Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p23
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 23/47)
Character Range: 73684–76863

difficult to define, anticipate or predict.

           * In changing circumstances that require a control response outside the scope of an existing automated control.

           * In monitoring the effectiveness of automated controls.

A66.         Manual elements in internal control may be less reliable than automated elements because they can be more easily bypassed, ignored, or overridden and they are also more prone to simple errors and mistakes.  Consistency of application of a manual control element cannot therefore be assumed.  Manual control elements may be less suitable for the following circumstances:

           * High volume or recurring transactions, or in situations where errors that can be anticipated or predicted can be prevented, or detected and corrected, by control parameters that are automated.

           * Control activities where the specific ways to perform the control can be adequately designed and automated.

A67.         The extent and nature of the risks to internal control vary depending on the nature and characteristics of the entity's information system.  The entity responds to the risks arising from the use of IT or from use of manual elements in internal control by establishing effective controls in light of the characteristics of the entity's information system.

Controls Relevant to the Audit

A68.         There is a direct relationship between an entity's objectives and the controls it implements to provide reasonable assurance about their achievement.  The entity's objectives, and therefore controls, relate to financial reporting, operations and compliance; however, not all of these objectives and controls are relevant to the auditor's risk assessment.

A69.         Factors relevant to the auditor's judgement about whether a control, individually or in combination with others, is relevant to the audit may include such matters as the following:

           * Materiality.

           * The significance of the related risk.

           * The size of the entity.

           * The nature of the entity's business, including its organisation and ownership characteristics.

           * The diversity and complexity of the entity's operations.

           * Applicable legal and regulatory requirements.

           * The circumstances and the applicable component of internal control.

           * The nature and complexity of the systems that are part of the entity's internal control, including the use of service organisations.

           * Whether, and how, a specific control, individually or in combination with others, prevents, or detects and corrects, material misstatement.

A70.         Controls over the completeness and accuracy of information produced by the entity may be relevant to the audit if the auditor intends to make use of the information in designing and performing further audit procedures.  Controls relating to operations and compliance objectives may also be relevant to an audit if they relate to data the auditor evaluates or uses in applying audit procedures.

A71.         Internal control over safeguarding of assets against unauthorised acquisition, use, or disposition may