Document ID: chunk:federal_register_of_legislation:F2025C00096:body:0:p64
Version: federal_register_of_legislation:F2025C00096
Segment Type: other
Provision Reference: 
Character Range: 182750–185907

2

(Ref: Para. A85)

Understanding the Group's System of Internal Control

 1.                This appendix provides examples of matters related to internal control that may be helpful in obtaining an understanding of the system of internal control in the context of a group environment, and expands on how ASA 315[97] is to be applied in relation to an audit of a group financial report. The examples may not be relevant to every group audit engagement and the list of examples is not necessarily complete.

Control Environment

 1.                The group auditor's understanding of the control environment may include matters such as the following:

           * The structure of the governance and management functions across the group, and group management's oversight responsibilities, including arrangements for assigning authority and responsibility to management of entities or business units in the group.

           * How oversight over the group's system of internal control by those charged with governance is structured and organised.

           * How ethical and behavioural standards are communicated and reinforced in practice across the group, (e.g., group-wide programs, such as codes of conduct and fraud prevention programs).

           * The consistency of policies and procedures across the group, including a group financial reporting procedures manual.

The Group's Risk Assessment Process

 1.                The group auditor's understanding of the group's risk assessment process may include matters such as group management's risk assessment process, that is, the process for identifying, analysing and managing business risks, including the risk of fraud, that may result in material misstatement of the group financial report. It may also include an understanding of how sophisticated the group's risk assessment process is and the involvement of entities and business units in this process.

The Group's Process to Monitor the System of Internal Control

 1.                The group auditor's understanding of the group's process to monitor the system of internal control may include matters such as monitoring of controls, including how the controls are monitored across the group and, when relevant, activities of the internal audit function across the group, including its nature, responsibilities and activities in respect of monitoring of controls at entities or business units in the group. ASA 610[98] requires the auditor to evaluate the extent to which the internal audit function's organisational status and relevant policies and procedures support the objectivity of internal auditors, the level of competence of the internal audit function, and whether the internal audit function applies a systematic and disciplined approach, including quality control.

The Information System and Communication

 1.                The group auditor's understanding of the group's information system and communication may include matters such as the following:

           * The extent of centralisation in the group's IT environment and the commonality of IT applications, IT processes and IT infrastructure.

           *