Page 178 - Internal Auditing Standards

Guide to Using International Standards on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts

Exhibit 15.2-4

Steps Auditor Response
1. Obtain an understanding of the nature of the act and the circumstances. This should be suffi cient

to evaluate the possible effect on the fi nancial statements.
2. Document the findings and discuss them with management. If non-compliance is believed to

be intentional and material, the auditor should communicate the finding without delay. When

adequate information about suspected non-compliance and the potential effects on the fi nancial

statement cannot be verified, the auditor should consider the effect of the lack of suffi cient

appropriate audit evidence on the auditor’s report.
3. Consider the implications of non-compliance in relation to other aspects of the audit. In particular,
consider the reliability of management representations.
4. Report the matter to the next higher level of authority if it involves senior management or those
charged with governance. Where no higher authority exists, the auditor would consider the need
to obtain legal advice.
5. Express a qualified or an adverse opinion if non-compliance has a material effect on the fi nancial

statements, and has not been properly reflected in the financial statements. (See Volume 2, Chapter 23.)

Documentation
Doc u m e n t a t i o n

Paragraph # Relevant Extracts from ISAs
250.29 The auditor shall include in the audit documentation identified or suspected non-compliance

with laws and regulations and the results of discussion with management and, where
applicable, those charged with governance and other parties outside the entity. (Ref: Para. A21)

Typical documentation will include:

• Copies of relevant records or documents; and
• Minutes of discussions held with management, those charged with governance, or other parties outside
the entity.

15.3 ISA 402—Audit Considerations Relating to an Entity Using a Service Organization

Paragraph # ISA Objective(s)

402.7 The objectives of the user auditor, when the user entity uses the services of a service
organization, are:

(a) To obtain an understanding of the nature and significance of the services provided by the
service organization and their effect on the user entity’s internal control relevant to the

audit, sufficient to identify and assess the risks of material misstatement; and

(b) To design and perform audit procedures responsive to those risks.

176