Page 111 - Auditing Standards

As of December 15, 2017
Reporting

8
.18 The auditor should obtain a sufficient understanding of each component of internal control over
financial reporting ("understanding of internal control") to (a) identify the types of potential misstatements, (b)
assess the factors that affect the risks of material misstatement, and (c) design further audit procedures.

.19 The nature, timing, and extent of procedures that are necessary to obtain an understanding of internal
9
control depend on the size and complexity of the company; the auditor's existing knowledge of the
company's internal control over financial reporting; the nature of the company's controls, including the
company's use of IT; the nature and extent of changes in systems and operations; and the nature of the
company's documentation of its internal control over financial reporting.

Note: The auditor also might obtain an understanding of certain controls that are not part of internal control
over financial reporting, e.g., controls over the completeness and accuracy of operating or other

nonfinancial information used as audit evidence. 10

.20 Obtaining an understanding of internal control includes evaluating the design of controls that are
relevant to the audit and determining whether the controls have been implemented.

Note: Procedures the auditor performs to obtain evidence about design effectiveness include inquiry of
appropriate personnel, observation of the company's operations, and inspection of relevant

documentation. Walkthroughs, as described in paragraphs .37-.38, that include these procedures
ordinarily are sufficient to evaluate design effectiveness.

Note: Determining whether a control has been implemented means determining whether the control exists
and whether the company is using it. The procedures to determine whether a control has been
implemented may be performed in connection with the evaluation of its design. Procedures performed to

determine whether a control has been implemented include inquiry of appropriate personnel, in
combination with observation of the application of controls or inspection of documentation. Walkthroughs,
as described in paragraphs .37-.38, that include these procedures ordinarily are sufficient to determine

whether a control has been implemented.

108