Document ID: chunk:federal_register_of_legislation:F2021C01264:body:0:p7
Version: federal_register_of_legislation:F2021C01264
Segment Type: other
Provision Reference: 
Character Range: 18137–21539

the financial reporting process; for example:

                   + General monitoring controls (such as oversight of management).

                   + Controls over the prevention and detection of fraud.

                   + Controls over the selection and application of significant accounting policies.

                   + Controls over significant transactions with related parties.

                   + Controls over significant transactions outside the entity's normal course of business.

                   + Controls over the period‑end financial reporting process (such as controls over non‑recurring journal entries).

           * The cause and frequency of the exceptions detected as a result of the deficiencies in the controls.

           * The interaction of the deficiency with other deficiencies in internal control.

A7.             Indicators of significant deficiencies in internal control include, for example:

           * Evidence of ineffective aspects of the control environment, such as:

                   + Indications that significant transactions in which management is financially interested are not being appropriately scrutinised by those charged with governance.

                   + Identification of management fraud, whether or not material, that was not prevented by the entity's internal control.

                   + Management's failure to implement appropriate remedial action on significant deficiencies previously communicated.

           * Absence of a risk assessment process within the entity where such a process would ordinarily be expected to have been established.

           * Evidence of an ineffective entity risk assessment process, such as management's failure to identify a risk of material misstatement that the auditor would expect the entity's risk assessment process to have identified.

           * Evidence of an ineffective response to identified significant risks (for example, absence of controls over such a risk).

           * Misstatements detected by the auditor's procedures that were not prevented, or detected and corrected, by the entity's internal control.

           * Restatement of a previously issued financial report to reflect the correction of a material misstatement due to error or fraud.

           * Evidence of management's inability to oversee the preparation of the financial reports.

A8.             Controls may be designed to operate individually or in combination to effectively prevent, or detect and correct, misstatements.[5]  For example, controls over accounts receivable may consist of both automated and manual controls designed to operate together to prevent, or detect and correct, misstatements in the account balance.  A deficiency in internal control on its own may not be sufficiently important to constitute a significant deficiency.  However, a combination of deficiencies affecting the same account balance or disclosure, assertion, or component of the entity's system of internal control may increase the risks of misstatement to such an extent as to give rise to a significant deficiency.

A9.             Law or regulation in some jurisdictions may establish a requirement (particularly for audits of listed entities) for the auditor to communicate to those charged with governance or to other relevant parties (such as regulators) one or more specific types of deficiency