Describe how management and the auditor decide on which locations or business units to test

The approach followed by management in choosing which locations to include in its assessment of internal control is a function of the presence of entity-level controls and the financial reporting risk at the individual locations or business units. When controls that are necessary to address financial reporting risks operate at more than one location or business unit, management needs to evaluate evidence of the operation of the controls at the individual locations or business units. When management determines that the financial reporting risks for the controls at an individual location are high, management will normally need to directly test the operation of the controls at that location.