Understanding the Entity, Its Environment and Internal Control
ASA/ISA 315 requires the auditor to obtain an understanding of the entity, its environment, and its system of internal control sufficient to identify and assess risks of material misstatement. This understanding covers industry and regulatory factors, business model, accounting policies, objectives and strategies, and the five components of internal control: control environment, risk assessment process, information system and communication, control activities, and monitoring activities.
Understand the control environment (tone at the top, governance, ethics) and control activities (authorisation, segregation of duties, reconciliations, IT general controls). Distinguish preventive from detective controls, and manual from automated controls. Know that understanding controls is mandatory, but testing controls is only required if the auditor intends to rely on them (or when substantive procedures alone cannot provide sufficient evidence, e.g. highly automated environments).
Identify significant risks and risks requiring special audit consideration, including fraud, related parties, and management override. Understand the entity-level controls and how they affect the nature of further procedures.
Traps: confusing understanding controls with testing controls; assuming all controls must be tested; overlooking IT general controls; and failing to identify management override as a risk in every audit.
Rule of thumb: you must understand controls in every audit, but you only test operating effectiveness when you plan to rely on them. Management override is always a significant risk.