ASA 315 - Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment - October 2009
Control ActivitiesControl Activities
Start here
Get a plain-English read of Control Activities
Turn the raw legal text into a practical explanation grounded in ASA 315 - Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment - October 2009.
Control Activities
- Generally, control activities that may be relevant to an audit may be categorised as policies and procedures that pertain to the following:
-
Performance reviews. These control activities include reviews and analyses of actual performance versus budgets, forecasts, and prior period performance; relating different sets of data – operating or financial – to one another, together with analyses of the relationships and investigative and corrective actions; comparing internal data with external sources of information; and review of functional or activity performance.
-
Information processing. The two broad groupings of information systems control activities are application controls, which apply to the processing of individual applications, and general IT‑controls, which are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems. Examples of application controls include checking the arithmetical accuracy of records, maintaining and reviewing accounts and trial balances, automated controls such as edit checks of input data and numerical sequence checks, and manual follow‑up of exception reports. Examples of general IT‑controls are program change controls, controls that restrict access to programs or data, controls over the implementation of new releases of packaged software applications, and controls over system software that restrict access to or monitor the use of system utilities that could change financial data or records without leaving an audit trail.
-
Physical controls. Controls that encompass:
- The physical security of assets, including adequate safeguards such as secured facilities over access to assets and records.
- The authorisation for access to computer programs and data files.
- The periodic counting and comparison with amounts shown on control records (for example comparing the results of cash, security and inventory counts with accounting records).
The extent to which physical controls intended to prevent theft of assets are relevant to the reliability of financial report preparation, and therefore the audit, depends on circumstances such as when assets are highly susceptible to misappropriation.
- Segregation of duties. Assigning different people the responsibilities of authorising transactions, recording transactions, and maintaining custody of assets. Segregation of duties is intended to reduce the opportunities to allow any person to be in a position to both perpetrate and conceal errors or fraud in the normal course of the person’s duties.