25.140 When forming an opinion on internal control, the audit team should evaluate all evidence obtained, including:
• management’s assessment and its report
• matters identified in reports issued by internal auditors (or similar functions)
• the results of tests of controls
• identified control deficiencies and whether they, individually or in combination, represent significant deficiencies or material weaknesses (additional guidance below)
• results of substantive procedures performed during the financial statement audit, specifically recorded adjustments and misstatements. Identified misstatements indicate that internal control failed to prevent or detect an error and correcting the misstatement does not eliminate the deficiency nor mitigate the finding