Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p20
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 20/47)
Character Range: 64860–68044

review, there may be an increased risk of misstatements not being detected and corrected.

The Entity's Internal Control (Ref: Para. 12)

A50.         An understanding of internal control assists the auditor in identifying types of potential misstatements and factors that affect the risks of material misstatement, and in designing the nature, timing, and extent of further audit procedures.

A51.         The following application material on internal control is presented in four sections, as follows:

           * General Nature and Characteristics of Internal Control.

           * Controls Relevant to the Audit.

           * Nature and Extent of the Understanding of Relevant Controls.

           * Components of Internal Control.

General Nature and Characteristics of Internal Control

Purpose of Internal Control

A52.         Internal control is designed, implemented and maintained to address identified business risks that threaten the achievement of any of the entity's objectives that concern:

           * The reliability of the entity's financial reporting;

           * The effectiveness and efficiency of its operations; and

           * Its compliance with applicable laws and regulations.

    The way in which internal control is designed, implemented and maintained varies with an entity's size and complexity.

Considerations specific to smaller entities

A53.         Smaller entities may use less structured means and simpler processes and procedures to achieve their objectives.

Limitations of Internal Control

A54.         Internal control, no matter how effective, can provide an entity with only reasonable assurance about achieving the entity's financial reporting objectives.  The likelihood of their achievement is affected by the inherent limitations of internal control.  These include the realities that human judgement in decision‑making can be faulty and that breakdowns in internal control can occur because of human error.  For example, there may be an error in the design of, or in the change to, a control.  Equally, the operation of a control may not be effective, such as where information produced for the purposes of internal control (for example, an exception report) is not effectively used because the individual responsible for reviewing the information does not understand its purpose or fails to take appropriate action.

A55.         Additionally, controls can be circumvented by the collusion of two or more people or inappropriate management override of internal control.  For example, management may enter into side agreements with customers that alter the terms and conditions of the entity's standard sales contracts, which may result in improper revenue recognition.  Also, edit checks in a software program that are designed to identify and report transactions that exceed specified credit limits may be overridden or disabled.

A56.         Further, in designing and implementing controls, management may make judgements on the nature and extent of the controls it chooses to implement, and the nature and extent of the risks it chooses to assume.

Considerations specific to smaller entities

A57.         Smaller