Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p34
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 101839–104937

account balance or disclosure is susceptible to misstatement because of complexity, subjectivity, change or uncertainty, these inherent risk factors may create opportunity for management bias, whether unintentional or intentional, and affect susceptibility to misstatement due to management bias.  The auditor's identification of risks of material misstatement, and assessment of inherent risk at the assertion level, are also affected by the interrelationships among inherent risk factors.

A89.         Events or conditions that may affect susceptibility to misstatement due to management bias may also affect susceptibility to misstatement due to other fraud risk factors.  Accordingly, this may be relevant information for use in accordance with paragraph 24 of ASA 240, which requires the auditor to evaluate whether the information obtained from the other risk assessment procedures and related activities indicates that one or more fraud risk factors are present.

Obtaining an Understanding of the Entity's System of Internal Control (Ref: Para. 21‒27)
Appendix 3 further describes the nature of the entity's system of internal control and inherent limitations of internal control, respectively.  Appendix 3 also provides further explanation of the components of a system of internal control for the purposes of the ASAs.

A90.         The auditor's understanding of the entity's system of internal control is obtained through risk assessment procedures performed to understand and evaluate each of the components of the system of internal control as set out in paragraphs 21 to 27.

A91.         The components of the entity's system of internal control for the purpose of this ASA may not necessarily reflect how an entity designs, implements and maintains its system of internal control, or how it may classify any particular component.  Entities may use different terminology or frameworks to describe the various aspects of the system of internal control.  For the purpose of an audit, auditors may also use different terminology or frameworks provided all the components described in this ASA are addressed.

Scalability

A92.         The way in which the entity's system of internal control is designed, implemented and maintained varies with an entity's size and complexity.  For example, less complex entities may use less structured or simpler controls (i.e., policies and procedures) to achieve their objectives.

Considerations Specific to Public Sector Entities

A93.         Auditors of public sector entities often have additional responsibilities with respect to internal control, for example, to report on compliance with an established code of practice or reporting on spending against budget.  Auditors of public sector entities may also have responsibilities to report on compliance with law, regulation or other authority.  As a result, their considerations about the system of internal control may be broader and more detailed.

Information Technology in the Components of the Entity's System of Internal Control
Appendix 5 provides further guidance on understanding