Assess systems, processes and controls

Assess systems, processes and controls

The audit team leader must assess the audited body's systems and processes. As part of this, they should assess the controls the audited body has in place to manage the risk of errors or non-compliance.

By doing this assessment, the audit team leader knows which areas of the assurance engagement are likely to involve higher levels of risk. These risks may occur because of poor internal controls.

To assess the internal control system, the audit team leader needs to evaluate:

● the overall control environment, for example, the attitude senior staff have towards risk management

● the audited body's risk assessment process, for example, risk registers or risk management functions like internal audit

● the information system, for example, how the audited body collects and reports information and monitors for inaccurate reporting

● control activities, for example, signoffs performed over reported information at a facility

● monitoring of controls, for example, how the audited body monitors the ongoing efficiency of controls.

Section 3.11 of the Audit Codes of Practice lists the requirements for assessing systems and processes.