Document ID: chunk:federal_register_of_legislation:F2022C01152:reg:4:p36
Version: federal_register_of_legislation:F2022C01152
Segment Type: reg
Provision Reference: reg 4 (pt 36/63)
Character Range: 115461–118616

for bonuses that are paid to employees shortly after period end. In this situation, it may be more practical for the auditor to obtain sufficient appropriate audit evidence by evaluating events occurring up to the date of the auditor's report, rather than through other testing approaches.

           * The reasons for the assessed risks of material misstatement.

When the Auditor Intends to Rely on the Operating Effectiveness of Controls (Ref: Para: 19)

A85.         Testing the operating effectiveness of controls may be appropriate when inherent risk is assessed as higher on the spectrum of inherent risk, including for significant risks. This may be the case when the accounting estimate is subject to or affected by a high degree of complexity. When the accounting estimate is affected by a high degree of subjectivity, and therefore requires significant judgement by management, inherent limitations in the effectiveness of the design of controls may lead the auditor to focus more on substantive procedures than on testing the operating effectiveness of controls.

A86.         In determining the nature, timing and extent of testing of the operating effectiveness of controls relating to accounting estimates, the auditor may consider factors such as:

           * The nature, frequency and volume of transactions;

           * The effectiveness of the design of the controls, including whether controls are appropriately designed to respond to the assessed inherent risk, and the strength of governance;

           * The importance of particular controls to the overall control objectives and processes in place at the entity, including the sophistication of the information system to support transactions;

           * The monitoring of controls and identified deficiencies in internal control;

           * The nature of the risks the controls are intended to address, for example, controls related to the exercise of judgement compared with controls over supporting data;

           * The competency of those involved in the control activities;

           * The frequency of performance of the control activities; and

           * The evidence of performance of control activities.

Substantive Procedures Alone Cannot Provide Sufficient Appropriate Audit Evidence

A87.         In some industries, such as the financial services industry, management makes extensive use of IT to conduct business. It may therefore be more likely that there are risks related to certain accounting estimates for which substantive procedures alone cannot provide sufficient appropriate audit evidence.

A88.         Circumstances when risks for which substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level may exist include:

           * When controls are necessary to mitigate risks relating to the initiation, recording, processing, or reporting of information obtained from outside of the general and subsidiary ledgers.

           * Information supporting one or more assertions is electronically initiated, recorded, processed, or reported. This is likely to be the case when there is a high