Guide to Using International Standards on Auditing in - IFAC

63
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
In larger companies, information systems can be complex, au<strong>to</strong>mated, and highly integrated. Smaller
companies will often rely on manual or stand-alone information technology applications.
CONSIDER POINT
Many mainstream accounting software packages (even smaller ones) come with a variety of built-in
application controls that could be used <strong>to</strong> improve control over financial reporting. These controls
include au<strong>to</strong>mated reconciliations, reporting of exceptions for management review, and ensuring
general consistency over financial reporting.
In obtaining an understanding of the information system (including business processes), the audi<strong>to</strong>r would
address (in addition <strong>to</strong> the exhibit above) the matters outlined below.
Exhibit 5.5-3
Identify
Sources of
Information Used
How Information
Is Captured and
Processed
How the
Information
Produced Is Used
Address
What classes of transactions are significant <strong>to</strong> the financial statements?
How do transactions originate within the entity’s business processes?
What accounting records (electronic or manual) exist?
How does the system capture events and conditions (other than classes of
transactions) that are significant <strong>to</strong> the financial statements?
What are the financial reporting processes used <strong>to</strong>:
• Initiate, record, process, and report transactions and non-standard transactions
(such as related-party transactions, etc.); and
• Prepare the financial statements, including significant accounting estimates and
disclosures?
What procedures address:
• Risks of material misstatement associated with inappropriate override of
controls, including use of standard and non-standard journal entries;
• Override or suspension of au<strong>to</strong>mated controls; and
• Identification of exceptions and reporting the actions that have been taken <strong>to</strong>
remedy these?
How does the entity communicate financial reporting roles, responsibilities, and
significant matters relating <strong>to</strong> financial reporting?
What reports are regularly produced by the information system, and how are they
used <strong>to</strong> manage the entity?
What information is provided by management <strong>to</strong> those charged with governance (if
different from management) and <strong>to</strong> external parties such as regula<strong>to</strong>ry authorities?