Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p49
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 145075–148166

similar to those in larger entities, but the formality with which they operate may vary.  Further, in less complex entities, more controls may be directly applied by management.
Example:

Management's sole authority for granting credit to customers and approving significant purchases can provide strong control over important account balances and transactions.

A157.      It may be less practicable to establish segregation of duties in less complex entities that have fewer employees.  However, in an owner-managed entity, the owner-manager may be able to exercise more effective oversight through direct involvement than in a larger entity, which may compensate for the generally more limited opportunities for segregation of duties.  Although, as also explained in ASA 240, domination of management by a single individual can be a potential control deficiency since there is an opportunity for management override of controls.[39]

Controls that address risks of material misstatement at the assertion level (Ref: Para. 26(a))

Controls that address risks that are determined to be a significant risk (Ref: Para. 26(a)(i))

A158.      Regardless of whether the auditor plans to test the operating effectiveness of controls that address significant risks, the understanding obtained about management's approach to addressing those risks may provide a basis for the design and performance of substantive procedures responsive to significant risks as required by ASA 330.[40] Although risks relating to significant non-routine or judgemental matters are often less likely to be subject to routine controls, management may have other responses intended to deal with such risks.  Accordingly, the auditor's understanding of whether the entity has designed and implemented controls for significant risks arising from non-routine or judgemental matters may include whether and how management responds to the risks.  Such responses may include:

           * Controls, such as a review of assumptions by senior management or experts.

           * Documented processes for accounting estimations.

           * Approval by those charged with governance.
Example:

Where there are one-off events such as the receipt of a notice of a significant lawsuit, consideration of the entity's response may include such matters as whether it has been referred to appropriate experts (such as internal or external legal counsel), whether an assessment has been made of the potential effect, and how it is proposed that the circumstances are to be disclosed in the financial report.

A159.      ASA 240[41] requires the auditor to understand controls related to assessed risks of material misstatement due to fraud (which are treated as significant risks), and further explains that it is important for the auditor to obtain an understanding of the controls that management has designed, implemented and maintained to prevent and detect fraud.

Controls over journal entries (Ref: Para. 26(a)(ii))

A160.      Controls that address risks of material misstatement at the assertion level that are expected