Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p50
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 147881–150795

obtain an understanding of the controls that management has designed, implemented and maintained to prevent and detect fraud.

Controls over journal entries (Ref: Para. 26(a)(ii))

A160.      Controls that address risks of material misstatement at the assertion level that are expected to be identified for all audits are controls over journal entries, because the manner in which an entity incorporates information from transaction processing into the general ledger ordinarily involves the use of journal entries, whether standard or non-standard, or automated or manual.  The extent to which other controls are identified may vary based on the nature of the entity and the auditor's planned approach to further audit procedures.
Example:

In an audit of a less complex entity, the entity's information system may not be complex and the auditor may not plan to rely on the operating effectiveness of controls.  Further, the auditor may not have identified any significant risks or any other risks of material misstatement for which it is necessary for the auditor to evaluate the design of controls and determine that they have been implemented.  In such an audit, the auditor may determine that there are no identified controls other than the entity's controls over journal entries.

Automated tools and techniques

A161.      In manual general ledger systems, non-standard journal entries may be identified through inspection of ledgers, journals, and supporting documentation.  When automated procedures are used to maintain the general ledger and prepare financial reports, such entries may exist only in electronic form and may therefore be more easily identified through the use of automated techniques.
Example:

In the audit of a less complex entity, the auditor may be able to extract a total listing of all journal entries into a simple spreadsheet.  It may then be possible for the auditor to sort the journal entries by applying a variety of filters such as currency amount, name of the preparer or reviewer, journal entries that gross up the balance sheet and income statement only, or to view the listing by the date the journal entry was posted to the general ledger, to assist the auditor in designing responses to the risks identified relating to journal entries.

Controls for which the auditor plans to test the operating effectiveness (Ref: Para. 26(a)(iii))

A162.      The auditor determines whether there are any risks of material misstatement at the assertion level for which it is not possible to obtain sufficient appropriate audit evidence through substantive procedures alone.  The auditor is required, in accordance with ASA 330,[42] to design and perform tests of controls that address such risks of material misstatement when substantive procedures alone do not provide sufficient appropriate audit evidence at the assertion level.  As a result, when such controls exist that