Guide to Using International Standards on Auditing in - IFAC

56
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Key Elements
<strong>to</strong> Address
Management’s
Philosophy and
Operating Style
Organizational
Structure
Assignment of
Authority and
Responsibility
Human Resources
Policies and
Practices
Description
Management’s approach <strong>to</strong> taking and managing business risks, and management’s
attitudes and actions <strong>to</strong>ward financial reporting, information processing, accounting
functions, and personnel.
The framework within which an entity’s activities for achieving its objectives are
planned, executed, controlled, and reviewed.
How authority and responsibility for operating activities are assigned, and how
reporting relationships and authorization hierarchies are established.
Recruitment, orientation, training, evaluating, counselling, promoting, compensating,
and remedial actions.
The controls outlined above are pervasive <strong>to</strong> the entire entity and are often more subjective <strong>to</strong> evaluate than
the traditional control activities (such as segregation of duties). Therefore, the audi<strong>to</strong>r will exercise professional
judgment in this evaluation.
Control-environment strengths can compensate or even replace weak transactional controls in some
situations. However, control-environment weaknesses can undermine and even negate good design in other
components of internal control. For example, if a culture of honesty and ethical behavior did not exist, the
audi<strong>to</strong>r would have <strong>to</strong> consider carefully what types of (additional) audit procedures would be effective in
finding material misstatements in the financial statements. In some cases, the audi<strong>to</strong>r may conclude that
internal control has broken down <strong>to</strong> such an extent that the only option is <strong>to</strong> withdraw from the engagement.
The Control Environment in Smaller Entities
The control environment within small entities will differ from larger entities, but is just as important. This
is particularly true when the entity does not have the staff or resources <strong>to</strong> implement traditional control
activities such as segregation of duties.
In smaller entities, the active involvement of a competent owner-manager (a control-environment strength)
may well reduce the need for other control activities such as segregation of duties. Consequently, control
environment strengths can serve <strong>to</strong> indirectly prevent or detect and correct certain types of misstatement.
For example, when the owner-manager reviews and approves individual transactions before they are
completed, it may serve <strong>to</strong> prevent or detect and correct certain specific errors or fraud. However, this control
environment strength would not mitigate other risks such as management override of controls.
In smaller entities, there will typically be less documentation available <strong>to</strong> support control environment
controls. Consequently, the attitudes, awareness, and actions of management (such as owner-managers) will
often form the basis for evaluating control design and implementation. For example, larger entities are likely
<strong>to</strong> provide staff with a code of conduct that outlines acceptable behaviors and consequences for violating
codes or rules. Smaller entities may communicate similar values and acceptable behaviors through oral
communications and by management example.
Where there is no supporting documentation for a particular control, the audi<strong>to</strong>r would prepare a
memorandum for the file. For example, in addressing whether there is communication and enforcement of
integrity and ethical values, the audi<strong>to</strong>r could: