Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p67
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 195013–198164

multiple acceptable accounting treatments such that subjectivity is involved.

           * Accounting estimates that have high estimation uncertainty or complex models.

           * Complexity in data collection and processing to support account balances.

           * Account balances or quantitative disclosures that involve complex calculations.

           * Accounting principles that may be subject to differing interpretation.

           * Changes in the entity's business that involve changes in accounting, for example, mergers and acquisitions.

Risks for Which Substantive Procedures Alone Do Not Provide Sufficient Appropriate Audit Evidence (Ref: Para. 33)

Why risks for which substantive procedures alone do not provide sufficient appropriate audit evidence are required to be identified

A222.      Due to the nature of a risk of material misstatement, and the control activities that address that risk, in some circumstances the only way to obtain sufficient appropriate audit evidence is to test the operating effectiveness of controls.  Accordingly, there is a requirement for the auditor to identify any such risks because of the implications for the design and performance of further audit procedures in accordance with ASA 330 to address risks of material misstatement at the assertion level.

A223.      Paragraph 26(a)(iii) also requires the identification of controls that address risks for which substantive procedures alone cannot provide sufficient appropriate audit evidence because the auditor is required, in accordance with ASA 330,[59] to design and perform tests of such controls.

Determining risks for which substantive procedures alone do not provide sufficient appropriate audit evidence

A224.      Where routine business transactions are subject to highly automated processing with little or no manual intervention, it may not be possible to perform only substantive procedures in relation to the risk.  This may be the case in circumstances where a significant amount of an entity's information is initiated, recorded, processed, or reported only in electronic form such as in an information system that involves a high degree of integration across its IT applications.  In such cases:

           * Audit evidence may be available only in electronic form, and its sufficiency and appropriateness usually depend on the effectiveness of controls over its accuracy and completeness.

           * The potential for improper initiation or alteration of information to occur and not be detected may be greater if appropriate controls are not operating effectively.

Example:

It is typically not possible to obtain sufficient appropriate audit evidence relating to revenue for a telecommunications entity based on substantive procedures alone.  This is because the evidence of call or data activity does not exist in a form that is observable.  Instead, substantial controls testing is typically performed to determine that the origination and completion of calls, and data activity is correctly captured (e.g., minutes of a call or volume of a download) and recorded correctly in the entity's billing system.