Guide to Using International Standards on Auditing in - IFAC

67
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Control Activities
in Smaller Entities
Risks May be
Mitigated by
the Control
Environment
(See Volume 1,
Chapter 5.3)
Comments
Certain types of control activities may not be relevant because of controls applied by
senior management. For example, management's approval of significant transactions
can provide strong control over important account balances and transactions,
lessening or removing the need for more detailed control activities. Some
transactional misstatements (usually addressed by control activities in larger entities)
could be mitigated by:
• A corporate culture that emphasizes the importance of control;
• Employing highly competent staff;
• Moni<strong>to</strong>ring revenues and expenditures against an established budget;
• Requiring senior management’s approval of all major transactions;
• Moni<strong>to</strong>ring of key performance indica<strong>to</strong>rs; and
• Assigning responsibilities among staff so as <strong>to</strong> maximize the segregation of
duties.
Control activities, relevant <strong>to</strong> the audit, would potentially mitigate risks such as:
• Significant risks
Identified and assessed risks of material misstatement that, in the audi<strong>to</strong>r’s judgment, require special
audit consideration. (Refer <strong>to</strong> Volume 2, Chapter 10.)
• Risks that cannot easily be addressed by substantive procedures
These are identified and assessed risks of material misstatement for which substantive procedures alone
would not provide sufficient appropriate audit evidence.
• Other risks of material misstatement
The audi<strong>to</strong>r’s judgment about whether a control activity is relevant <strong>to</strong> the audit is influenced by:
• Knowledge about the presence/absence of control activities identified in other components of internal
control. If a particular risk has already been adequately addressed (such as by the control environment,
information system, etc.), there is no need <strong>to</strong> identify any additional controls that may exist.
• The existence of multiple control activities that achieve the same objective. It is unnecessary <strong>to</strong> obtain
an understanding of each of the control activities related <strong>to</strong> such an objective.
• Increased audit efficiency that will be gained from testing the operating effectiveness of certain key
controls. This could occur when:
– Obtaining audit evidence through a test of the operating effectiveness of controls may be more
cost efficient than performing substantive procedures. Tests of controls typically result in smaller
sample sizes than substantive tests. If the controls are au<strong>to</strong>mated, a sample size of just one item
(assuming good general IT controls) may be all that is required. In addition, if the control system
and personnel involved have not changed from previous years, it may be possible (under certain
conditions) <strong>to</strong> limit the test of operating effectiveness of controls <strong>to</strong> once every three years. (See
Volume 2, Chapter 17.)
– Substantive procedures alone would not provide sufficient appropriate audit evidence at the
assertion level. For example, the completeness assertion for sales revenue can be difficult (and
sometimes impossible) <strong>to</strong> address by substantive procedures alone. In these situations, it would
be worthwhile <strong>to</strong> identify any internal controls that address the risk and assertion involved. If the