Statements on Auditing Standards Nos. 109 and 110 require:
• Identifying the risks of material misstatements at the financial statement level and at the assertion level for relevant assertions in significant accounts.
• Identifying the controls that mitigate the risks and determining they are properly designed and implemented.
• Determining reductions in substantive tests that can be achieved by relying on internal controls, i.e., by performing tests of controls.
• Assessing and documenting control risk.
In this process, auditors need to understand the client’s financial reporting system and the significance of key or entity level controls. The financial reporting system understanding includes:
• The flow of information through significant transactions cycles that affect material financial statement classifications:
o Sales and collections—cash, accounts receivable, sales
o Payments and acquisitions—cash, accounts payable, purchases, fixed assets, expenses
o Payroll—salaries and wages, payroll expense, payroll withholdings and accruals
• The flow of information that includes data, documents, source records and journals, accounting system procedures and internal control activities.
In addition, auditors are required to document their understanding of an audit client’s IT system, accounting records and supporting information, as well as significant general ledger accounts. Analyzing the general ledger, performing system’s walk-through procedures and preparing efficient internal control documentation will accomplish the requirements in professional standards to understand a small audit client’s business and environment.
Preparing efficient documenation of an internal control system for a small client will usually include, among other things, modifhying internal control questionnaires used for larger clients to accomodate the needs of smaller entities. I have a Small Audits Internal Control Questionnaire under development which I'll email to you when you make a contact request on our webiste, www.cpafirmsupport.com. Please post a comment and describe your internal control documentation process for small audits.