Section 79 - ASA 315 - Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement - April 2006 - The auditor shall obtain an understanding of the control environment. | Zoe
ASA 315 - Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement - April 2006
79The auditor shall obtain an understanding of the control environment.
Start here
Get a plain-English read of 79
Turn the raw legal text into a practical explanation grounded in ASA 315 - Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement - April 2006.
79 The auditor shall obtain an understanding of the control environment.
80 The control environment includes the governance and management functions and the attitudes, awareness, and actions of those charged with governance and management concerning the entity’s internal control and its importance in the entity. The control environment sets the tone of an organisation, influencing the control consciousness of its people. It is the foundation for effective internal control, providing discipline and structure.
81 The primary responsibility for the prevention and detection of fraud and error rests with both those charged with governance and management of an entity. In evaluating the design of the control environment and determining whether it has been implemented, ordinarily the auditor understands how management, with the oversight of those charged with governance, has created and maintained a culture of honesty and ethical behaviour, and established appropriate controls to prevent and detect fraud and error within the entity.
82 In evaluating the design of the entity’s control environment, the auditor ordinarily considers the following elements and how they have been incorporated into the entity’s processes:
Communication and enforcement of integrity and ethical values — essential elements which influence the effectiveness of the design, administration and monitoring of controls.
Commitment to competence — management’s consideration of the competence levels for particular jobs and how those levels translate into requisite skills and knowledge.
Participation by those charged with governance — independence from management, their experience and stature, the extent of their involvement and scrutiny of activities, the information they receive, the degree to which difficult questions are raised and pursued with management and their interaction with internal and external auditors.
Management’s philosophy and operating style — management’s approach to taking and managing business risks, and management’s attitudes and actions toward financial reporting, information processing and accounting functions and personnel.
Organisational structure — the framework within which an entity’s activities for achieving its objectives are planned, executed, controlled and reviewed.
Assignment of authority and responsibility — how authority and responsibility for operating activities are assigned and how reporting relationships and authorisation hierarchies are established.
Human resource policies and practices — recruitment, orientation, training, evaluating, counselling, promoting, compensating and remedial actions.
83 In understanding the control environment, under paragraph 79 of this Auditing Standard, the auditor needs to consider whether controls have been implemented. Ordinarily, the auditor obtains relevant audit evidence through a combination of enquiries and other risk assessment procedures, for example, corroborating enquiries through observation or inspection of documents. For example, through enquiries of management and employees, the auditor may obtain an understanding of how management communicates to employees its views on business practices and ethical behaviour. Ordinarily, the auditor determines whether controls have been implemented by considering, for example, whether management has established a formal code of conduct and whether it acts in a manner that supports the code or condones violations of, or authorises exceptions to the code.
84 Audit evidence for elements of the control environment may not be available in documentary form, in particular for smaller entities where communication between management and other personnel may be informal, yet effective. For example, management’s commitment to ethical values and competence are often implemented through the behaviour and attitude they demonstrate in managing the entity’s business instead of in a written code of conduct. Consequently, management’s attitudes, awareness and actions are of particular importance in the design of a smaller entity’s control environment. In addition, the role of those charged with governance is often undertaken by the owner-manager where there are no other owners.
85 The overall responsibilities of those charged with governance are recognised in codes of practice and other regulations or guidance produced for the benefit of those charged with governance. It is one, but not the only, role of those charged with governance to counterbalance pressures on management in relation to financial reporting. For example, the basis for management remuneration may place stress on management arising from the conflicting demands of fair reporting and the perceived benefits of improved results. In understanding the design of the control environment, ordinarily the auditor considers:
(a) such matters as the independence of the directors and those charged with governance, and their ability to evaluate the actions of management; and
(b) whether there is an audit committee that understands the entity’s business transactions and evaluates whether the financial report gives a true and fair view (or is presented fairly, in all material respects) in accordance with the applicable financial reporting framework.
86 The nature of an entity’s control environment is such that it has a pervasive effect on assessing the risks of material misstatement. For example, owner-manager controls may mitigate a lack of segregation of duties in a small business, or an active and independent board of directors may influence the philosophy and operating style of senior management in larger entities. The auditor’s evaluation of the design of the entity’s control environment ordinarily includes considering whether the strengths in the control environment elements collectively provide an appropriate foundation for the other components of internal control, and are not undermined by control environment weaknesses. For example, human resource policies and practices directed toward hiring competent financial, accounting, and IT personnel may not mitigate a strong bias by senior management to overstate earnings. Changes in the control environment may affect the relevance of information obtained in prior audits. For example, management’s decision to commit additional resources for training and awareness of financial reporting activities may reduce the risk of errors in processing financial information. Alternatively, management’s failure to commit sufficient resources to address security risks presented by IT may adversely affect internal control by allowing improper changes to be made to computer programs or to data, or by allowing unauthorised transactions to be processed.
87 The existence of a satisfactory control environment can be a positive factor when the auditor assesses the risks of material misstatement and as explained in ASA 330, influences the nature, timing, and extent of the auditor’s further audit procedures. In particular, it may help reduce the risk of fraud, although a satisfactory control environment is not an absolute deterrent to fraud. Conversely, weaknesses in the control environment may undermine the effectiveness of controls and therefore be negative factors in the auditor’s assessment of the risks of material misstatement, in particular in relation to fraud.
88 The control environment in itself does not prevent, or detect and correct, a material misstatement in classes of transactions, account balances, and disclosures and related assertions. The auditor, therefore, ordinarily considers the effect of other components along with the control environment when assessing the risks of material misstatement; for example, the monitoring of controls and the operation of specific control activities.
The Entity’s Risk Assessment Process
89 The auditor shall obtain an understanding of the entity’s process for identifying business risks relevant to financial reporting objectives and deciding about actions to address those risks, and the results thereof.
90 The process is described as the “entity’s risk assessment process” and forms the basis for how management determines the risks to be managed.
91 In evaluating the design and implementation of the entity’s risk assessment process, the auditor ordinarily determines how management identifies business risks relevant to financial reporting, estimates the significance of the risks, assesses the likelihood of their occurrence, and decides upon actions to manage them. If the entity’s risk assessment process is appropriate to the circumstances, it assists the auditor in identifying risks of material misstatement.
92 Ordinarily, the auditor enquires about business risks that management has identified and considers whether they may result in material misstatement. During the audit, the auditor may identify risks of material misstatement that management failed to identify. In such cases, the auditor ordinarily considers whether there was an underlying risk of a kind that ought to have been identified by the entity’s risk assessment process, and if so, why that process failed to do so and whether the process is appropriate to its circumstances. If, as a result, the auditor judges that there is a material weakness in the entity’s risk assessment process, under paragraph 141 of this Auditing Standard, the auditor needs to communicate to those charged with governance.
93 In a smaller entity, management may not have a formal risk assessment process as described in paragraph 89. For such entities, under paragraph 89 of this Auditing Standard, the auditor needs to discuss with management how risks to the business are identified by management and how they are addressed.
Information System, Including the Related Business Processes, Relevant to Financial Reporting, and Communication
94 The information system relevant to financial reporting objectives, which includes the accounting system, consists of the procedures and records established to initiate, record, process, and report entity transactions (as well as events and conditions) and to maintain accountability for the related assets, liabilities, and equity.
95 The auditor shall obtain an understanding of the information system, including the related business processes, relevant to financial reporting, including the following areas:
(a) The classes of transactions in the entity’s operations that are significant to the financial report.
(b) The procedures, within both IT and manual systems, by which those transactions are initiated, recorded, processed and reported in the financial report.
(c) The related accounting records, whether electronic or manual, supporting information, and specific accounts in the financial report, in respect of initiating, recording, processing and reporting transactions.
(d) How the information system captures events and conditions, other than classes of transactions, that are significant to the financial report.
(e) The financial reporting process used to prepare the entity’s financial report, including significant accounting estimates and disclosures.