Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p40
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 118817–122078

For entities where there is no formal process for monitoring the system of internal control, understanding the process to monitor the system of internal control may include understanding periodic reviews of management accounting information that are designed to contribute to how the entity prevents or detects misstatements.

Understanding the entity's process to monitor the system of internal control (Ref: Para. 24(a))

A116.      Matters that may be relevant for the auditor to consider when understanding how the entity monitors its system of internal control include:

           * The design of the monitoring activities, for example whether it is periodic or ongoing monitoring;

           * The performance and frequency of the monitoring activities;

           * The evaluation of the results of the monitoring activities, on a timely basis, to determine whether the controls have been effective; and

           * How identified deficiencies have been addressed through appropriate remedial actions, including timely communication of such deficiencies to those responsible for taking remedial action.

A117.      The auditor may also consider how the entity's process to monitor the system of internal control addresses monitoring information processing controls that involve the use of IT.  This may include, for example:

           * Controls to monitor complex IT environments that:

                   + Evaluate the continuing design effectiveness of information processing controls and modify them, as appropriate, for changes in conditions; or

                   + Evaluate the operating effectiveness of information processing controls.

           * Controls that monitor the permissions applied in automated information processing controls that enforce the segregation of duties.

           * Controls that monitor how errors or control deficiencies related to the automation of financial reporting are identified and addressed.

Understanding the entity's internal audit function (Ref: Para. 24(a)(ii))
Appendix 4 sets out further considerations for understanding the entity's internal audit function.

A118.      The auditor's enquiries of appropriate individuals within the internal audit function help the auditor obtain an understanding of the nature of the internal audit function's responsibilities.  If the auditor determines that the function's responsibilities are related to the entity's financial reporting, the auditor may obtain further understanding of the activities performed, or to be performed, by the internal audit function by reviewing the internal audit function's audit plan for the period, if any, and discussing that plan with the appropriate individuals within the function.  This understanding, together with the information obtained from the auditor's enquiries, may also provide information that is directly relevant to the auditor's identification and assessment of the risks of material misstatement.  If, based on the auditor's preliminary understanding of the internal audit function, the auditor expects to use the work of the internal audit function to modify the nature or timing, or reduce the extent, of audit procedures to be performed, ASA 610[37] applies.

Other sources of information used