Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p31
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 31/47)
Character Range: 97322–100404

risks for which substantive procedures alone do not provide sufficient appropriate audit evidence, as required by paragraphs 29 and 30, respectively; or

           * Those that are considered to be relevant in the judgement of the auditor.

A101.      The auditor's judgement about whether a control activity is relevant to the audit is influenced by the risk that the auditor has identified that may give rise to a material misstatement and whether the auditor thinks it is likely to be appropriate to test the operating effectiveness of the control in determining the extent of substantive testing.

A102.      The auditor's emphasis may be on identifying and obtaining an understanding of control activities that address the areas where the auditor considers that risks of material misstatement are likely to be higher.  When multiple control activities each achieve the same objective, it is unnecessary to obtain an understanding of each of the control activities related to such objective.

A103.      Control activities relevant to the audit may include controls established by management that address risks of material misstatement related to disclosures not being prepared in accordance with the applicable financial reporting framework, in addition to controls that address risks related to account balances and transactions.  Such control activities may relate to information included in the financial report that is obtained from outside of the general and subsidiary ledgers.

A104.      The auditor's knowledge about the presence or absence of control activities obtained from the understanding of the other components of internal control assists the auditor in determining whether it is necessary to devote additional attention to obtaining an understanding of control activities.

Considerations Specific to Smaller Entities

A105.      The concepts underlying control activities in small entities are likely to be similar to those in larger entities, but the formality with which they operate may vary.  Further, small entities may find that certain types of control activities are not relevant because of controls applied by management.  For example, management's sole authority for granting credit to customers and approving significant purchases can provide strong control over important account balances and transactions, lessening or removing the need for more detailed control activities.

A106.      Control activities relevant to the audit of a smaller entity are likely to relate to the main transaction cycles such as revenues, purchases and employment expenses.

Risks Arising From IT (Ref: Para. 21)

A107.      The use of IT affects the way that control activities are implemented.  From the auditor's perspective, controls over IT systems are effective when they maintain the integrity of information and the security of the data such systems process, and include effective general IT‑controls and application controls.

A108.      General IT‑controls are policies and procedures that relate to many applications and support the effective functioning