Controls and Scots

Obtain understanding of critical path of SCOTs
- obtain understanding of policies and procedures (SoD, Safeguarding of assets,

authorization, monitoring of processes, information processing)
in place that mgmt uses to determine that directives are carried out and applied at
various org levels
- integrated audit (rely on controls)
- identify controls, understand design to determine w/c ar relevant to the
audit
- when we plan to rely on controls, test controls to conclude whether they
are properly designed and operated effectively throughout the audit period
- then we address control exceptions and identify deficiencies in internal
control
A SCOT is one that has one or more of the following attributes:

� Results in material amounts being recorded in a significant account
� Is susceptible to material misstatements arising from qualitative factors (e.g.,
the complexity of transactions or other inherent risk factors)
�Is affected by a significant risk
We obtain an understanding of the critical path of SCOTs by understanding the

following phases:
� Initiation: The point where the transaction first enters the entity�s SCOT and is
prepared and submitted for recording
� Recording: When the transaction is first recorded in the entity�s books and
records
� Processing: Any changes, manipulation or transfers of the data in the books and
records
� Reporting: When the transaction is reported (i.e., posted) in the general ledger
To understand the SCOTs, we use a combination of inquiry, observation and

inspection to obtain information that is likely to help in the identification of
WCGWs.9
When we obtain an understanding of the critical path, we obtain an understanding of

the policies and procedures in place that management uses to determine that
directives are carried out and are applied at various organizational and functional
levels. The policies and procedures include:7
� Authorization
� Segregation of duties
� Safeguarding of assets
� Monitoring of processes
� Information processing
When we obtain an understanding of information processing within SCOTs, we obtain

an understanding of the automated aspects of the SCOTs, including:8
� How information is input into the application
� Manual aspects that depend upon computer functionality or computer generated data
� The processing within the relevant IT applications
The likelihood of material misstatements in the financial statements increases

with:
�Inappropriate authorization of transactions, contrary to management�s general or

specific policies.
�Inadequate segregation of duties. This occurs when someone performs procedures
that are incompatible with each other, such as when someone processes/records the
transaction and also performs the reconciliation or review to identify errors in
processed transactions.
�Lack of asset safeguarding, i.e., access to assets and data without management�s
authorization.
�Lack of asset accountability. This occurs when amounts recorded for assets are not
compared with existing assets at reasonable intervals and appropriate action is not
taken regarding any differences arising from the comparison.
�The use of accounting estimates and the degree of estimation uncertainty:

Estimation uncertainty, by its very nature, may have a higher likelihood of a
material misstatement occurring and may result in a significant risk.
We confirm our understanding of the routine and non-routine SCOTs every period,
regardless of our strategy (whether controls-reliance strategy or substantive only
strategy) by selecting one transaction and tracing that transaction along its
critical path.
When confirming our understanding of a SCOT, we document:42

� The transactions we selected for our walkthrough
� Individuals with whom we confirmed our understanding
� The procedures we performed to confirm our understanding and documentation of the
SCOT
� The procedures we performed to confirm our understanding of controls over
significant risks, highly-automated SCOTs and journal entries (refer to SCOTS 5)
� Anything noted during our procedures that would indicate issues related to
authorization or segregation of duties
� Anything noted during our procedures that would indicate the potential for
management override of controls or other risks of material misstatement due to
fraud in the SCOTs
� Our conclusion that our documentation accurately describes the operation of the
SCOT and that we have identified the appropriate WCGWs
We consider the following when identifying a relevant control:

�Why is the control performed?
�Who performs the control?
�When is the control performed?
�How precise and sensitive is the control?
�How is the control affected by other components of internal control?
�What evidence supports the performance of the control?
When identifying relevant controls, we:

�Use a �top-down� approach, i.e., we determine which controls management considers
important
�Ask management and supervisory personnel which controls they believe are best to
detect and correct misstatements. Their perspective helps us determine whether we
want to identify a control as relevant to the audit.
�Inquire of appropriate personnel who are responsible for the SCOT or who perform
individual controls within the process
�Involve team members with specialized knowledge of IT, when applicable

�Are aware of the risk of management override
�Use our professional judgment to determine whether a control, individually or in
combination with other controls, is relevant to the audit
�Do not document all controls, but only the relevant controls, i.e., it is not
necessary to obtain an understanding of every control when many controls achieve
the same purpose
Factors to determine whether a control is relevant or not
1. controls appropriately address the assessed WCGW at the financial statement or

at the assertion levels
2. contrls operate effectively thorughout the period of reliance
3. controls operates at a point in time but relates to transactions accumulated to
that point
4. data subjected to the control is complete and reliable
5. contrls are applied on a timely basis or correction of misstatements that were
detected by the control occur timely
6. person operating the control is competent and objective
7. control is a detect and correct control and is performed by a person at a lvel
above the level of those performing the controls
8. we are able to obtain the suffcient audit evidence of the operating
effectiveness of the control
We confirm our understanding of the design of relevant controls and that they have
been implemented
- through a combination of performing a walkthrough, making inquiries of
personnel and observing individuals performing their duties
- To confirm our understanding:

�We determine whether the walkthrough encompasses the relevant controls
for the entire critical path of individual transactions. If it does not, we select
additional transactions to validate the operation of the remaining
controls.
�We inquire of entity personnel about their understanding of what is
required by the controls, to determine whether the controls are performed on a
timely basis and in the way we expect based on our understanding of the
controls. We are alert for exceptions to the prescribed controls.
�We determine whether the specific design attributes of the controls
are present.
Nature of Test of Control

Inquiry: Seeking information from knowledgeable people, both financial and non-
financial, throughout or outside the entity.
�Inquiries can be written or oral.
�We consider making inquiries of both the control owner and reviewer.
�We consider making corroborating inquiries of others.
�Evaluating responses is an important part of the inquiry process, as it may

provide information not previously obtained or corroborate existing audit evidence.
Responses to inquiries may help us modify or perform additional audit
procedures.
�Observation: Watching processes or procedures being performed by entity personnel.
�We remain alert that employees may perform procedures more diligently
when they know they are being observed.
�Inspection: Examining records or documents
�Records and documents may be internal or external, in paper, electronic form
or other media.
�Records and documents provide audit evidence of varying reliability,
depending on the nature and source and, with internal documents, the effectiveness
of controls over their production.
�Reperformance/recalculation: Independent execution, by the audit team, of control

procedures originally performed as part of the entity�s internal control (e.g.,
reperforming a reconciliation to confirm it was properly performed as input to the
control). Reperformance may include recalculation, i.e., checking the mathematical
accuracy of documents or records. Reperformance may be manual or via computer-
assisted audit techniques (CAATs).
�Data analysis: Using automated tools to test controls (e.g., SAP table
authorization limits have not changed throughout the period, confirming that all
document numbers run in sequence and the sequence is complete).
When designing the extent of test of controls we consider: 21

�Whether the population is complete and appropriate, i.e. the population
includes all transactions or procedures that the control should be applied to
�The minimum sample size and factors that could influence whether to increase
the sample size recognizing that the greater reliance we place on controls the more
persuasive the audit evidence we require
�The sampling method
When we execute our tests of controls, we may find that there have been changes to
the entity�s controls since we confirmed our understanding of the SCOTs or designed
our tests of controls. These may include changes in:
�The application of controls
�Policies and procedures affecting the SCOT
�The IT application (including significant modifications or updates to the
existing IT application)
�Personnel that affect the application of the control
�Circumstances that indicate a need for changes in the control (e.g.,
unexpected economic crisis or new major shareholders with different expectations of
management and/or those charged with governance)
Review controls are detect and correct controls that are usually manual or ITDM.
They are performed by an individual(s) (generally management) with appropriate
competence and authority.
The reviewer generally determines whether the information is complete and accurate,
whether the accounting is appropriate and whether there are potential errors or
misstatements. The reviewer also checks that other controls over that data were
performed timely and effectively. The purpose of review controls is to detect
misstatements that exceed a specified threshold that may have occurred during
processing (i.e., the misstatements that occur despite the entity�s prevent
controls) and to correct those misstatements.
http://forumserver.twoplustwo.com/30/business-finance-investing/what-would-you-
tell-your-25-yr-old-self-1373143/?s=2519d198f820c38066cb6153f9060eb7
http://vip.aersia.net/vip.swf

Controls and Scots

Uploaded by

Copyright:

Available Formats

Controls and Scots

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Read this document in other languages

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Controls and Scots

Uploaded by

Copyright:

Available Formats

What are the different types of audit evidence that can be obtained?

What are the different types of audit evidence that can be obtained?

What are the key considerations when designing tests of controls?

What are the key considerations when designing tests of controls?

Obtain understanding of critical path of SCOTs

- obtain understanding of policies and procedures (SoD, Safeguarding of assets,

A SCOT is one that has one or more of the following attributes:

�Is affected by a significant risk

We obtain an understanding of the critical path of SCOTs by understanding the

To understand the SCOTs, we use a combination of inquiry, observation and

When we obtain an understanding of the critical path, we obtain an understanding of

When we obtain an understanding of information processing within SCOTs, we obtain

� The processing within the relevant IT applications

The likelihood of material misstatements in the financial statements increases

�Inappropriate authorization of transactions, contrary to management�s general or

�The use of accounting estimates and the degree of estimation uncertainty:

When confirming our understanding of a SCOT, we document:42

We consider the following when identifying a relevant control:

When identifying relevant controls, we:

�Involve team members with specialized knowledge of IT, when applicable

Factors to determine whether a control is relevant or not

1. controls appropriately address the assessed WCGW at the financial statement or

- To confirm our understanding:

Nature of Test of Control

�Evaluating responses is an important part of the inquiry process, as it may

�Observation: Watching processes or procedures being performed by entity personnel.

�Reperformance/recalculation: Independent execution, by the audit team, of control

When designing the extent of test of controls we consider: 21

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.