- This topic has 1 reply, 2 voices, and was last updated 4 years ago by
.
- Posts
Dear sir,
1) In suggested answer, it says: “Small businesses may have the problem of very informal accounting systems and completeness of records may be a specific audit risk as the auditors may find it impossible to be sure that they have been given full information.” Small businesses do have manuals and competent staff so the auditors should consider these and audit accordingly. How it is possible that they may not have been given full information?
2) Please confirm that the lack of internal control procedures may not necessarily mean an increased risk of fraud or error as some procedures may not be applicable for small business.
3) Should I read the five components of the internal control framework which are control environment, risk assessment, control activities, information and communication, and monitoring for AAA exam in detail? Are they examined directly or indirectly?
Thank you!
If a small business is cash-based (for example) that increases inherent risk. A lack of segregation of duties to exercise control over completeness of recording of cash does not increase inherent risk – it means there is control risk. That control risk might be reduced by the supervision of an owner-manager. However, there may be few controls that can be tested by the auditor – supervision can only be tested if it is observed (i.e. only at a single moment in time) or evidenced (e.g. a signature evidencing checking of the monthly bank reconciliation). So mostly the auditor will take a substantive approach.
Lack of segregation of duties may suggest a higher risk of fraud and error by employees – but an owner-manager would have particular incentive to exercise oversight to prevent and detect theft (say) by employees. However, there would be no “higher” control over management if an owner-manager wanted to understate revenue/overstate expenses in order to reduce tax liabilities.
You need to understand what the components are in order to understand what controls the auditor might expect to find, where relevant, in keeping with a case scenario.
It will not be examined directly – at this level the examiner does not ask for rote-learnt knowledge.
- You must be logged in to reply to this topic.