Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p21
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 21/47)
Character Range: 67780–70994

in designing and implementing controls, management may make judgements on the nature and extent of the controls it chooses to implement, and the nature and extent of the risks it chooses to assume.

Considerations specific to smaller entities

A57.         Smaller entities often have fewer employees which may limit the extent to which segregation of duties is practicable.  However, in a small owner‑managed entity, the owner‑manager may be able to exercise more effective oversight than in a larger entity.  This oversight may compensate for the generally more limited opportunities for segregation of duties.

A58.         On the other hand, the owner‑manager may be more able to override controls because the system of internal control is less structured.  This is taken into account by the auditor when identifying the risks of material misstatement due to fraud.

Division of Internal Control into Components

A59.         The division of internal control into the following five components, for purposes of Australian Auditing Standards, provides a useful framework for auditors to consider how different aspects of an entity's internal control may affect the audit:

(a)                The control environment;

(b)                The entity's risk assessment process;

(c)                The information system, including the related business processes, relevant to financial reporting, and communication;

(d)                Control activities; and

(e)                Monitoring of controls.

    The division does not necessarily reflect how an entity designs, implements and maintains internal control, or how it may classify any particular component.  Auditors may use different terminology or frameworks to describe the various aspects of internal control, and their effect on the audit than those used in this Auditing Standard, provided all the components described in this Auditing Standard are addressed.

A60.         Application material relating to the five components of internal control as they relate to a financial report audit is set out in paragraphs A77-A121 below.  Appendix 1 provides further explanation of these components of internal control.

Characteristics of Manual and Automated Elements of Internal Control Relevant to the Auditor's Risk Assessment

A61.         An entity's system of internal control contains manual elements and often contains automated elements.  The characteristics of manual or automated elements are relevant to the auditor's risk assessment and further audit procedures based thereon.

A62.         The use of manual or automated elements in internal control also affects the manner in which transactions are initiated, recorded, processed, and reported:

           * Controls in a manual system may include such procedures as approvals and reviews of transactions, and reconciliations and follow‑up of reconciling items.  Alternatively, an entity may use automated procedures to initiate, record, process, and report transactions, in which case records in electronic format replace paper documents.

           * Controls in IT systems consist of a combination of automated controls (for example, controls embedded in computer programs) and manual