Guide to Using International Standards on Auditing in - IFAC

71
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
• Communications relating <strong>to</strong> internal control from external audi<strong>to</strong>rs and consultants.
Sources of Information Used for Moni<strong>to</strong>ring
Much of the information used in moni<strong>to</strong>ring will be produced by the entity’s information system.
Management may tend <strong>to</strong> assume that this information is accurate. If this information is not accurate, there is
a risk that management could reach incorrect conclusions, and make poor decisions as a result.
Accordingly, when the audi<strong>to</strong>r is evaluating the moni<strong>to</strong>ring of controls, an understanding is required of:
• The sources of the information related <strong>to</strong> the entity’s moni<strong>to</strong>ring activities; and
• The basis upon which management considers the information <strong>to</strong> be sufficiently reliable for the purpose.
5.9 Understanding of Internal Controls Relevant <strong>to</strong> the Audit
The following exhibit summarizes the steps involved in obtaining an understanding of internal controls
relevant <strong>to</strong> the audit.
Exhibit 5.9-1
Identify
Specific Risks
of Material
Misstatement
Requiring
Mitigation
Management’s
Response <strong>to</strong>
the Identified
Risks of Material
Misstatement
Significant
Deficiencies
Implementation of
Relevant Controls
Address
The potential risks of material misstatement (related <strong>to</strong> significant classes of
transactions, account balances, and financial statement disclosures) that exist at the
assertion level. For example:
• Regular day-<strong>to</strong>-day transactional risks;
• Fraud risks (such as management override and asset misappropriation);
• Disclosure risks (incomplete or missing information);
• Significant risks;
• Non-routine risks (such as implementing a new accounting system); and
• Judgmental risks (estimates, valuations, etc.).
What specific (manual or IT application) control activities that (individually or in
combination with others) prevent, or detect and correct, material errors and fraud.
This step does not require the audi<strong>to</strong>r <strong>to</strong> identify all the control activities that may
exist. For example, an entity may have implemented 15 control procedures <strong>to</strong> address
a particular risk. If the audi<strong>to</strong>r concluded that the first three control procedures
identified were sufficient <strong>to</strong> mitigate the risk involved, there is no need <strong>to</strong> carry on
work <strong>to</strong> identify and document the other 12 control procedures.
Failure by management <strong>to</strong> mitigate a risk of material misstatement would likely result
in a significant deficiency. These would be reported <strong>to</strong> management and an audit
response developed.
This involves procedures (in addition <strong>to</strong> inquiry of the client’s personnel) <strong>to</strong> determine
that relevant controls identified actually exist and are in use by the entity. This can be
carried out at a point in time such as tracing one transaction through the system on
a particular day. This is not a test of controls, which is designed <strong>to</strong> evaluate whether a
control operated effectively throughout the period covered by the audit.