Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p43
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 127589–130814

activities.  This information, and the information obtained from the auditor's evaluation of the information system may confirm or further influence the auditor's expectations about the significant classes of transactions, account balances and disclosures initially identified (see paragraph A126).

A128.      In obtaining an understanding of how information relating to significant classes of transactions, account balances and disclosures flows into, through, and out of the entity's information system, the auditor may also identify controls in the control activities component that are required to be identified in accordance with paragraph 26(a).  The auditor's identification and evaluation of controls in the control activities component may first focus on controls over journal entries and controls that the auditor plans to test the operating effectiveness of in designing the nature, timing and extent of substantive procedures.

A129.      The auditor's assessment of inherent risk may also influence the identification of controls in the control activities component.  For example, the auditor's identification of controls relating to significant risks may only be identifiable when the auditor has assessed inherent risk at the assertion level in accordance with paragraph 31.  Furthermore, controls addressing risks for which the auditor has determined that substantive procedures alone do not provide sufficient appropriate audit evidence (in accordance with paragraph 33) may also only be identifiable once the auditor's inherent risk assessments have been undertaken.

A130.      The auditor's identification and assessment of risks of material misstatement at the assertion level is influenced by both the auditor's:

           * Understanding of the entity's policies for its information processing activities in the information system and communication component, and

           * Identification and evaluation of controls in the control activities component.

Obtaining an understanding of the information system and communication (Ref: Para. 25)
Appendix 3, Paragraphs 15–19, sets out further considerations relating to the information system and communication.

Scalability

A131.      The information system, and related business processes, in less complex entities are likely to be less sophisticated than in larger entities, and are likely to involve a less complex IT environment; however, the role of the information system is just as important.  Less complex entities with direct management involvement may not need extensive descriptions of accounting procedures, sophisticated accounting records, or written policies.  Understanding the relevant aspects of the entity's information system may therefore require less effort in an audit of a less complex entity, and may involve a greater amount of enquiry than observation or inspection of documentation.  The need to obtain an understanding, however, remains important to provide a basis for the design of further audit procedures in accordance with ASA 330 and may further assist the auditor in identifying or assessing risks of material misstatement (see paragraph A86).

Obtaining an understanding of the information system (Ref: Para.