Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p26
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 26/47)
Character Range: 82584–85791

training, evaluation, counselling, promotion, compensation, and remedial actions.

Audit Evidence for Elements of the Control Environment

A79.         Relevant audit evidence may be obtained through a combination of enquiries and other risk assessment procedures such as corroborating enquiries through observation or inspection of documents.  For example, through enquiries of management and employees, the auditor may obtain an understanding of how management communicates to employees its views on business practices and ethical behaviour.  The auditor may then determine whether relevant controls have been implemented by considering, for example, whether management has a written code of conduct and whether it acts in a manner that supports the code.

A80.         The auditor may also consider how management has responded to the findings and recommendations of the internal audit function regarding identified deficiencies in internal control relevant to the audit, including whether and how such responses have been implemented, and whether they have been subsequently evaluated by the internal audit function.

Effect of the Control Environment on the Assessment of the Risks of Material Misstatement

A81.         Some elements of an entity's control environment have a pervasive effect on assessing the risks of material misstatement.  For example, an entity's control consciousness is influenced significantly by those charged with governance, because one of their roles is to counterbalance pressures on management in relation to financial reporting that may arise from market demands or remuneration schemes.  The effectiveness of the design of the control environment in relation to participation by those charged with governance is therefore influenced by such matters as:

           * Their independence from management and their ability to evaluate the actions of management.

           * Whether they understand the entity's business transactions.

           * The extent to which they evaluate whether the financial report is prepared in accordance with the applicable financial reporting framework, including whether the financial report includes adequate disclosures.

A82.         An active and independent board of directors may influence the philosophy and operating style of senior management.  However, other elements may be more limited in their effect.  For example, although human resource policies and practices directed toward hiring competent financial, accounting, and IT personnel may reduce the risk of errors in processing financial information, they may not mitigate a strong bias by top management to overstate earnings.

A83.         The existence of a satisfactory control environment can be a positive factor when the auditor assesses the risks of material misstatement.  However, although it may help reduce the risk of fraud, a satisfactory control environment is not an absolute deterrent to fraud.  Conversely, deficiencies in the control environment may undermine the effectiveness of controls, in particular in relation to fraud.  For example, management's failure to commit sufficient resources to address IT security risks may adversely affect internal