Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p38
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 113101–116252

such concentration of knowledge and authority can also lead to an increased susceptibility to misstatement through management override of controls.

A106.      The auditor may consider how the different elements of the control environment may be influenced by the philosophy and operating style of senior management taking into account the involvement of independent members of those charged with governance.

A107.      Although the control environment may provide an appropriate foundation for the system of internal control and may help reduce the risk of fraud, an appropriate control environment is not necessarily an effective deterrent to fraud.
Example:

Human resource policies and procedures directed toward hiring competent financial, accounting, and IT personnel may mitigate the risk of errors in processing and recording financial information.  However, such policies and procedures may not mitigate the override of controls by senior management (e.g., to overstate earnings).

A108.      The auditor's evaluation of the control environment as it relates to the entity's use of IT may include such matters as:

           * Whether governance over IT is commensurate with the nature and complexity of the entity and its business operations enabled by IT, including the complexity or maturity of the entity's technology platform or architecture and the extent to which the entity relies on IT applications to support its financial reporting.

           * The management organisational structure regarding IT and the resources allocated (for example, whether the entity has invested in an appropriate IT environment and necessary enhancements, or whether a sufficient number of appropriately skilled individuals have been employed including when the entity uses commercial software (with no or limited modifications)).

Obtaining an understanding of the entity's risk assessment process (Ref: Para. 22–23)

Understanding the entity's risk assessment process (Ref: Para. 22(a))

A109.      As explained in paragraph A62, not all business risks give rise to risks of material misstatement.  In understanding how management and those charged with governance have identified business risks relevant to the preparation of the financial report, and decided about actions to address those risks, matters the auditor may consider include how management or, as appropriate, those charged with governance, has:

           * Specified the entity's objectives with sufficient precision and clarity to enable the identification and assessment of the risks relating to the objectives;

           * Identified the risks to achieving the entity's objectives and analysed the risks as a basis for determining how the risks should be managed; and

           * Considered the potential for fraud when considering the risks to achieving the entity's objectives.[36]

A110.      The auditor may consider the implications of such business risks for the preparation of the entity's financial report and other aspects of its system of internal control.

Evaluating the entity's risk assessment process (Ref: Para. 22(b))

Why the auditor evaluates whether