Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p36
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 107469–110525

and the entity's process to monitor the system of internal control

A97.         The control environment provides an overall foundation for the operation of the other components of the system of internal control.  The control environment does not directly prevent, or detect and correct, misstatements.  It may, however, influence the effectiveness of controls in the other components of the system of internal control.  Similarly, the entity's risk assessment process and its process for monitoring the system of internal control are designed to operate in a manner that also supports the entire system of internal control.

A98.         Because these components are foundational to the entity's system of internal control, any deficiencies in their operation could have pervasive effects on the preparation of the financial report.  Therefore, the auditor's understanding and evaluations of these components affect the auditor's identification and assessment of risks of material misstatement at the financial report level, and may also affect the identification and assessment of risks of material misstatement at the assertion level.  Risks of material misstatement at the financial report level affect the auditor's design of overall responses, including, as explained in ASA 330, an influence on the nature, timing and extent of the auditor's further procedures.[35]

Obtaining an understanding of the control environment (Ref: Para. 21)

Scalability

A99.         The nature of the control environment in a less complex entity is likely to be different from the control environment in a more complex entity.  For example, those charged with governance in less complex entities may not include an independent or outside member, and the role of governance may be undertaken directly by the owner-manager where there are no other owners.  Accordingly, some considerations about the entity's control environment may be less relevant or may not be applicable.

A100.      In addition, audit evidence about elements of the control environment in less complex entities may not be available in documentary form, in particular where communication between management and other personnel is informal, but the evidence may still be appropriately relevant and reliable in the circumstances.
Examples:

      * The organisational structure in a less complex entity will likely be simpler and may include a small number of employees involved in roles related to financial reporting.

      * If the role of governance is undertaken directly by the owner-manager, the auditor may determine that the independence of those charged with governance is not relevant.

      * Less complex entities may not have a written code of conduct but, instead, develop a culture that emphasises the importance of integrity and ethical behaviour through oral communication and by management example.  Consequently, the attitudes, awareness and actions of management or the owner-manager are of particular importance to the auditor's understanding of a less complex entity's control