Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p27
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 27/47)
Character Range: 85501–88587

an absolute deterrent to fraud.  Conversely, deficiencies in the control environment may undermine the effectiveness of controls, in particular in relation to fraud.  For example, management's failure to commit sufficient resources to address IT security risks may adversely affect internal control by allowing improper changes to be made to computer programs or to data, or unauthorised transactions to be processed.  As explained in ASA 330, the control environment also influences the nature, timing, and extent of the auditor's further procedures.[14]

A84.         The control environment in itself does not prevent, or detect and correct, a material misstatement.  It may, however, influence the auditor's evaluation of the effectiveness of other controls (for example, the monitoring of controls and the operation of specific control activities) and thereby, the auditor's assessment of the risks of material misstatement.

Considerations Specific to Smaller Entities

A85.         The control environment within small entities is likely to differ from larger entities.  For example, those charged with governance in small entities may not include an independent or outside member, and the role of governance may be undertaken directly by the owner‑manager where there are no other owners.  The nature of the control environment may also influence the significance of other controls, or their absence.  For example, the active involvement of an owner‑manager may mitigate certain of the risks arising from a lack of segregation of duties in a small business; it may, however, increase other risks, for example, the risk of override of controls.

A86.         In addition, audit evidence for elements of the control environment in smaller entities may not be available in documentary form, in particular where communication between management and other personnel may be informal, yet effective.  For example, small entities might not have a written code of conduct but, instead, develop a culture that emphasises the importance of integrity and ethical behaviour through oral communication and by management example.

A87.         Consequently, the attitudes, awareness and actions of management or the owner‑manager are of particular importance to the auditor's understanding of a smaller entity's control environment.

Components of Internal Control—The Entity's Risk Assessment Process (Ref: Para. 15)

A88.         The entity's risk assessment process forms the basis for how management determines the risks to be managed.  If that process is appropriate to the circumstances, including the nature, size and complexity of the entity, it assists the auditor in identifying risks of material misstatement.  Whether the entity's risk assessment process is appropriate to the circumstances is a matter of judgement.

Considerations Specific to Smaller Entities (Ref: Para. 17)

A89.         There is unlikely to be an established risk assessment process in a small entity.  In such cases, it is likely that management will identify risks through direct personal involvement in the