Question

You are an audit senior at the accounting firm of Court & Partners in Sydney. The firm has recently won the audit of a small manufacturing firm located in Bankstown and you have been given the job. The audit partner in the planning meeting tells you not to worry about the controls because the firm is quite small, and based on his experience of firms of this size, controls are mostly poor and it is not even worth looking at them.

Required

(a)     Comment on the audit partner’s advice.

(b)     Discuss any special considerations in evaluating and relying on controls in small firms.

Answer 1

The audit partner’s advice is not correct that not to worry about the controls because the firm is quite small, and based on his experience of firms of this size, controls are mostly poor and it is not even worth looking at them.

Internal controls are methods or procedures adopted in a business to:

• safeguard its assets; •

ensure financial information is accurate and reliable;

• ensure compliance with all financial and operational requirements; and

• generally assist in achieving the business’s objectives.

Control procedures are the policies and procedures that have been put in place to ensure that owners and managers can take the correct action to ensure the business achieves its objectives.

Procedures explain the how, why, what, where and when for any set of actions.

Some small business owners may think procedures are unnecessary. Nevertheless, written procedures help train new staff by explaining why they need to do what is asked of them. Written procedures reduce errors and help staff understand the business quickly. And, most importantly, it reduces the time taken to train new staff.

Auditors are only required to obtain an understanding of controls relevant to the audit. Controls relevant to the audit are typically controls over financial reporting. That is not to say that all controls over financial reporting are relevant to the audit. The only controls that auditors need concern themselves with are those that auditors believe may prevent, detect or correct a material misstatement. It is a matter of professional judgement whether a control individually, or in combination with others, is relevant to the audit. To be able to make this judgement, auditors need to understand the system within which the controls operate.

Internal controls in smaller and less complex entities are likely to be informal, but this does not mean that there will be no controls relevant to the audit or that if there are, they will never be good enough for auditors to test their operating effectiveness.

If auditors do not understand the system and assume that there are no controls relevant to the audit without further consideration, they write off the potential value of this work before they start.

Operational and financial controls are often tightly integrated and interdependent. In a theatre ticketing system, for example, controls over the issue of tickets are often linked with controls over the receipt of funds or the issue of invoices. This means that operational controls may sometimes be relevant to the audit and auditors need to think carefully about that and whether it is therefore necessary to assess their design and implementation. One way of determining this might be to ask whether the absence of the control might render the system inoperative, or vulnerable to the failure of a single control, or constitute a significant deficiency.