Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p46
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 136517–139641

or disclosures in the entity's financial report (such as disclosures about credit risk, liquidity risk, and market risk) may be based on information obtained from the entity's risk management system.  However, the auditor is not required to understand all aspects of the risk management system, and uses professional judgement in determining the necessary understanding.

The entity's use of information technology in the information system

Why does the auditor understand the IT environment relevant to the information system

A140.      The auditor's understanding of the information system includes the IT environment relevant to the flows of transactions and processing of information in the entity's information system because the entity's use of IT applications or other aspects in the IT environment may give rise to risks arising from the use of IT.

A141.      The understanding of the entity's business model and how it integrates the use of IT may also provide useful context to the nature and extent of IT expected in the information system.

Understanding the entity's use of IT

A142.      The auditor's understanding of the IT environment may focus on identifying, and understanding the nature and number of, the specific IT applications and other aspects of the IT environment that are relevant to the flows of transactions and processing of information in the information system.  Changes in the flow of transactions, or information within the information system may result from program changes to IT applications, or direct changes to data in databases involved in processing, or storing those transactions or information.

A143.      The auditor may identify the IT applications and supporting IT infrastructure concurrently with the auditor's understanding of how information relating to significant classes of transactions, account balances and disclosures flows into, through and out the entity's information system.

Obtaining an understanding of the entity's communication (Ref: Para. 25(b))

Scalability

A144.      In larger, more complex entities, information the auditor may consider when understanding the entity's communication may come from policy manuals and financial reporting manuals.

A145.      In less complex entities, communication may be less structured (e.g., formal manuals may not be used) due to fewer levels of responsibility and management's greater visibility and availability.  Regardless of the size of the entity, open communication channels facilitate the reporting of exceptions and acting on them.

Evaluating whether the relevant aspects of the information system support the preparation of the entity's financial report (Ref: Para. 25(c))

A146.      The auditor's evaluation of whether the entity's information system and communication appropriately supports the preparation of the financial report is based on the understanding obtained in paragraphs 25(a)‒(b).

Control Activities (Ref: Para. 26)

Controls in the control activities component
Appendix 3, Paragraphs 20 and 21 set out further considerations relating to control activities.

A147.      The control