Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p48
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 142190–145349

address a risk of material misstatement at the assertion level.

A151.      The controls that the auditor is required to identify and evaluate the design, and determine the implementation of, in accordance with paragraph 26 are those:

           * Controls which the auditor plans to test the operating effectiveness of in determining the nature, timing and extent of substantive procedures.  The evaluation of such controls provides the basis for the auditor's design of test of control procedures in accordance with ASA 330.  These controls also include controls that address risks for which substantive procedures alone do not provide sufficient appropriate audit evidence.

           * Controls include controls that address significant risks and controls over journal entries.  The auditor's identification and evaluation of such controls may also influence the auditor's understanding of the risks of material misstatement, including the identification of additional risks of material misstatement (see paragraph A95).  This understanding also provides the basis for the auditor's design of the nature, timing and extent of substantive audit procedures that are responsive to the related assessed risks of material misstatement.

           * Other controls that the auditor considers are appropriate to enable the auditor to meet the objectives of paragraph 13 with respect to risks at the assertion level, based on the auditor's professional judgement.

A152.      Controls in the control activities component are required to be identified when such controls meet one or more of the criteria included in paragraph 26(a).  However, when multiple controls each achieve the same objective, it is unnecessary to identify each of the controls related to such objective.

Types of controls in the control activities component (Ref: Para. 26)

A153.      Examples of controls in the control activities component include authorisations and approvals, reconciliations, verifications (such as edit and validation checks or automated calculations), segregation of duties, and physical or logical controls, including those addressing safeguarding of assets.

A154.      Controls in the control activities component may also include controls established by management that address risks of material misstatement related to disclosures not being prepared in accordance with the applicable financial reporting framework.  Such controls may relate to information included in the financial report that is obtained from outside of the general and subsidiary ledgers.

A155.      Regardless of whether controls are within the IT environment or manual systems, controls may have various objectives and may be applied at various organisational and functional levels.

Scalability (Ref: Para. 26)

A156.      Controls in the control activities component for less complex entities are likely to be similar to those in larger entities, but the formality with which they operate may vary.  Further, in less complex entities, more controls may be directly applied by management.
Example:

Management's sole authority for granting credit to customers and approving significant