Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p40
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 40/47)
Character Range: 123600–126676

internal or external legal counsel), whether an assessment has been made of the potential effect, and how it is proposed that the circumstances are to be disclosed in the financial report.

A147.      In some cases, management may not have appropriately responded to significant risks of material misstatement by implementing controls over these significant risks.  Failure by management to implement such controls is an indicator of a significant deficiency in internal control.[22]

Risks for Which Substantive Procedures Alone Do Not Provide Sufficient Appropriate Audit Evidence (Ref: Para. 30)

A148.      Risks of material misstatement may relate directly to the recording of routine classes of transactions or account balances, and the preparation of a reliable financial report.  Such risks may include risks of inaccurate or incomplete processing for routine and significant classes of transactions such as an entity's revenue, purchases, and cash receipts or cash payments.

A149.      Where such routine business transactions are subject to highly automated processing with little or no manual intervention, it may not be possible to perform only substantive procedures in relation to the risk.  For example, the auditor may consider this to be the case in circumstances where a significant amount of an entity's information is initiated, recorded, processed, or reported only in electronic form such as in an integrated system.  In such cases:

           * Audit evidence may be available only in electronic form, and its sufficiency and appropriateness usually depend on the effectiveness of controls over its accuracy and completeness.

           * The potential for improper initiation or alteration of information to occur and not be detected may be greater if appropriate controls are not operating effectively.

A150.      The consequences for further audit procedures of identifying such risks are described in ASA 330.[23]

Revision of Risk Assessment (Ref: Para. 31)

A151.      During the audit, information may come to the auditor's attention that differs significantly from the information on which the risk assessment was based.  For example, the risk assessment may be based on an expectation that certain controls are operating effectively.  In performing tests of those controls, the auditor may obtain audit evidence that they were not operating effectively at relevant times during the audit.  Similarly, in performing substantive procedures the auditor may detect misstatements in amounts or frequency greater than is consistent with the auditor's risk assessments.  In such circumstances, the risk assessment may not appropriately reflect the true circumstances of the entity and the further planned audit procedures may not be effective in detecting material misstatements.  See ASA 330 for further guidance.

Documentation (Ref: Para. 32)

A152.      The manner in which the requirements of paragraph 32 are documented is for the auditor to determine using professional judgement.  For example, in audits of small entities the documentation