Document ID: chunk:federal_register_of_legislation:F2020L00252:body:0:p25
Version: federal_register_of_legislation:F2020L00252
Segment Type: other
Provision Reference: 
Character Range: 70365–73319

effective operation of indirect controls (e.g., general IT controls). As explained in paragraphs A29 to A29b, general IT controls may have been identified in accordance with ASA 315 because of their support of the operating effectiveness of automated controls or due to their support in maintaining the integrity of information used in the entity's financial reporting, including system-generated reports. The requirement in paragraph 10(b) acknowledges that the auditor may have already tested certain indirect controls to address the matters in paragraph 10(a). For example, when the auditor decides to test the effectiveness of a user review of exception reports detailing sales in excess of authorised credit limits, the user review and related follow up is the control that is directly of relevance to the auditor.  Controls over the accuracy of the information in the reports (for example, general IT controls) are described as "indirect" controls.

94.               Existing paragraph A31 has been deleted.

95.               Existing paragraph A32 has been amended to read as follows:

Audit evidence pertaining only to a point in time may be sufficient for the auditor's purpose, for example, when testing controls over the entity's physical inventory counting at the period end.  If, on the other hand, the auditor intends to rely on a control over a period, tests that are capable of providing audit evidence that the control operated effectively at relevant times during that period are appropriate.  Such tests may include tests of controls in the entity's process to monitoring of the system of internal controls.

96.               Existing paragraph A35 has been amended to read as follows:

In certain circumstances, audit evidence obtained from previous audits may provide audit evidence where the auditor performs audit procedures to establish its continuing relevance and reliability.  For example, in performing a previous audit, the auditor may have determined that an automated control was functioning as intended.  The auditor may obtain audit evidence to determine whether changes to the automated control have been made that affect its continued effective functioning through, for example, enquiries of management and the inspection of logs to indicate what controls have been changed.  Consideration of audit evidence about these changes may support either increasing or decreasing the expected audit evidence to be obtained in the current period about the operating effectiveness of the controls.

97.               Existing paragraph A36 has been amended to read as follows:

Changes may affect the relevance and reliability of the audit evidence obtained in previous audits such that there may no longer be a basis for continued reliance.  For example, changes in a system that enable an entity to receive a new report from the system probably do not affect the relevance of audit evidence from a previous audit; however, a