Guide to Using International Standards on Auditing in - IFAC

73
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
CONSIDER POINT
When the entity has a mix of manual and au<strong>to</strong>mated controls, always identify who is responsible for
the operation of each control. For example, suppose a warehouse manager is responsible for shipping
goods. The warehouse manager manually inputs the data in<strong>to</strong> a sales system that has an application
control <strong>to</strong> match the shipment <strong>to</strong> the original order. If something goes wrong in the matching process,
is it the responsibility of the warehouse manager, the IT department, or the accounting department?
Unless one person is assigned responsibility for the entire process, people will inevitably blame each
other when errors are made.
Where responsibility has not been assigned, consider:
• The likelihood and magnitude of potential misstatements that could occur in the financial
statements;
• The appropriate audit response; and
• Whether the matter should be reported <strong>to</strong> management.
5.11 Pervasive Controls
Paragraph #
Relevant Extracts from ISAs
315.14 (b) The audi<strong>to</strong>r shall…evaluate whether:
(b) The strengths in the control environment elements collectively provide an appropriate
foundation for the other components of internal control, and whether those other
components are not undermined by deficiencies in the control environment. (Ref: Para.
A69-A78)
This chapter has now addressed each of the five components of internal control. Some of these controls are
pervasive in nature and only indirectly serve <strong>to</strong> prevent a misstatement from occurring, or <strong>to</strong> detect and
correct it after it has occurred. Other controls relate <strong>to</strong> particular transaction risks (such as payroll, sales, and
purchases) and are designed specifically <strong>to</strong> prevent or detect and correct misstatements.
The following exhibit shows the interaction of the two levels of control over transactions as they journey from
initiation and processing (transactional level) through the accounting records (entity level) and finally <strong>to</strong> the
financial statements. Notice that at least three of the five internal control components consist primarily of
pervasive controls.