Page 65 - Internal Auditing Standards

Guide to Using International Standards on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts

In larger companies, information systems can be complex, automated, and highly integrated. Smaller
companies will often rely on manual or stand-alone information technology applications.

CONSIDER POINT

Many mainstream accounting software packages (even smaller ones) come with a variety of built-in

application controls that could be used to improve control over financial reporting. These controls
include automated reconciliations, reporting of exceptions for management review, and ensuring
general consistency over fi nancial reporting.

In obtaining an understanding of the information system (including business processes), the auditor would
address (in addition to the exhibit above) the matters outlined below.

Exhibit 5.5-3

Identify Address
Sources of What classes of transactions are significant to the fi nancial statements?

Information Used
How do transactions originate within the entity’s business processes?

What accounting records (electronic or manual) exist?
How does the system capture events and conditions (other than classes of

transactions) that are significant to the fi nancial statements?
How Information What are the financial reporting processes used to:

Is Captured and • Initiate, record, process, and report transactions and non-standard transactions
Processed (such as related-party transactions, etc.); and

• Prepare the financial statements, including significant accounting estimates and
disclosures?
What procedures address:
• Risks of material misstatement associated with inappropriate override of
controls, including use of standard and non-standard journal entries;
• Override or suspension of automated controls; and
• Identification of exceptions and reporting the actions that have been taken to

remedy these?
How the How does the entity communicate financial reporting roles, responsibilities, and

Information significant matters relating to fi nancial reporting?

Produced Is Used
What reports are regularly produced by the information system, and how are they
used to manage the entity?

What information is provided by management to those charged with governance (if
different from management) and to external parties such as regulatory authorities?

63