Guide to Using International Standards on Auditing in - IFAC

58
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Control Element The Key Question Possible Controls
Participation by
Those Charged
With Governance
(TCWG)
(Other than Where
Management is
TCWG)
Management’s
Philosophy and
Operating Style
Organizational
Structure
Assignment of
Authority and
Responsibility
How effective is the
governance (if any)
being provided
over entity
operations?
What are
management's
attitudes and
actions <strong>to</strong>ward
financial reporting?
Has a relevant
organizational
structure been
established?
Have key areas
of authority and
responsibility been
appropriately
assigned?
• A majority of TCWG are independent of management.
• TCWG have the appropriate experience, stature, and
financial expertise.
• Significant issues and financial results are communicated
<strong>to</strong> TCWG in a timely manner.
• TCWG provide effective oversight over management’s
activities. This includes raising difficult questions and
pursuing answers.
• TCWG meet on a regular basis, and minutes of meetings
are circulated in a timely basis.
• Management demonstrates positive attitudes and actions
<strong>to</strong>ward:
– Sound internal control over financial reporting
(including management override and other fraud),
– Appropriate selection/application of accounting
policies,
– Information-processing controls, and
– The treatment of accounting personnel.
• Management has established procedures <strong>to</strong> prevent
unauthorized access <strong>to</strong> or destruction of assets,
documents, and records.
• Management analyzes business risks and takes
appropriate action.
• The organizational structure is appropriate <strong>to</strong> facilitate
achievement of entity objectives, operating functions,
and regula<strong>to</strong>ry requirements.
• Management clearly understands its responsibility
and authority for business activities, and possesses the
requisite experience and levels of knowledge <strong>to</strong> properly
execute its positions.
• The entity structure facilitates the flow of reliable and
timely information <strong>to</strong> the appropriate people for planning
and controlling activities.
• Incompatible duties are segregated <strong>to</strong> the extent
possible.
• There are policies and procedures for authorization and
approval of transactions.
• Appropriate lines of reporting and accountability exist
(appropriate <strong>to</strong> the entity’s size and the nature of its
activities).
• Job descriptions include control-related responsibilities.