Entity’s Risk Assessment ProcessEntity’s Risk Assessment Process

Entity’s Risk Assessment Process

1. For financial reporting purposes, the entity’s risk assessment process includes how management identifies business risks relevant to the preparation of the financial report in accordance with the entity’s applicable financial reporting framework, estimates their significance, assesses the likelihood of their occurrence, and decides upon actions to respond to and manage them and the results thereof. For example, the entity’s risk assessment process may address how the entity considers the possibility of unrecorded transactions or identifies and analyses significant estimates recorded in the financial report.
2. Risks relevant to reliable financial reporting include external and internal events, transactions or circumstances that may occur and adversely affect an entity’s ability to initiate, record, process, and report financial data consistent with the assertions of management in the financial report. Management may initiate plans, programs, or actions to address specific risks or it may decide to accept a risk because of cost or other considerations. Risks can arise or change due to circumstances such as the following:

• Changes in operating environment. Changes in the regulatory or operating environment can result in changes in competitive pressures and significantly different risks.
• New personnel. New personnel may have a different focus on or understanding of internal control.
• New or revamped information systems. Significant and rapid changes in information systems can change the risk relating to internal control.
• Rapid growth. Significant and rapid expansion of operations can strain controls and increase the risk of a breakdown in controls.
• New technology. Incorporating new technologies into production processes or information systems may change the risk associated with internal control.
• New business models, products, or activities. Entering into business areas or transactions with which an entity has little experience may introduce new risks associated with internal control.
• Corporate restructurings. Restructurings may be accompanied by staff reductions and changes in supervision and segregation of duties that may change the risk associated with internal control.
• Expanded foreign operations. The expansion or acquisition of foreign operations carries new and often unique risks that may affect internal control, for example, additional or changed risks from foreign currency transactions.
• New accounting pronouncements. Adoption of new accounting principles or changing accounting principles may affect risks in preparing the financial report.