118For this purpose, the auditor ordinarily:

118 For this purpose, the auditor ordinarily:

• Identifies risks throughout the process of obtaining an understanding of the entity and its environment, including relevant controls that relate to the risks, and by considering the classes of transactions, account balances, and disclosures in the financial report.
• Relates the identified risks to what can go wrong at the assertion level.
• Considers whether the risks are of a magnitude that could result in a material misstatement of the financial report.
• Considers the likelihood that the risks could result in a material misstatement of the financial report.

119 The auditor uses information gathered by performing risk assessment procedures, including the audit evidence obtained in evaluating the design of controls and determining whether they have been implemented, as audit evidence to support the risk assessment. Under ASA 330, the auditor needs to use the risk assessment to determine the nature, timing, and extent of further audit procedures to be performed.

120 Under paragraph 117 of this Auditing Standard, the auditor needs to determine whether the identified risks of material misstatement relate to specific classes of transactions, account balances, and disclosures and related assertions, or whether they relate more pervasively to the financial report as a whole and potentially affect many assertions. The latter risks (risks at the financial report level) may derive in particular from a weak control environment.

121 The nature of the risks arising from a weak control environment is such that they are not likely to be confined to specific individual risks of material misstatement in particular classes of transactions, account balances, and disclosures. Rather, weaknesses such as management’s lack of competence may have a more pervasive effect on the financial report and may require an overall response by the auditor.

122 In making risk assessments, the auditor may identify the controls that are likely to prevent, or detect and correct, material misstatement in specific assertions. Generally, the auditor gains an understanding of controls and relates them to assertions in the context of processes and systems in which they exist. Doing so is useful because individual control activities often do not in themselves address a risk. Often only multiple control activities, together with other elements of internal control, will be sufficient to address a risk.

123 Conversely, some control activities may have a specific effect on an individual assertion embodied in a particular class of transactions or account balance. For example, the control activities that an entity established to ensure that its personnel are properly counting and recording the annual physical inventory relate directly to the existence and completeness assertions for the inventory account balance.