Document ID: chunk:federal_register_of_legislation:F2021C01264:body:0:p6
Version: federal_register_of_legislation:F2021C01264
Segment Type: other
Provision Reference: 
Character Range: 15185–18505

integrity or competence into question (see paragraph A20).

A2.             In discussing the facts and circumstances of the auditor's findings with management, the auditor may obtain other relevant information for further consideration, such as:

           * Management's understanding of the actual or suspected causes of the deficiencies.

           * Exceptions arising from the deficiencies that management may have noted, for example, misstatements that were not prevented by the relevant information technology (IT) controls.

           * A preliminary indication from management of its response to the findings.

Considerations Specific to Smaller Entities

A3.             While the concepts underlying controls in the control activities component in smaller entities are likely to be similar to those in larger entities, the formality with which they operate will vary.  Further, smaller entities may find that certain types of control activities are not necessary because of controls applied by management.  For example, management's sole authority for granting credit to customers and approving significant purchases can provide effective control over important account balances and transactions, lessening or removing the need for more detailed controls.

A4.             Also, smaller entities often have fewer employees which may limit the extent to which segregation of duties is practicable.  However, in a small owner‑managed entity, the owner‑manager may be able to exercise more effective oversight than in a larger entity.  This higher level of management oversight needs to be balanced against the greater potential for management override of controls.

Significant Deficiencies in Internal Control (Ref: Para. 6(b), 8)

A5.             The significance of a deficiency or a combination of deficiencies in internal control depends not only on whether a misstatement has actually occurred, but also on the likelihood that a misstatement could occur and the potential magnitude of the misstatement.  Significant deficiencies may therefore exist even though the auditor has not identified misstatements during the audit.

A6.             Examples of matters that the auditor may consider in determining whether a deficiency or combination of deficiencies in internal control constitutes a significant deficiency include:

           * The likelihood of the deficiencies leading to material misstatements in the financial report in the future.

           * The susceptibility to loss or fraud of the related asset or liability.

           * The subjectivity and complexity of determining estimated amounts, such as fair value accounting estimates.

           * The financial report amounts exposed to the deficiencies.

           * The volume of activity that has occurred or could occur in the account balance or class of transactions exposed to the deficiency or deficiencies.

           * The importance of the controls to the financial reporting process; for example:

                   + General monitoring controls (such as oversight of management).

                   + Controls over the prevention and detection of fraud.

                   + Controls over the selection and application of significant accounting policies.

                   + Controls over significant transactions