Guide to Using International Standards on Auditing in - IFAC

66
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Controls Description Examples
IT Application
Controls
Actual Results
Reviews
Physical
Controls
These controls are programmed in<strong>to</strong> IT
applications such as sales or purchases.
They include fully au<strong>to</strong>mated and partially
au<strong>to</strong>mated controls.
These controls involve the regular review
and analyses of actual results versus
budgets, forecasts, and prior-period
performance. It also involves relating
different sets of data (operating or financial)
<strong>to</strong> one another and comparing internal
data with external sources of information.
Unexpected variations would be
investigated and corrective actions taken.
These controls relate <strong>to</strong> the physical
security of assets and permitted access
<strong>to</strong> entity premises, accounting records,
computer programs, and data files.
Checking the arithmetical accuracy of
records, pricing of invoices, edit checks of
input data, numerical sequence checks,
and production of exception reports for
manager review.
Analysis of operating results, comparing
actual results <strong>to</strong> budget, and investigating
variances.
Such controls consist of asset security (door
locks and restricted access <strong>to</strong> inven<strong>to</strong>ry/
records) and comparing the results of
periodic cash, security, and inven<strong>to</strong>ry
counts with accounting records.
Smaller Entities
Control activities are designed <strong>to</strong> directly prevent a material misstatement from occurring or detecting and
then correcting a misstatement after it has occurred. In smaller entities, the concepts underlying control
activities are likely <strong>to</strong> be similar <strong>to</strong> larger entities, but their relevance <strong>to</strong> the audi<strong>to</strong>r may vary considerably.
Consider the following.
Exhibit 5.6-3
Control Activities
in Smaller Entities
Informal
and Limited
documentation
Limited Scope
Comments
Many controls may operate informally and may not be well documented. For
example, granting credit <strong>to</strong> a cus<strong>to</strong>mer may be more reliant on the judgment and
knowledge of the manager than on a pre-established credit limit.
Control activities (<strong>to</strong> the extent they exist) are likely <strong>to</strong> relate <strong>to</strong> the main transaction
cycles such as revenues, purchases, and employment expenses.