Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p56
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 163686–166861

controls is higher and management is placing greater reliance on those controls for effective processing of transactions or the effective maintenance of the integrity of underlying information.

Evaluating the design, and determining implementation, of identified controls in the control activities component (Ref: Para 26(d))

A175.      Evaluating the design of an identified control involves the auditor's consideration of whether the control, individually or in combination with other controls, is capable of effectively preventing, or detecting and correcting, material misstatements (i.e., the control objective).

A176.      The auditor determines the implementation of an identified control by establishing that the control exists and that the entity is using it.  There is little point in the auditor assessing the implementation of a control that is not designed effectively.  Therefore, the auditor evaluates the design of a control first.  An improperly designed control may represent a control deficiency.

A177.      Risk assessment procedures to obtain audit evidence about the design and implementation of identified controls in the control activities component may include:

           * Enquiring of entity personnel.

           * Observing the application of specific controls.

           * Inspecting documents and reports.

Enquiry alone, however, is not sufficient for such purposes.

A178.      The auditor may expect, based on experience from the previous audit or based on current period risk assessment procedures, that management does not have effectively designed or implemented controls to address a significant risk.  In such instances, the procedures performed to address the requirement in paragraph 26(d) may consist of determining that such controls have not been effectively designed or implemented.  If the results of the procedures indicate that controls have been newly designed or implemented, the auditor is required to perform the procedures in paragraph 26(b)‒(d) on the newly designed or implemented controls.

A179.      The auditor may conclude that a control, which is effectively designed and implemented, may be appropriate to test in order to take its operating effectiveness into account in designing substantive procedures.  However, when a control is not designed or implemented effectively, there is no benefit in testing it.  When the auditor plans to test a control, the information obtained about the extent to which the control addresses the risk(s) of material misstatement is an input to the auditor's control risk assessment at the assertion level.

A180.      Evaluating the design and determining the implementation of identified controls in the control activities component is not sufficient to test their operating effectiveness.  However, for automated controls, the auditor may plan to test the operating effectiveness of automated controls by identifying and testing general IT controls that provide for the consistent operation of an automated control instead of performing tests of operating effectiveness on the automated controls directly.  Obtaining audit evidence about the implementation of a manual