Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p51
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 150534–153590

with ASA 330,[42] to design and perform tests of controls that address such risks of material misstatement when substantive procedures alone do not provide sufficient appropriate audit evidence at the assertion level.  As a result, when such controls exist that address these risks, they are required to be identified and evaluated.

A163.      In other cases, when the auditor plans to take into account the operating effectiveness of controls in determining the nature, timing and extent of substantive procedures in accordance with ASA 330, such controls are also required to be identified because ASA 330[43] requires the auditor to design and perform tests of those controls.
Examples:

The auditor may plan to test the operating effectiveness of controls:

      * Over routine classes of transactions because such testing may be more effective or efficient for large volumes of homogenous transactions.

      * Over the completeness and accuracy of information produced by the entity (e.g., controls over the preparation of system-generated reports), to determine the reliability of that information, when the auditor intends to take into account the operating effectiveness of those controls in designing and performing further audit procedures.

      * Relating to operations and compliance objectives when they relate to data the auditor evaluates or uses in applying audit procedures.

A164.      The auditor's plans to test the operating effectiveness of controls may also be influenced by the identified risks of material misstatement at the financial report level.  For example, if deficiencies are identified related to the control environment, this may affect the auditor's overall expectations about the operating effectiveness of direct controls.

Other controls that the auditor considers appropriate (Ref: Para. 26(a)(iv))

A165.      Other controls that the auditor may consider are appropriate to identify, and evaluate the design and determine the implementation, may include:

           * Controls that address risks assessed as higher on the spectrum of inherent risk but have not been determined to be a significant risk;

           * Controls related to reconciling detailed records to the general ledger; or

           * Complementary user entity controls, if using a service organisation.[44]

Identifying IT applications and other aspects of the IT environment, risks arising from the use of IT and general IT controls (Ref: Para. 26(b)‒(c))
Appendix 5 includes example characteristics of IT applications and other aspects of the IT environment, and guidance related to those characteristics, that may be relevant in identifying IT applications and other aspects of the IT environment subject to risks arising from the use of IT.

Identifying IT applications and other aspects of the IT environment (Ref: Para. 26(b))

Why the auditor identifies risks arising from the use of IT and general IT controls related to identified IT applications and other aspects of the IT environment

A166.      Understanding the risks