Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p44
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 130556–133870

a basis for the design of further audit procedures in accordance with ASA 330 and may further assist the auditor in identifying or assessing risks of material misstatement (see paragraph A86).

Obtaining an understanding of the information system (Ref: Para. 25(a))

A132.      Included within the entity's system of internal control are aspects that relate to the entity's reporting objectives, including its financial reporting objectives, but may also include aspects that relate to its operations or compliance objectives, when such aspects are relevant to financial reporting.  Understanding how the entity initiates transactions and captures information as part of the auditor's understanding of the information system may include information about the entity's systems (its policies) designed to address compliance and operations objectives because such information is relevant to the preparation of the financial report.  Further, some entities may have information systems that are highly integrated such that controls may be designed in a manner to simultaneously achieve financial reporting, compliance and operational objectives, and combinations thereof.

A133.      Understanding the entity's information system also includes an understanding of the resources to be used in the entity's information processing activities.  Information about the human resources involved that may be relevant to understanding risks to the integrity of the information system include:

           * The competence of the individuals undertaking the work;

           * Whether there are adequate resources; and

           * Whether there is appropriate segregation of duties.

A134.      Matters the auditor may consider when understanding the policies that define the flows of information relating to the entity's significant classes of transactions, account balances, and disclosures in the information system and communication component include the nature of:

(a)                The data or information relating to transactions, other events and conditions to be processed;

(b)                The information processing to maintain the integrity of that data or information; and

(c)                The information processes, personnel and other resources used in the information processing process.

A135.      Obtaining an understanding of the entity's business processes, which include how transactions are originated, assists the auditor in obtaining an understanding of the entity's information system in a manner that is appropriate to the entity's circumstances.

A136.      The auditor's understanding of the information system may be obtained in various ways and may include:

           * Enquiries of relevant personnel about the procedures used to initiate, record, process and report transactions or about the entity's financial reporting process;

           * Inspection of policy or process manuals or other documentation of the entity's information system;

           * Observation of the performance of the policies or procedures by entity's personnel; or

           * Selecting transactions and tracing them through the applicable process in the information system (i.e., performing a walk-through).

Automated tools and techniques

A137.      The auditor may also use automated techniques to