Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p45
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 45/47)
Character Range: 138610–141979

over access to assets and records.

                   + The authorisation for access to computer programs and data files.

                   + The periodic counting and comparison with amounts shown on control records (for example comparing the results of cash, security and inventory counts with accounting records).

         The extent to which physical controls intended to prevent theft of assets are relevant to the reliability of financial report preparation, and therefore the audit, depends on circumstances such as when assets are highly susceptible to misappropriation.

           * Segregation of duties.  Assigning different people the responsibilities of authorising transactions, recording transactions, and maintaining custody of assets.  Segregation of duties is intended to reduce the opportunities to allow any person to be in a position to both perpetrate and conceal errors or fraud in the normal course of the person's duties.

10.               Certain control activities may depend on the existence of appropriate higher level policies established by management or those charged with governance.  For example, authorisation controls may be delegated under established guidelines, such as investment criteria set by those charged with governance; alternatively, non‑routine transactions such as major acquisitions or divestments may require specific high level approval, including in some cases that of shareholders.

Monitoring of Controls

11.               An important management responsibility is to establish and maintain internal control on an ongoing basis.  Management's monitoring of controls includes considering whether they are operating as intended and that they are modified as appropriate for changes in conditions.  Monitoring of controls may include activities such as management's review of whether bank reconciliations are being prepared on a timely basis, internal auditors' evaluation of sales personnel's compliance with the entity's policies on terms of sales contracts, and a legal department's oversight of compliance with the entity's ethical or business practice policies.  Monitoring is done also to ensure that controls continue to operate effectively over time.  For example, if the timeliness and accuracy of bank reconciliations are not monitored, personnel are likely to stop preparing them.

12.               Internal auditors or personnel performing similar functions may contribute to the monitoring of an entity's controls through separate evaluations.  Ordinarily, they regularly provide information about the functioning of internal control, focusing considerable attention on evaluating the effectiveness of internal control, and communicate information about strengths and deficiencies in internal control and recommendations for improving internal control.

13.               Monitoring activities may include using information from communications from external parties that may indicate problems or highlight areas in need of improvement.  Customers implicitly corroborate billing data by paying their invoices or complaining about their charges.  In addition, regulators may communicate with the entity concerning matters that affect the functioning of internal control, for example, communications concerning examinations by bank regulatory agencies.  Also, management may consider communications