Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p30
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 30/47)
Character Range: 94332–97598

the information system.  Obtaining an understanding of the entity's business processes, which include how transactions are originated, assists the auditor obtain an understanding of the entity's information system relevant to financial reporting in a manner that is appropriate to the entity's circumstances.

Considerations specific to smaller entities

A96.         The information system and related business processes relevant to financial reporting in small entities, including relevant aspects of that system relating to information disclosed in the financial report that is obtained from within or outside of the general and subsidiary ledgers, is likely to be less sophisticated than in larger entities, but its role is just as significant.  Small entities with active management involvement may not need extensive descriptions of accounting procedures, sophisticated accounting records, or written policies.  Understanding the entity's information system relevant to financial reporting may therefore be easier in an audit of smaller entities, and may be more dependent on enquiry than on review of documentation.  The need to obtain an understanding, however, remains important.

Communication (Ref: Para. 19)

A97.         Communication by the entity of the financial reporting roles and responsibilities and of significant matters relating to financial reporting involves providing an understanding of individual roles and responsibilities pertaining to internal control over financial reporting.  It includes such matters as the extent to which personnel understand how their activities in the financial reporting information system relate to the work of others and the means of reporting exceptions to an appropriate higher level within the entity.  Communication may take such forms as policy manuals and financial reporting manuals.  Open communication channels help ensure that exceptions are reported and acted on.

Considerations specific to smaller entities

A98.         Communication may be less structured and easier to achieve in a small entity than in a larger entity due to fewer levels of responsibility and management's greater visibility and availability.

Components of Internal Control—Control Activities (Ref: Para. 20)

A99.         Control activities are the policies and procedures that help ensure that management directives are carried out.  Control activities, whether within IT or manual systems, have various objectives and are applied at various organisational and functional levels.  Examples of specific control activities include those relating to the following:

           * Authorisation.

           * Performance reviews.

           * Information processing.

           * Physical controls.

           * Segregation of duties.

A100.      Control activities that are relevant to the audit are:

           * Those that are required to be treated as such, being control activities that relate to significant risks and those that relate to risks for which substantive procedures alone do not provide sufficient appropriate audit evidence, as required by paragraphs 29 and 30, respectively; or

           * Those that are considered to be relevant in the judgement of the auditor.

A101.      The auditor's judgement