Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p42
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 124670–127902

information system and communication and controls in the control activities component

A124.      The auditor is required to understand the entity's information system and communication because understanding the entity's policies that define the flows of transactions and other aspects of the entity's information processing activities relevant to the preparation of the financial report, and evaluating whether the component appropriately supports the preparation of the entity's financial report, supports the auditor's identification and assessment of risks of material misstatement at the assertion level.  This understanding and evaluation may also result in the identification of risks of material misstatement at the financial report level when the results of the auditor's procedures are inconsistent with expectations about the entity's system of internal control that may have been set based on information obtained during the engagement acceptance or continuance process (see paragraph A86).

A125.      The auditor is required to identify specific controls in the control activities component, and evaluate the design and determine whether the controls have been implemented, as it assists the auditor's understanding about management's approach to addressing certain risks and therefore provides a basis for the design and performance of further audit procedures responsive to these risks as required by ASA 330.  The higher on the spectrum of inherent risk a risk is assessed, the more persuasive the audit evidence needs to be.  Even when the auditor does not plan to test the operating effectiveness of identified controls, the auditor's understanding may still affect the design of the nature, timing and extent of substantive audit procedures that are responsive to the related risks of material misstatement.

The iterative nature of the auditor's understanding and evaluation of the information system and communication, and control activities

A126.      As explained in paragraph A49, the auditor's understanding of the entity and its environment, and the applicable financial reporting framework, may assist the auditor in developing initial expectations about the classes of transactions, account balances and disclosures that may be significant classes of transactions, account balances and disclosures.  In obtaining an understanding of the information system and communication component in accordance with paragraph 25(a), the auditor may use these initial expectations for the purpose of determining the extent of understanding of the entity's information processing activities to be obtained.

A127.      The auditor's understanding of the information system includes understanding the policies that define flows of information relating to the entity's significant classes of transactions, account balances, and disclosures, and other related aspects of the entity's information processing activities.  This information, and the information obtained from the auditor's evaluation of the information system may confirm or further influence the auditor's expectations about the significant classes of transactions, account balances and disclosures initially identified (see paragraph A126).

A128.      In