Guide to Using International Standards on Auditing in - IFAC

72
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
5.10 Manual versus Au<strong>to</strong>mated Controls
For most entities, the system of internal control will consist of a mixture of manual and au<strong>to</strong>mated controls.
The risks and benefits associated with the different types of control are outlined below.
Exhibit 5.10-1
Manual Controls
• Used <strong>to</strong> moni<strong>to</strong>r the effectiveness of au<strong>to</strong>mated
controls.
• Suited <strong>to</strong> areas where judgment and discretion
are required over large, unusual, or non-recurring
transactions.
• Beneficial when errors are difficult <strong>to</strong> define,
anticipate, or predict.
• Changing circumstances may require a control
response outside the scope of an existing
au<strong>to</strong>mated control.
Benefits
Au<strong>to</strong>mated Controls
• Consistently apply predefined business rules and
perform complex calculations in processing large
volumes of transactions or data.
• Enhance the timeliness, availability, and accuracy
of information.
• Facilitate the additional analysis of information.
• Enhance the ability <strong>to</strong> moni<strong>to</strong>r the performance
of the entity’s activities and its policies and
procedures.
• Reduce the risk that internal control will be
circumvented.
• Enhance the ability <strong>to</strong> achieve effective segregation
of duties by implementing appropriate system
access restrictions in applications, databases, and
operating systems.
Risks
Manual Controls
Au<strong>to</strong>mated Controls
• Less reliable than au<strong>to</strong>mated controls, as
performed by people.
• Reliance can be placed on systems or programs
that are inaccurately processing data, processing
• More easily bypassed, ignored, or overridden.
inaccurate data, or both.
• Prone <strong>to</strong> simple errors and mistakes.
• Unauthorized access <strong>to</strong> data may result in destruction
• Consistency of application cannot be assumed.
of data or improper changes <strong>to</strong> data, including
the recording of unauthorized or non-existent
• Less suitable for high volume or recurring
transactions, or inaccurate recording of transactions
transactions where au<strong>to</strong>mated controls would be
(particular risks may arise where multiple users access
more efficient.
a common database).
• Less suitable for activities where specific ways <strong>to</strong>
• The possibility of IT personnel gaining access
perform the control can be adequately designed
privileges beyond those necessary <strong>to</strong> perform
and au<strong>to</strong>mated.
their assigned duties, thereby breaking down the
segregation of duties.
• Unauthorized changes <strong>to</strong> data in master files.
• Unauthorized changes <strong>to</strong> systems or programs.
• Failure <strong>to</strong> make necessary changes <strong>to</strong> systems or
programs.
• Inappropriate manual intervention.
• Potential loss of data or inability <strong>to</strong> access data as
required.