Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p89
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 264943–268094

610, the activities of an internal audit function are distinct from other monitoring controls that may be relevant to financial reporting, such as reviews of management accounting information that are designed to contribute to how the entity prevents or detects misstatements.

11.               Establishing communications with the appropriate individuals within an entity's internal audit function early in the engagement, and maintaining such communications throughout the engagement, can facilitate effective sharing of information.  It creates an environment in which the auditor can be informed of significant matters that may come to the attention of the internal audit function when such matters may affect the work of the auditor.  ASA 200 discusses the importance of the auditor planning and performing the audit with professional scepticism,[75] including being alert to information that brings into question the reliability of documents and responses to enquiries to be used as audit evidence.  Accordingly, communication with the internal audit function throughout the engagement may provide opportunities for internal auditors to bring such information to the auditor's attention.  The auditor is then able to take such information into account in the auditor's identification and assessment of risks of material misstatement.

Appendix 5

(Ref: Para. 25(a), 26(b)‒(c), A94, A166‒A172)

Considerations for Understanding Information Technology (IT)

This appendix provides further matters that the auditor may consider in understanding the entity's use of IT in its system of internal control.

Understanding the Entity's Use of Information Technology in the Components of the Entity's System of Internal Control

      1. An entity's system of internal control contains manual elements and automated elements (i.e., manual and automated controls and other resources used in the entity's system of internal control).  An entity's mix of manual and automated elements varies with the nature and complexity of the entity's use of IT.  An entity's use of IT affects the manner in which the information relevant to the preparation of the financial report in accordance with the applicable financial reporting framework is processed, stored and communicated, and therefore affects the manner in which the entity's system of internal control is designed and implemented.  Each component of the entity's system of internal control may use some extent of IT.

Generally, IT benefits an entity's system of internal control by enabling an entity to:

           * Consistently apply predefined business rules and perform complex calculations in processing large volumes of transactions or data;

           * Enhance the timeliness, availability and accuracy of information;

           * Facilitate the additional analysis of information;

           * Enhance the ability to monitor the performance of the entity's activities and its policies and procedures;

           * Reduce the risk that controls will be circumvented; and

           * Enhance the ability to achieve effective segregation of duties by implementing security controls in IT