Guide to Using International Standards on Auditing in - IFAC

64
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Communication
Communication is a key component of successful information systems. Consequently, if information is <strong>to</strong> be
used in decision-making and <strong>to</strong> facilitate the functioning of internal control, it needs <strong>to</strong> be communicated on
a timely basis (both internally and externally) <strong>to</strong> the appropriate people.
Effective internal communication helps the entity’s personnel clearly understand internal control objectives,
the business processes in use, and their individual roles and responsibilities. It also helps them understand
the extent <strong>to</strong> which their activities relate <strong>to</strong> the work of others, and the means of reporting exceptions <strong>to</strong> an
appropriate higher level within the entity.
The means of communication may be informal (verbal) or formal (i.e., documented in policy and financial
reporting manuals).
Internal communication between <strong>to</strong>p management and employees is often easier and less formal in smaller
companies, due <strong>to</strong> fewer levels and smaller numbers of personnel and the greater availability and presence of
senior management.
Effective external communication ensures that matters affecting the achievement of financial reporting
objectives are communicated with relevant outside parties such as key stakeholders, financial institutions,
regula<strong>to</strong>rs, and government agencies.
Lack of IT Systems Documentation
Smaller entities may have less sophisticated and less thoroughly documented information and
communication systems. If management does not have extensive descriptions of accounting procedures,
sophisticated accounting records, or written policies, the understanding required by the audi<strong>to</strong>r will be
obtained more by inquiry and observation than by review of documentation.
5.6 Control Activities
Paragraph #
Relevant Extracts from ISAs
315.20 The audi<strong>to</strong>r shall obtain an understanding of control activities relevant <strong>to</strong> the audit, being
those the audi<strong>to</strong>r judges it necessary <strong>to</strong> understand in order <strong>to</strong> assess the risks of material
misstatement at the assertion level and design further audit procedures responsive <strong>to</strong> assessed
risks. An audit does not require an understanding of all the control activities related <strong>to</strong> each
significant class of transactions, account balance, and disclosure in the financial statements or
<strong>to</strong> every assertion relevant <strong>to</strong> them. (Ref: Para. A88-A94)
315.21 In understanding the entity’s control activities, the audi<strong>to</strong>r shall obtain an understanding of
how the entity has responded <strong>to</strong> risks arising from IT. (Ref: Para. A95-A97)
Control
Activities