Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p41
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 121836–124962

the internal audit function, the auditor expects to use the work of the internal audit function to modify the nature or timing, or reduce the extent, of audit procedures to be performed, ASA 610[37] applies.

Other sources of information used in the entity's process to monitor the system of internal control

Understanding the sources of information (Ref: Para. 24(b))

A119.      Management's monitoring activities may use information in communications from external parties such as customer complaints or regulator comments that may indicate problems or highlight areas in need of improvement.

Why the auditor is required to understand the sources of information used for the entity's monitoring of the system of internal control

A120.      The auditor's understanding of the sources of information used by the entity in monitoring the entity's system of internal control, including whether the information used is relevant and reliable, assists the auditor in evaluating whether the entity's process to monitor the entity's system of internal control is appropriate.  If management assumes that information used for monitoring is relevant and reliable without having a basis for that assumption, errors that may exist in the information could potentially lead management to draw incorrect conclusions from its monitoring activities.

Evaluating the entity's process to monitor the system of internal control (Ref: Para 24(c))

Why the auditor evaluates whether the entity's process to monitor the system of internal control is appropriate

A121.      The auditor's evaluation about how the entity undertakes ongoing and separate evaluations for monitoring the effectiveness of controls assists the auditor in understanding whether the other components of the entity's system of internal control are present and functioning, and therefore assists with understanding the other components of the entity's system of internal control.  This evaluation may also assist the auditor with identifying and assessing financial report level and assertion level risks of material misstatement (see paragraph A86).

Evaluating whether the entity's process to monitor the system of internal control is appropriate (Ref: Para. 24(c))

A122.      The auditor's evaluation of the appropriateness of the entity's process to monitor the system of internal control is based on the auditor's understanding of the entity's process to monitor the system of internal control.

Information System and Communication, and Control Activities (Ref: Para. 25‒26)

A123.      The controls in the information system and communication, and control activities components are primarily direct controls (i.e., controls that are sufficiently precise to prevent, detect or correct misstatements at the assertion level).

Why the auditor Is required to understand the information system and communication and controls in the control activities component

A124.      The auditor is required to understand the entity's information system and communication because understanding the entity's policies that define the flows of transactions and other aspects of the