Risk Assessment Procedures and Related ARisk Assessment Procedures and Related Activities

Risk Assessment Procedures and Related Activities

1. When performing risk assessment procedures and related activities to obtain an understanding of the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control, required by ASA 315, the auditor shall perform the procedures in paragraphs 18‑25 of this Auditing Standard to obtain information for use in identifying the risks of material misstatement due to fraud.

Management and Others within the Entity

1. The auditor shall make enquiries of management regarding:
   1. Management’s assessment of the risk that the financial report may be materially misstated due to fraud, including the nature, extent and frequency of such assessments; (Ref: Para. A13‑A14)
   2. Management’s process for identifying and responding to the risks of fraud in the entity, including any specific risks of fraud that management has identified or that have been brought to its attention, or classes of transactions, account balances, or disclosures for which a risk of fraud is likely to exist; (Ref: Para. A15)
   3. Management’s communication, if any, to those charged with governance regarding its processes for identifying and responding to the risks of fraud in the entity; and
   4. Management’s communication, if any, to employees regarding its views on business practices and ethical behaviour.
2. The auditor shall make enquiries of management, and others within the entity as appropriate, to determine whether they have knowledge of any actual, suspected or alleged fraud affecting the entity. (Ref: Para. A16‑A18)
3. For those entities that have an internal audit function, the auditor shall make enquiries of appropriate individuals within the function to determine whether they have knowledge of any actual, suspected or alleged fraud affecting the entity, and to obtain its views about the risks of fraud. (Ref: Para. A19)

Those Charged with Governance

1. Unless all of those charged with governance are involved in managing the entity,[7] the auditor shall obtain an understanding of how those charged with governance exercise oversight of management’s processes for identifying and responding to the risks of fraud in the entity and the controls that management has established to mitigate these risks. (Ref: Para. A20‑A22)
2. Unless all of those charged with governance are involved in managing the entity, the auditor shall make enquiries of those charged with governance to determine whether they have knowledge of any actual, suspected or alleged fraud affecting the entity. These enquiries are made in part to corroborate the responses to the enquiries of management.