Document ID: chunk:federal_register_of_legislation:F2021C01250:reg:27:p11
Version: federal_register_of_legislation:F2021C01250
Segment Type: reg
Provision Reference: reg 27 (pt 11/23)
Character Range: 38464–41447

increases.  For example, in response to the assessed risk of material misstatement due to fraud, increasing sample sizes or performing substantive analytical procedures at a more detailed level may be appropriate.  However, increasing the extent of an audit procedure is effective only if the audit procedure itself is relevant to the specific risk.

A16.         The use of computer-assisted audit techniques (CAATs) may enable more extensive testing of electronic transactions and account files, which may be useful when the auditor decides to modify the extent of testing, for example, in responding to the risks of material misstatement due to fraud.  Such techniques can be used to select sample transactions from key electronic files, to sort transactions with specific characteristics, or to test an entire population instead of a sample.

Considerations specific to public sector entities

A17.         For the audits of public sector entities, the audit mandate and any other special auditing requirements may affect the auditor's consideration of the nature, timing and extent of further audit procedures.

Considerations specific to smaller entities

A18.         In the case of smaller entities, there may not be many control activities that could be identified by the auditor, or the extent to which their existence or operation have been documented by the entity may be limited.  In such cases, it may be more efficient for the auditor to perform further audit procedures that are primarily substantive procedures.  In some rare cases, however, the absence of controls or of components of the system of internal control may make it impossible to obtain sufficient appropriate audit evidence.

Higher Assessments of Risk (Ref: Para 7(b))

A19.         When obtaining more persuasive audit evidence because of a higher assessment of risk, the auditor may increase the quantity of the evidence, or obtain evidence that is more relevant or reliable, for example, by placing more emphasis on obtaining third party evidence or by obtaining corroborating evidence from a number of independent sources.

Tests of Controls

Designing and Performing Tests of Controls (Ref: Para. 8)

A20.         Tests of controls are performed only on those controls that the auditor has determined are suitably designed to prevent, or detect and correct, a material misstatement in a relevant assertion, and the auditor plans to test those controls.  If substantially different controls were used at different times during the period under audit, each is considered separately.

A21.         Testing the operating effectiveness of controls is different from obtaining an understanding of and evaluating the design and implementation of controls.  However, the same types of audit procedures are used.  The auditor may, therefore, decide it is efficient to test the operating effectiveness of controls at the same time as evaluating their design and determining that they have been implemented.