Document ID: chunk:federal_register_of_legislation:F2021C01250:reg:27:p15
Version: federal_register_of_legislation:F2021C01250
Segment Type: reg
Provision Reference: reg 27 (pt 15/23)
Character Range: 49289–52377

(Ref: Para. 10(b))

A32.         In some circumstances, it may be necessary to obtain audit evidence supporting the effective operation of indirect controls (e.g., general IT controls). As explained in paragraphs A29 to A31, general IT controls may have been identified in accordance with ASA 315 because of their support of the operating effectiveness of automated controls or due to their support in maintaining the integrity of information used in the entity's financial reporting, including system-generated reports. The requirement in paragraph 10(b) acknowledges that the auditor may have already tested certain indirect controls to address the matters in paragraph 10(a).

Timing of Tests of Controls

Intended period of reliance (Ref: Para. 11)

A33.         Audit evidence pertaining only to a point in time may be sufficient for the auditor's purpose, for example, when testing controls over the entity's physical inventory counting at the period end.  If, on the other hand, the auditor intends to rely on a control over a period, tests that are capable of providing audit evidence that the control operated effectively at relevant times during that period are appropriate.  Such tests may include tests of controls in the entity's process to monitor the system of internal controls.

Using audit evidence obtained during an interim period (Ref: Para. 12(b))

A34.         Relevant factors in determining what additional audit evidence to obtain about controls that were operating during the period remaining after an interim period, include:

           * The significance of the assessed risks of material misstatement at the assertion level.

           * The specific controls that were tested during the interim period, and significant changes to them since they were tested, including changes in the information system, processes, and personnel.

           * The degree to which audit evidence about the operating effectiveness of those controls was obtained.

           * The length of the remaining period.

           * The extent to which the auditor intends to reduce further substantive procedures based on the reliance of controls.

           * The control environment.

A35.         Additional audit evidence may be obtained, for example, by extending tests of controls over the remaining period or testing the entity's monitoring of controls.

Using audit evidence obtained in previous audits (Ref: Para. 13)

A36.         In certain circumstances, audit evidence obtained from previous audits may provide audit evidence where the auditor performs audit procedures to establish its continuing relevance and reliability.  For example, in performing a previous audit, the auditor may have determined that an automated control was functioning as intended.  The auditor may obtain audit evidence to determine whether changes to the automated control have been made that affect its continued effective functioning through, for example, enquiries of management and the inspection of logs to indicate what controls have been changed.  Consideration of audit evidence