</strong> the
audit. (Ref: Para. A42-A65)
315.13 When obtaining an understanding of controls that are relevant <strong>to</strong> the audit, the audi<strong>to</strong>r shall
evaluate the design of those controls and determine whether they have been implemented, by
performing procedures in addition <strong>to</strong> inquiry of the entity’s personnel. (Ref: Para. A66-A68)
5.1 Overview
Internal control is designed, implemented, and maintained by those charged with governance and
management of other personnel <strong>to</strong> address identified business and fraud risks that threaten the achievement
of stated objectives, such as the reliability of financial reporting.
Note: A control is always designed <strong>to</strong> respond (mitigate) <strong>to</strong> a possible risk. A control that does not address a
risk is obviously redundant.
The first step in evaluating control design is <strong>to</strong> identify the risks that require mitigation by control. The second
step is then <strong>to</strong> identify what controls are in place <strong>to</strong> address those risks.
5.2 Internal Control Objectives
Internal control is management’s response intended <strong>to</strong> mitigate an identified risk fac<strong>to</strong>r or achieve a control
objective. There is a direct relationship between an entity’s objectives and the internal control it implements
<strong>to</strong> ensure their achievement. Once objectives are set, it is possible <strong>to</strong> identify and assess potential events
(risks) that would prevent the achievement of the objectives. Based on this information, management can
develop appropriate responses, which will include the design of internal control.
Internal control objectives can be broadly grouped in<strong>to</strong> four categories:
• Strategic, high-level goals that support the mission of the entity;
• Financial reporting (internal control over financial reporting);
• Operations (operational controls); and
• Compliance with laws and regulations.
Internal control relevant <strong>to</strong> an audit primarily pertains <strong>to</strong> financial reporting. This addresses the entity’s
objective of preparing financial statements for external purposes.
Operational controls, such as production and staff scheduling, quality control, and employee compliance with
health and safety requirements, would not normally be relevant <strong>to</strong> the audit, except where: