Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p86
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 256564–259684

example above, if the salesperson can modify product price files, a detective control activity can be put in place to have personnel unrelated to the sales function periodically review whether and under what circumstances the salesperson changed prices.

21.               Certain controls may depend on the existence of appropriate supervisory controls established by management or those charged with governance.  For example, authorisation controls may be delegated under established guidelines, such as investment criteria set by those charged with governance; alternatively, non-routine transactions such as major acquisitions or divestments may require specific high-level approval, including in some cases that of shareholders.

Limitations of Internal Control

22.               The entity's system of internal control, no matter how effective, can provide an entity with only reasonable assurance about achieving the entity's financial reporting objectives.  The likelihood of their achievement is affected by the inherent limitations of internal control.  These include the realities that human judgement in decision-making can be faulty and that breakdowns in the entity's system of internal control can occur because of human error.  For example, there may be an error in the design of, or in the change to, a control.  Equally, the operation of a control may not be effective, such as where information produced for the purposes of the entity's system of internal control (for example, an exception report) is not effectively used because the individual responsible for reviewing the information does not understand its purpose or fails to take appropriate action.

23.               Additionally, controls can be circumvented by the collusion of two or more people or inappropriate management override of controls.  For example, management may enter into side agreements with customers that alter the terms and conditions of the entity's standard sales contracts, which may result in improper revenue recognition.  Also, edit checks in an IT application that are designed to identify and report transactions that exceed specified credit limits may be overridden or disabled.

24.               Further, in designing and implementing controls, management may make judgements on the nature and extent of the controls it chooses to implement, and the nature and extent of the risks it chooses to assume.

Appendix 4

(Ref: Para. 14(a), 24(a)(ii), A25‒A28, A118)

Considerations for Understanding an Entity's Internal Audit Function

This appendix provides further considerations relating to understanding the entity's internal audit function when such a function exists.

Objectives and Scope of the Internal Audit Function

      1. The objectives and scope of an internal audit function, the nature of its responsibilities and its status within the organisation, including the function's authority and accountability, vary widely and depend on the size, complexity and structure of the entity and the requirements of management and, where applicable, those charged with governance.  These matters may be set