55Internal control, as discussed in this Auditing Standard, consists of the following components:

55 Internal control, as discussed in this Auditing Standard, consists of the following components:

(a) the control environment;

(b) the entity’s risk assessment process;

(c) the information system, including the related business processes, relevant to financial reporting, and communication;

(d) control activities; and

(e) monitoring of controls.

Appendix 2 contains a detailed discussion of the internal control components.

56 The division of internal control into the five components provides a useful framework for auditors to consider how different aspects of an entity’s internal control may affect the audit. The division does not necessarily reflect how an entity considers and implements internal control. Also, the auditor’s primary consideration is whether, and how, a specific control prevents, or detects and corrects, material misstatements in classes of transactions, account balances, or disclosures, and their related assertions, rather than its classification into any particular component. Accordingly, auditors may use different terminology or frameworks to describe the various aspects of internal control, and their effect on the audit than those used in this Auditing Standard, provided all the components described in this Auditing Standard are addressed.

57 The way in which internal control is designed and implemented varies with an entity’s size and complexity. Specifically, smaller entities may use less formal means and simpler processes and procedures to achieve their objectives. For example, smaller entities with active management involvement in the financial reporting process may not have extensive descriptions of accounting procedures or detailed written policies. For some entities, in particular very small entities, the owner-manager[3] may perform functions which in a larger entity would be regarded as belonging to several of the components of internal control. Therefore, the components of internal control may not be clearly distinguished within smaller entities, but their underlying purposes are equally valid.

58 For the purposes of this Auditing Standard, the term “internal control” encompasses all five components of internal control stated above. In addition, the term “controls” refers to one or more of the components, or any aspect thereof.

Controls Relevant to the Audit

59 There is a direct relationship between an entity’s objectives and the controls it implements to provide reasonable assurance about their achievement. The entity’s objectives, and therefore controls, relate to financial reporting, operations and compliance; however, not all of these objectives and controls are relevant to the auditor’s risk assessment.

60 Ordinarily, controls that are relevant to an audit pertain to the entity’s objective of preparing a financial report for external purposes that gives a true and fair view (or is presented fairly, in all material respects) in accordance with the applicable financial reporting framework and the management of risk that may give rise to a material misstatement in that financial report. It is a matter of the auditor’s professional judgement, subject to the mandatory requirements of this Auditing Standard, whether a control, individually or in combination with others, is relevant to the auditor’s considerations in assessing the risks of material misstatement and designing and performing further procedures in response to assessed risks. In exercising that judgement, the auditor considers the circumstances, the applicable component and factors such as the following:

• The auditor’s judgement about materiality.
• The size of the entity.
• The nature of the entity’s business, including its organisation and ownership characteristics.
• The diversity and complexity of the entity’s operations.
• Applicable legal and regulatory requirements.
• The nature and complexity of the systems that are part of the entity’s internal control, including the use of service organisations.

61 Controls over the completeness and accuracy of information produced by the entity may also be relevant to the audit if the auditor intends to make use of the information in designing and performing further procedures. The auditor’s previous experience with the entity and information obtained in understanding the entity and its environment and throughout the audit assists the auditor in identifying controls relevant to the audit. Further, although internal control applies to the entire entity or to any of its operating units or business processes, an understanding of internal control relating to each of the entity’s operating units and business processes may not be relevant to the audit.

62 Controls relating to operations and compliance objectives may, however, be relevant to an audit if they pertain to data the auditor evaluates or uses in applying audit procedures. For example, controls pertaining to non-financial data that the auditor uses in analytical procedures, such as production statistics, or controls pertaining to detecting non-compliance with laws and regulations that may have a direct and material effect on the financial report, such as controls over compliance with income tax laws and regulations used to determine the income tax provision, may be relevant to an audit.

63 An entity generally has controls relating to objectives that are not relevant to an audit and therefore need not be considered. For example, an entity may rely on a sophisticated system of automated controls to provide efficient and effective operations (such as a commercial airline’s system of automated controls to maintain flight schedules), but these controls ordinarily would not be relevant to the audit.

64 Internal control over safeguarding of assets against unauthorised acquisition, use, or disposition may include controls relating to financial reporting and operations objectives. In obtaining an understanding of each of the components of internal control, the auditor’s consideration of safeguarding controls is generally limited to those relevant to the reliability of financial reporting. For example, use of access controls, such as passwords, that limit access to the data and programs that process cash disbursements may be relevant to a financial report audit. Conversely, controls to prevent the excessive use of materials in production generally are not relevant to a financial report audit.

65 Controls relevant to the audit may exist in any of the components of internal control and a further discussion of controls relevant to the audit is included under the heading of each internal control component below. In addition, under paragraphs 132 and 135 there are certain risks for which the auditor needs to evaluate the design of the entity’s controls over such risks and determine whether they have been implemented.

Depth of Understanding of Internal Control

66 Obtaining an understanding of internal control involves evaluating the design of a control and determining whether it has been implemented. Evaluating the design of a control involves considering whether the control, individually or in combination with other controls, is capable of effectively preventing, or detecting and correcting, material misstatements. Further explanation is contained in the discussion of each internal control component below. Implementation of a control means that the control exists and that the entity is using it. Under paragraph 135 of this Auditing Standard, the auditor needs to consider the design of a control in determining whether to consider its implementation. An improperly designed control may represent a material weakness[4] in the entity’s internal control and under paragraph 141 of this Auditing Standard the auditor needs to consider whether to communicate this to those charged with governance and management.

67 Risk assessment procedures to obtain audit evidence about the design and implementation of relevant controls may include enquiring of entity personnel, observing the application of specific controls, inspecting documents and reports, and tracing transactions through the information system relevant to financial reporting. Enquiry alone is not sufficient to evaluate the design of a control relevant to an audit and to determine whether it has been implemented.

68 Obtaining an understanding of an entity’s controls is not sufficient to serve as testing the operating effectiveness of controls, unless there is some automation that provides for the consistent application of the operation of the control (manual and automated elements of internal control relevant to the audit are further described below). For example, obtaining audit evidence about the implementation of a manually operated control at a point in time does not provide audit evidence about the operating effectiveness of the control at other times during the period under audit. However, IT enables an entity to process large volumes of data consistently and enhances the entity’s ability to monitor the performance of control activities and to achieve effective segregation of duties by implementing security controls in applications, databases, and operating systems. Therefore, because of the inherent consistency of IT processing, performing audit procedures to determine whether an automated control has been implemented may serve as a test of that control’s operating effectiveness, depending on the auditor’s assessment and testing of controls such as those over program changes. Tests of the operating effectiveness of controls are further described in ASA 330.

Characteristics of Manual and Automated Elements of Internal Control Relevant to the Auditor’s Risk Assessment

69 Most entities make use of IT systems for financial reporting and operational purposes. However, even when IT is extensively used, there will be manual elements to the systems. The balance between manual and automated elements varies. In certain cases, particularly smaller, less complex entities, the systems may be primarily manual. In other cases, the extent of automation may vary with some systems substantially automated with few related manual elements and others, even within the same entity, predominantly manual. As a result, an entity’s system of internal control is likely to contain manual and automated elements, the characteristics of which are relevant to the auditor’s risk assessment and further audit procedures based thereon.

70 The use of manual or automated elements in internal control also affects the manner in which transactions are initiated, recorded, processed, and reported.[5] Controls in a manual system may include such procedures as approvals and reviews of activities, and reconciliations and follow-up of reconciling items. Alternatively, an entity may use automated procedures to initiate, record, process, and report transactions, in which case records in electronic format replace such paper documents as purchase orders, invoices, shipping documents, and related accounting records. Controls in IT systems consist of a combination of automated controls (for example, controls embedded in computer programs) and manual controls. Further, manual controls may be independent of IT, may use information produced by IT, or may be limited to monitoring the effective functioning of IT and of automated controls, and to handling exceptions. When IT is used to initiate, record, process or report transactions, or other financial data for inclusion in the financial report, the systems and programs may include controls related to the corresponding assertions for material accounts or may be critical to the effective functioning of manual controls that depend on IT. An entity’s mix of manual and automated controls varies with the nature and complexity of the entity’s use of IT.

71 Generally, IT provides potential benefits of effectiveness and efficiency for an entity’s internal control because it enables an entity to:

• Consistently apply predefined business rules and perform complex calculations in processing large volumes of transactions or data.
• Enhance the timeliness, availability, and accuracy of information.
• Facilitate the additional analysis of information.
• Enhance the ability to monitor the performance of the entity’s activities and its policies and procedures.
• Reduce the risk that controls will be circumvented.
• Enhance the ability to achieve effective segregation of duties by implementing security controls in applications, databases, and operating systems.