Guide to Using International Standards on Auditing in - IFAC

65
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Control activities are the policies and procedures that help ensure that management’s directives are
carried out. Examples include controls <strong>to</strong> ensure that goods are not shipped <strong>to</strong> a bad credit risk, or that
only authorized purchases are made. These controls address risks that, if not mitigated, would threaten the
achievement of the entity’s objectives.
Control activities (whether within information or manual systems) are designed <strong>to</strong> mitigate the risks involved
in everyday activities such as transaction processing (business processes such as sales, purchases, and payroll)
and safeguarding of assets.
Business processes are structured sets of activities designed <strong>to</strong> produce a specified output. Business process
controls can generally be classified as preventive, detective and corrective, or compensating or steering, as
outlined in the exhibit below.
Exhibit 5.6-1
Controls
Classification
Preventive
Controls
Detective Controls
Compensating
Controls
Steering Controls
(e.g., Policies)
Description
Avoid errors or irregularities.
Identify errors or irregularities after they have occurred so corrective action can be
taken.
Provide some assurance where resource limitations may preclude other more direct
controls.
<strong>Guide</strong> actions <strong>to</strong>wards the desired objectives.
The nature of business process controls will vary based on the risks involved and the specific application.
Typical controls at the business process level would include the matters set out below.
Exhibit 5.6-2
Controls Description Examples
Segregation
of Duties
Authorization
Controls
Account
Reconciliations
These controls can reduce the
opportunities for a person <strong>to</strong> be in a
position <strong>to</strong> both perpetrate and conceal
errors or fraud.
These controls define who has the
authority <strong>to</strong> approve various routine and
non-routine transactions and events.
This includes preparing and reviewing
account reconciliations on a timely basis
and taking any necessary corrective
actions.
The employee responsible for the accounts
receivable processing has no access <strong>to</strong> cash
receipts.
Assigning responsibility <strong>to</strong> authorize:
• Hiring of new employees;
• Making investments;
• Ordering goods and services; and
• Extending credit <strong>to</strong> a cus<strong>to</strong>mer.
Reconciliations of bank accounts, sales
transactions, intercompany balances,
suspense accounts, etc.