Amendments to ASA 265Amendments to ASA 265

Amendments to ASA 265

1. Existing paragraph 1 is amended to read as follows:

This Australian Standard on Auditing (ASA) deals with the auditor’s responsibility to communicate appropriately to those charged with governance and management deficiencies in internal control that the auditor has identified in an audit of financial report. This ASA does not impose additional responsibilities on the auditor regarding obtaining an understanding of the entity’s system of internal control and designing and performing tests of controls over and above the requirements of ASA 315[1] and ASA 330.2 ASA 2603 establishes further requirements and provides guidance regarding the auditor’s responsibility to communicate with those charged with governance in relation to the audit.

1. Existing paragraph 2 is amended to read as follows:

The auditor is required to obtain an understanding of the entity’s system of internal control relevant to the audit when identifying and assessing the risks of material misstatement.[4] In making those risk assessments, the auditor considers the entity’s system of internal control in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control. The auditor may identify control deficiencies in internal control not only during this risk assessment process but also at any other stage of the audit. This ASA specifies which identified deficiencies the auditor is required to communicate to those charged with governance and management.

1. Existing paragraph A3 is amended to read as follows:

While the concepts underlying controls in the control activities component in smaller entities are likely to be similar to those in larger entities, the formality with which they operate will vary. Further, smaller entities may find that certain types of controls activities are not necessary because of controls applied by management. For example, management’s sole authority for granting credit to customers and approving significant purchases can provide effective control over important account balances and transactions, lessening or removing the need for more detailed controls activities.

1. Existing paragraph A8 is amended to read as follows:

Controls may be designed to operate individually or in combination to effectively prevent, or detect and correct, misstatements.[5] For example, controls over accounts receivable may consist of both automated and manual controls designed to operate together to prevent, or detect and correct, misstatements in the account balance. A deficiency in internal control on its own may not be sufficiently important to constitute a significant deficiency. However, a combination of deficiencies affecting the same account balance or disclosure, relevant assertion, or component of the entity’s system of internal control may increase the risks of misstatement to such an extent as to give rise to a significant deficiency.