Skip to content

CA Intermediate · Auditing and Ethics · Risk Assessment and Internal Control

In the audit of Sahyadri Pharma Ltd, the auditor is evaluating the internal financial controls over financial reporting (IFCoFR) as required for the audit report of a company under the Companies Act, 2013. Management has not documented its controls and says the auditor should simply assume they are adequate. What is the most appropriate response of the auditor?

The auditor should not accept management's assumption. Under the Companies Act the auditor must report on the adequacy and operating effectiveness of internal financial controls, so the auditor gathers evidence through enquiry, observation and inspection, assesses design and operation, and reports on IFCoFR based on that evidence.

  1. AAccept management's representation, since IFCoFR is solely management's responsibility
  2. BWithdraw from the engagement because undocumented controls make any audit impossible
  3. CReport only on operating effectiveness and skip design evaluation, as documentation is not needed
  4. DObtain an understanding of the controls through enquiry, observation and inspection, assess their design and operation, and report on IFCoFR in the audit report based on the evidence obtainedCorrect

Explanation

Under the Companies Act, the auditor's report must state whether an adequate IFCoFR system exists and whether it operates effectively. Management's responsibility to establish controls does not remove the auditor's duty to evaluate them. Lack of documentation does not preclude audit; the auditor gathers evidence by enquiry, observation and inspection and reports accordingly, possibly with a modified opinion on IFCoFR.

Did you get it right without looking?

One question tells you little. A timed set on Risk Assessment and Internal Control shows your real accuracy, how long you take and where you lose marks.

Practise Risk Assessment and Internal ControlFree diagnostic mock

More Risk Assessment and Internal Control questions