Guide to Using International Standards on Auditing in - IFAC

57
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
• Identify the entity’s values, acceptable behaviors, and enforcement actions through discussions with
management. The audi<strong>to</strong>r would then assess whether they are sufficient <strong>to</strong> address the control design.
• Ask one or two employees what they believe are the entity’s values, acceptable behaviors, and
enforcement actions. These interviews would address whether management’s values and acceptable
behaviors have been communicated and enforced. This would address control implementation.
CONSIDER POINT
Small entities are often reluctant <strong>to</strong> document internal controls which operate informally. However,
there can often be benefits <strong>to</strong> management in taking the time <strong>to</strong> document some of the more important
policies and procedures. Such policies and procedures could be provided <strong>to</strong> staff joining the
entity, and audit time may be saved versus having <strong>to</strong> make inquiries each period. In the example cited
above, even the smallest entity could prepare a simple statement of values and acceptable behaviors
that could be provided <strong>to</strong> employees and then referred <strong>to</strong> when an issue arises.
In smaller entities, some of the key areas <strong>to</strong> address in assessing the control environment are outlined in the
exhibit below.
Exhibit 5.3-3
Control Element The Key Question Possible Controls
Communication
and Enforcement
of Integrity and
Ethical Values
Commitment <strong>to</strong>
Competence
What management
actions serve
<strong>to</strong> eliminate or
mitigate incentives
or temptations
that might
prompt personnel
<strong>to</strong> engage in
dishonest, illegal,
or unethical acts?
Do personnel have
the knowledge and
skills necessary <strong>to</strong>
accomplish their
tasks?
• Management continually demonstrates, through words
and actions, a commitment <strong>to</strong> high ethical standards.
• Management removes or reduces incentives or
temptations that might cause personnel <strong>to</strong> engage in
dishonest or unethical acts.
• A code of conduct or equivalent exists that sets out
expected standards of ethical and moral behavior.
• Employees clearly understand what behavior is
acceptable and unacceptable, and know what <strong>to</strong> do when
they encounter improper behavior.
• Enforcement actions are taken when required.
• Management takes the necessary steps <strong>to</strong> ensure that
personnel have the requisite knowledge and skills
required for their jobs.
• Job descriptions exist and are effectively used.
• Management provides personnel with access <strong>to</strong> training
programs on relevant <strong>to</strong>pics.
• Initial and ongoing matching of staff skills <strong>to</strong> their job
descriptions.