Business Objective |
Example Control Objectives |
Corporate CultureEstablish a culture and a tone at the top that fosters integrity, shared values, and teamwork in pursuit of the entity’s objectives. |
Articulate and communicate codes of conduct and other policies regarding acceptable business practice, conflicts of interest, and expected standards of ethical and moral behavior.Reduce incentives and temptations that can motivate employees to act in a manner that is unethical, opposed to the entity’s objectives, or both.Reinforce written policies about ethical behavior through action and leadership by example. |
Personnel PoliciesThe entity’s personnel have been provided with the information, resources, and support necessary to effectively carry out their responsibilities. |
Identify, articulate, and communicate to entity personnel the information and skills needed to perform their jobs effectively.Provide entity personnel with the resources needed to perform their jobs effectively.Supervise and monitor individuals with internal control responsibilities.Delegate authority and responsibility to appropriate individuals within the organization. |
IT General ControlsThe entity’s general IT policies enable the effective functioning of computer applications related to the financial reporting process. |
Logical access control protects the following, which are used in the financial reporting process:SystemsDataApplication, utility, and other programsSpreadsheetsInstallation of suitable computer operating environment and controls over the physical access to hardware.Proper functioning of new, upgraded, and modified systems and applications, including plans for migration, conversion, testing, and acceptance. |
Risk IdentificationImplement a process that effectively identifies and responds to conditions that can significantly affect the entity’s ability to achieve its financial reporting objectives. |
Identify what can go wrong in the preparation of the financial statements at a sufficient level of detail that allows management to design and implement controls to mitigate risk effectively.Continuously identify and assess risk to account for changes in external and internal conditions. |
Antifraud Programs and ControlsReduce the incidence of fraud. |
Create a culture of honesty and high ethics.Evaluate antifraud processes and controls.Develop an effective antifraud oversight process. |
Period-End Financial Reporting ProcessesNonroutine, nonsystematic financial reporting adjustments are appropriately identified and approved. |
Management is aware of and understands the need for certain financial reporting adjustments.Information required for decision-making purposes is:Identified, gathered, and communicatedRelevant and reliableManagement analyzes the information and responds appropriately.Management’s response is reviewed and approved. |
Selection and application of accounting principles result in financial statements that are “fairly presented.” |
Management identifies events and transactions for which accounting policy choices should be made or existing policies reconsidered.The accounting policies chosen by management have general acceptance and result in a fair presentation of financial statement information.Information processing and internal control policies and procedures are designed to apply the accounting principles selected appropriately. |
MonitoringIdentify material weaknesses and changes in internal control that require disclosure. |
Monitoring controls operate at a level of precision that would allow management to identify a material misstatement of the financial statements. This objective applies both to:Controls that monitor other controlsControls that monitor financial information |
Activity-Level Control ObjectivesAdequately control the initiation, processing, and disclosure of transactions. |
Identify, analyze, and manage risks that may cause material misstatements of the financial statements.Design and implement an information system to record, process, summarize, and report transactions accurately.Design and implement control activities, including policies and procedures applied in the processing of transactions that flow through the accounting system, in order to prevent or promptly detect material misstatements.Monitor the design and operating effectiveness of activity-level internal controls to determine if they are operating as intended and, if not, to take corrective action. |
1 1 Refer to the October 2018 AICPA Peer Reviewer Alert at https://www.aicpa.org/content/dam/aicpa/interestareas/peerreview/newsandpublications/downloadabledocuments/reviewer-alert-201810.pdf.
11 AU-C 320 Materiality in Planning and Performing an Audit
Scope
Definition of Term
Objective of AU-C Section 320
Overview
Materiality and Audit Risk
Requirements
Determining Materiality and Performance Materiality
Revision of Materiality
Documentation Requirements
While AU-C 450 contains guidance on how to use materiality when evaluating the effect of identified misstatements, AU-C 320 offers auditors guidance in using materiality when planning and performing the audit. (AU-C 320-01)
NOTE: The auditor may want to consider the guidance provided in the SEC’s Staff Accounting Bulletin (SAB) 99, Materiality. This SAB addresses the application of materiality thresholds to the preparation and audit of financial statements filed with the SEC and provides guidance on qualitative factors to consider when evaluating materiality.
Source: AU-C 320.09.For the definition related to this standard, see Appendix A, “Definitions of Terms”: Performance materiality.
OBJECTIVE OF AU-C SECTION 320
The objective of the auditor is to apply the concept of materiality appropriately in planning and performing the audit.
(AU-C Section 320.08)
The concept of materiality recognizes that some matters are more important for the fair presentation of the financial statements than others. In performing the audit, the auditor is concerned with matters that, individually or in the aggregate, could be material to the financial statements. The auditor’s responsibility is to plan and perform the audit to obtain reasonable assurance that the auditor detects all material misstatements, whether caused by error or by fraud.
The FASB’s Conceptual Framework Concept No. 8 says that:
The omission or misstatement of an item in a financial report is material if, in light of surrounding circumstances, the magnitude of the item is such that it is probable that the judgment of a reasonable person relying upon the report would have been changed or influenced by the inclusion or correction of the item.
This definition is consistent with the definition used by the SEC, the PCAOB, the AICPA, and the U.S. judicial system.
Materiality is entity-specific and is based on the nature and/or magnitude of the item in the context of an individual entity’s financial report. Thus, materiality is influenced by the auditor’s perception of the needs of financial statement users who will rely on the financial statements to make economic decisions. (AU-C 320.04) Specific needs of users may vary widely, and those are not considered.
Materiality and Audit Risk
Читать дальше