Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p11
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 32862–37572

in the financial report;

         (ii)               The accounting records, specific accounts in the financial report and other supporting records relating to the flows of information in the information system;

         (iii)             The financial reporting process used to prepare the entity's financial report, including disclosures; and

         (iv)             The entity's resources, including the IT environment, relevant to (a)(i) to (a)(iii) above;

    (b)                Understanding how the entity communicates significant matters that support the preparation of the financial report and related reporting responsibilities in the information system and other components of the system of internal control: (Ref: Para. A144‒A145)

         (i)                 Between people within the entity, including how financial reporting roles and responsibilities are communicated;

         (ii)               Between management and those charged with governance; and

         (iii)             With external parties, such as those with regulatory authorities;

Control activities
26.               The auditor shall obtain an understanding of the control activities component, through performing risk assessment procedures, by: (Ref: Para. A147–A157)
    (a)                Identifying controls that address risks of material misstatement at the assertion level in the control activities component as follows:                                                                                                                                                                                 and
                                                                                                                                                                                                                                                                                                                                                   (d)                For each control identified in (a) or (c)(ii): (Ref: Para. A175‒A181)
         (i)                 Controls that address a risk that is determined to be a significant risk; (Ref: Para. A158‒A159)
                                                                                                                                                                                                                                                                                                                                                        (i)                 Evaluating whether the control is designed effectively to address the risk of material misstatement at the assertion level, or effectively designed to support the operation of other controls; and
         (ii)               Controls over journal entries, including non-standard journal entries used to record non-recurring, unusual transactions or adjustments; (Ref: Para. A160‒A161)
                                                                                                                                                                                                                                                                                                                                                        (ii)               Determining whether the control has been implemented by performing procedures in addition to enquiry of the entity's personnel.
         (iii)             Controls for which the auditor plans to test operating effectiveness in determining the nature, timing and extent of substantive testing, which shall include controls that address risks for which substantive procedures alone do not provide sufficient appropriate audit evidence; and (Ref: Para. A162‒A164)

         (iv)             Other controls that the auditor considers are appropriate to enable the auditor to meet the objectives of paragraph 13 with respect to risks at the assertion level, based on the auditor's professional judgement; (Ref: Para. A165)

    (b)                Based on controls identified in (a), identifying the IT applications and the other aspects of the entity's IT environment that are subject to risks arising from the use of IT; (Ref: Para. A166‒A172)

    (c)                For such IT applications and other aspects of the IT environment identified in (b), identifying: (Ref: Para. A173‒A174)

         (i)                 The related risks arising from the use of IT; and

         (ii)               The entity's general IT controls that address such risks.

Control Deficiencies Within the Entity's System of Internal Control

27.               Based on the auditor's evaluation of each of the components of the entity's system of internal