Annual Audit Manual
COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.
4026 Strategy in relation to indirect ELCs
Jun-2021
In This Section
CAS Guidance
Tests of controls are performed only on those controls that the auditor has determined are suitably designed to prevent, or detect and correct, a material misstatement in a relevant assertion, and the auditor plans to test those controls. If substantially different controls were used at different times during the period under audit, each is considered separately (CAS 330.A20).
OAG Guidance
Indirect ELCs are only indirectly related to specific assertions for FSLIs/business processes and, therefore, would not by themselves prevent or detect on a timely basis material misstatements to one or more relevant assertions for one or more FSLIs. However, depending on the nature of the Indirect ELC and our assessment of its importance to the effective operation of other (e.g., transaction level) controls and the extent to which we can relate those controls to assertions, we may decide to test Indirect ELCs.
Our assessment of Indirect ELCs may impact our expected controls reliance. If the entity is well controlled, it may be appropriate to follow a controls-based audit approach. The opposite of this is also true, i.e., if the entity has a weak control environment, our ability to identify and test controls for operating effectiveness is diminished. It may also impact on the nature, timing and extent of our further controls testing.
Consider the following example:
From our understanding of the control environment we learn that the entity has human resource policies and practices that, in our judgment, show a commitment to a well controlled organization. This includes: having standards for recruiting the most qualified individuals—with emphasis on educational background, prior work experience, past accomplishments, and evidence of integrity and ethical behavior. The entity has training policies that communicate prospective roles and responsibilities.
In this scenario, we may be able to follow a controls-based approach to the audit, or specific FSLIs and related business processes (i.e., plan to achieve Partial or High controls reliance and obtain further evidence from testing other controls (Direct ELCs or transaction level controls) for operating effectiveness). Our assessment of the control environment and Indirect ELCs may also influence our assessment of the planned level of assurance needed from specific controls (see OAG Audit 7011), e.g., for a manual control perform testing for moderate assurance instead of high (see OAG Audit 6053), or use inspection rather than reperformance as the testing technique.
Document the steps carried out to test the operating effectiveness of the indirect ELCs in planning procedures where the understanding and evaluation of those controls were documented.