Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p24
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 24/47)
Character Range: 76591–79709

to operations and compliance objectives may also be relevant to an audit if they relate to data the auditor evaluates or uses in applying audit procedures.

A71.         Internal control over safeguarding of assets against unauthorised acquisition, use, or disposition may include controls relating to both financial reporting and operations objectives.  The auditor's consideration of such controls is generally limited to those relevant to the reliability of financial reporting.

A72.         An entity generally has controls relating to objectives that are not relevant to an audit and therefore need not be considered.  For example, an entity may rely on a sophisticated system of automated controls to provide efficient and effective operations (such as an airline's system of automated controls to maintain flight schedules), but these controls ordinarily would not be relevant to the audit.  Further, although internal control applies to the entire entity or to any of its operating units or business processes, an understanding of internal control relating to each of the entity's operating units and business processes may not be relevant to the audit.

Considerations Specific to Public Sector Entities

A73.         Public sector auditors often have additional responsibilities with respect to internal control, for example to report on compliance with an established Code of Practice.  Public sector auditors can also have responsibilities to report on the compliance with law, regulation or other authority.  As a result, their review of internal control may be broader and more detailed.

Nature and Extent of the Understanding of Relevant Controls (Ref: Para. 13)

A74.         Evaluating the design of a control involves considering whether the control, individually or in combination with other controls, is capable of effectively preventing, or detecting and correcting, material misstatements.  Implementation of a control means that the control exists and that the entity is using it.  There is little point in assessing the implementation of a control that is not effective, and so the design of a control is considered first.  An improperly designed control may represent a significant deficiency in internal control.

A75.         Risk assessment procedures to obtain audit evidence about the design and implementation of relevant controls may include:

           * Enquiring of entity personnel.

           * Observing the application of specific controls.

           * Inspecting documents and reports.

           * Tracing transactions through the information system relevant to financial reporting.

           * Enquiry alone, however, is not sufficient for such purposes.

A76.         Obtaining an understanding of an entity's controls is not sufficient to test their operating effectiveness, unless there is some automation that provides for the consistent operation of the controls.  For example, obtaining audit evidence about the implementation of a manual control at a point in time does not provide audit evidence about the operating effectiveness of the control at other times