Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p35
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 104662–107736

regulation or other authority.  As a result, their considerations about the system of internal control may be broader and more detailed.

Information Technology in the Components of the Entity's System of Internal Control
Appendix 5 provides further guidance on understanding the entity's use of IT in the components of the system of internal control.

A94.         The overall objective and scope of an audit does not differ whether an entity operates in a mainly manual environment, a completely automated environment, or an environment involving some combination of manual and automated elements (i.e., manual and automated controls and other resources used in the entity's system of internal control).

Understanding the Nature of the Components of the Entity's System of Internal Control

A95.         In evaluating the effectiveness of the design of controls and whether they have been implemented (see paragraphs A175 to A181) the auditor's understanding of each of the components of the entity's system of internal control provides a preliminary understanding of how the entity identifies business risks and how it responds to them.  It may also influence the auditor's identification and assessment of the risks of material misstatement in different ways (see paragraph A86).  This assists the auditor in designing and performing further audit procedures, including any plans to test the operating effectiveness of controls.  For example:

           * The auditor's understanding of the entity's control environment, the entity's risk assessment process, and the entity's process to monitor controls components are more likely to affect the identification and assessment of risks of material misstatement at the financial report level.

           * The auditor's understanding of the entity's information system and communication, and the entity's control activities component, are more likely to affect the identification and assessment of risks of material misstatement at the assertion level.

Control Environment, The Entity's Risk Assessment Process and the Entity's Process to Monitor the System of Internal Control (Ref: Para. 21–24)

A96.         The controls in the control environment, the entity's risk assessment process and the entity's process to monitor the system of internal control are primarily indirect controls (i.e., controls that are not sufficiently precise to prevent, detect or correct misstatements at the assertion level but which support other controls and may therefore have an indirect effect on the likelihood that a misstatement will be detected or prevented on a timely basis).  However, some controls within these components may also be direct controls.

Why the auditor is required to understand the control environment, the entity's risk assessment process and the entity's process to monitor the system of internal control

A97.         The control environment provides an overall foundation for the operation of the other components of the system of internal control.  The control environment does not directly prevent, or