Management Practices and the Control Environment
The preliminary data gathering effort allows the auditor to verify that the scope has been set correctly, and also to form a set of control objectives, which will be the basis for audit testing. Control objectives are management practices which are expected to be in place in order to achieve control over the systems to the extent required to meet the audit objective. Auditors will repeatedly emphasize that control objectives are management practices. It is expected that the control objectives have been consciously established by management, that management provides leadership and resources to achieve control objectives, and that management monitors the environment to ensure that control objectives are met. Control environment is management behavior that provides leadership and accountability for controls; it is synonymous with the succinct phrase: the tone is set at the top. It is an absolute and nonnegotiable requirement for every audit that management responsibility with respect to system operation be undeniably clear to all within the organization under review.