Document ID: chunk:federal_register_of_legislation:F2021C01250:reg:27:p16
Version: federal_register_of_legislation:F2021C01250
Segment Type: reg
Provision Reference: reg 27 (pt 16/23)
Character Range: 52101–55122

evidence to determine whether changes to the automated control have been made that affect its continued effective functioning through, for example, enquiries of management and the inspection of logs to indicate what controls have been changed.  Consideration of audit evidence about these changes may support either increasing or decreasing the expected audit evidence to be obtained in the current period about the operating effectiveness of the controls.

Controls that have changed from previous audits (Ref: Para. 14(a))

A37.         Changes may affect the relevance and reliability of the audit evidence obtained in previous audits such that there may no longer be a basis for continued reliance.  For example, changes in a system that enable an entity to receive a new report from the system probably do not affect the relevance of audit evidence from a previous audit, however, a change that causes data to be accumulated or calculated differently does affect it.

Controls that have not changed from previous audits (Ref: Para. 14(b))

A38.         The auditor's decision on whether to rely on audit evidence obtained in previous audits for controls that:

(a)                have not changed since they were last tested; and

(b)                are not controls that mitigate a significant risk,

    is a matter of professional judgement.  In addition, the length of time between retesting such controls is also a matter of professional judgement, but is required by paragraph 14(b) to be at least once in every third year.

A39.         In general, the higher the risk of material misstatement, or the greater the reliance on controls, the shorter the time period elapsed, if any, is likely to be.  Factors that may decrease the period for retesting a control, or result in not relying on audit evidence obtained in previous audits at all, include the following:

           * A deficient control environment.

           * A deficiency in the entity's process to monitor the system of internal controls.

           * A significant manual element to controls.

           * Personnel changes that significantly affect the application of the control.

           * Changing circumstances that indicate the need for changes in the control.

           * Deficient general IT-controls.

A40.         When there are a number of controls for which the auditor intends to rely on audit evidence obtained in previous audits, testing some of those controls in each audit provides corroborating information about the continuing effectiveness of the control environment.  This contributes to the auditor's decision about whether it is appropriate to rely on audit evidence obtained in previous audits.

Evaluating the Operating Effectiveness of Controls (Ref: Para. 16-17)

A41.         A material misstatement detected by the auditor's procedures is a strong indicator of the existence of a significant deficiency in internal control.

A42.         The concept of effectiveness of the operation of controls recognises