Document ID: chunk:federal_register_of_legislation:F2025L00107:front:0:p162
Version: federal_register_of_legislation:F2025L00107
Segment Type: other
Provision Reference: 
Character Range: 505393–508660

practitioner may communicate to them instances of fraud or suspected fraud or non-compliance or suspected non-compliance with laws and regulations involving management, employees who have significant roles in internal control, or where the fraud or non-compliance with laws and regulations results in a material misstatement in the sustainability information, unless that communication is prohibited by law or regulation.

 2.       In certain circumstances, the practitioner's response to identified or suspected fraud, or instances of non-compliance or suspected non-compliance with laws and regulations may require reporting the identified or suspected fraud or non-compliance with laws and regulations to an appropriate authority outside the entity. See paragraph 67.

 3.       Relevant ethical requirements may include requirements addressing the practitioner's communication of instances of identified or suspected non-compliance with laws and regulations with the financial statement auditor.

 4.       Examples of circumstances that may cause the practitioner to evaluate the implications of identified or suspected non-compliance on the reliability of written representations received from management and, where applicable, those charged with governance include when:

           * The practitioner suspects or has evidence of the involvement or intended involvement of management and, where applicable, those charged with governance in any identified or suspected non-compliance.

           * The practitioner is aware that management and, where applicable, those charged with governance have knowledge of such non-compliance and, contrary to legal or regulatory requirements, have not reported, or authorised reporting of, the matter to an appropriate authority within a reasonable period.

Tests of Controls (Ref: Para. 132, 135)

 1.       When more persuasive evidence is needed regarding the effectiveness of a control, it may be appropriate to increase the extent of testing of the control. Other matters the practitioner may consider in determining the extent of tests of controls include the following:

           * The frequency of the performance of the control by the entity during the period.

           * The length of time during the period that the practitioner is relying on evidence about the operating effectiveness of the control.

           * The expected rate of deviation from a control.

           * The relevance and reliability of the information to be used as evidence regarding the operating effectiveness of the control at the assertion level.

           * The extent to which evidence is obtained from tests of other controls related to the assertion in a reasonable assurance engagement.

 1.       Because of the inherent consistency of IT processing, evidence about the implementation of an automated application control, when considered in combination with evidence about the operating effectiveness of the entity's IT general controls (in particular, change controls), may also provide substantial evidence about its operating effectiveness.

 2.       In certain circumstances, evidence obtained from previous engagements may provide evidence for the current engagement when the practitioner performs procedures to