Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p57
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 166576–169712

automated controls by identifying and testing general IT controls that provide for the consistent operation of an automated control instead of performing tests of operating effectiveness on the automated controls directly.  Obtaining audit evidence about the implementation of a manual control at a point in time does not provide audit evidence about the operating effectiveness of the control at other times during the period under audit.  Tests of the operating effectiveness of controls, including tests of indirect controls, are further described in ASA 330.[45]

A181.      When the auditor does not plan to test the operating effectiveness of identified controls, the auditor's understanding may still assist in the design of the nature, timing and extent of substantive audit procedures that are responsive to the related risks of material misstatement.
Example:

The results of these risk assessment procedures may provide a basis for the auditor's consideration of possible deviations in a population when designing audit samples.

Control Deficiencies Within the Entity's System of Internal Control (Ref: Para. 27)

A182.      In performing the evaluations of each of the components of the entity's system of internal control,[46] the auditor may determine that certain of the entity's policies in a component are not appropriate to the nature and circumstances of the entity.  Such a determination may be an indicator that assists the auditor in identifying control deficiencies.  If the auditor has identified one or more control deficiencies, the auditor may consider the effect of those control deficiencies on the design of further audit procedures in accordance with ASA 330.

A183.      If the auditor has identified one or more control deficiencies, ASA 265[47] requires the auditor to determine whether, individually or in combination, the deficiencies constitute a significant deficiency.  The auditor uses professional judgement in determining whether a deficiency represents a significant control deficiency.[48]
Examples:

Circumstances that may indicate a significant control deficiency exists include matters such as:

      * The identification of fraud of any magnitude that involves senior management;

      * Identified internal processes that are inadequate relating to the reporting and communication of deficiencies noted by internal audit;

      * Previously communicated deficiencies that are not corrected by management in a timely manner;

      * Failure by management to respond to significant risks, for example, by not implementing controls over significant risks; and

      * The restatement of previously issued financial reports.

Identifying and Assessing the Risks of Material Misstatement (Ref: Para. 28‒37)

Why the Auditor Identifies and Assesses the Risks of Material Misstatement

A184.      Risks of material misstatement are identified and assessed by the auditor in order to determine the nature, timing and extent of further audit procedures necessary to obtain sufficient appropriate audit evidence.  This evidence enables the auditor to express an opinion on the financial