Guide to Using International Standards on Auditing in - IFAC

53
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
• The information produced is used <strong>to</strong> develop an analytical procedure; or
• The information is required for disclosure in the financial statements.
For example, if production statistics were used as a basis for an analytical procedure, the controls <strong>to</strong> ensure
the accuracy of such data would be relevant. If non-compliance with certain laws and regulations has a
direct and material effect on the financial statements, the controls for detecting and reporting on such noncompliance
would be relevant.
Internal Control Components
The term “internal control” as used in ISA 315 is broader than just control activities such as segregation of
duties, authorizations and account reconciliations, etc.
Internal control encompasses five key components:
• The control environment;
• The entity’s risk assessment process;
• The information system, including the related business processes, relevant <strong>to</strong> financial reporting and
communication;
• Control activities relevant <strong>to</strong> the audit; and
• Moni<strong>to</strong>ring of internal control.
These components as they relate <strong>to</strong> the entity’s financial reporting objectives are illustrated below.
The Five Components of Internal Control
Exhibit 5.2-1
Financial
Reporting
Objectives
Control
Environment
Moni<strong>to</strong>ring
Risk
Assessment
Control
Activities
Information
System
The division of internal control in<strong>to</strong> these five components provides a useful framework for audi<strong>to</strong>rs in
understanding the different aspects of an entity’s internal control system. However, it should be noted that:
• The way in which the internal control system is designed and implemented will vary based on the
entity’s size and complexity. Smaller entities often use less formal means and simpler processes and
procedures <strong>to</strong> achieve their objectives. The five components of internal control may not be so clearly
distinguished; however, their underlying purposes are equally valid. For example, an owner-manager