Guide to Using International Standards on Auditing in - IFAC

70
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
5.8 Moni<strong>to</strong>ring
Paragraph #
Relevant Extracts from ISAs
315.22 The audi<strong>to</strong>r shall obtain an understanding of the major activities that the entity uses <strong>to</strong>
moni<strong>to</strong>r internal control over financial reporting, including those related <strong>to</strong> those control
activities relevant <strong>to</strong> the audit, and how the entity initiates remedial actions <strong>to</strong> deficiencies in
its controls. (Ref: Para. A98-A100)
315.24 The audi<strong>to</strong>r shall obtain an understanding of the sources of the information used in the entity’s
moni<strong>to</strong>ring activities, and the basis upon which management considers the information <strong>to</strong> be
sufficiently reliable for the purpose. (Ref: Para. A104)
Moni<strong>to</strong>ring
Moni<strong>to</strong>ring assesses the effectiveness of the internal control’s performance over time. The objective is <strong>to</strong>
ensure that the controls are working properly and, if not, <strong>to</strong> take necessary corrective actions.
Moni<strong>to</strong>ring provides feedback <strong>to</strong> management on whether the internal control system they have designed <strong>to</strong>
mitigate risks is:
• Effective in addressing the stated control objectives;
• Properly implemented and unders<strong>to</strong>od by employees;
• Being used and complied with on a day-<strong>to</strong>-day basis; and
• In need of modification or improvement <strong>to</strong> reflect changes in conditions.
Management accomplishes the moni<strong>to</strong>ring of controls through ongoing activities, separate evaluations, or a
combination of these two.
Ongoing moni<strong>to</strong>ring activities in smaller entities are informal, and are usually built in<strong>to</strong> the normal recurring
activities of an entity. This includes regular management and supervisory activities and the review of
exception reports that may be produced by the information system. Where management is closely involved in
operations, they will often identify significant variances from expectations and inaccuracies in financial data,
and take corrective action <strong>to</strong> modify or improve the control.
Periodic moni<strong>to</strong>ring (separate evaluations of specific areas within the entity, such as those performed by
an internal audit function in a much larger company) is not common in smaller entities. However, periodic
evaluations of critical processes could be conducted by qualified employees not directly involved in those
processes, or by hiring an external and suitably qualified person.
Management’s moni<strong>to</strong>ring activities may also include the use of information received from external parties
that indicates problems or highlights areas in need of improvement. Examples of this could include:
• Complaints from cus<strong>to</strong>mers;
• Comments from governing bodies such as franchisors, financial institutions, and regula<strong>to</strong>rs; and