Evaluating the Sufficiency and AppropriaEvaluating the Sufficiency and Appropriateness of Audit Evidence Obtained

Evaluating the Sufficiency and Appropriateness of Audit Evidence Obtained

90 Based on the audit procedures performed and the audit evidence obtained, the auditor shall evaluate whether the assessments of the risks of material misstatement at the assertion level remain appropriate.

91 An audit of a financial report is a cumulative and iterative process. As the auditor performs planned audit procedures, the audit evidence obtained may cause the auditor to modify the nature, timing, or extent of other planned audit procedures. Information may come to the auditor’s attention that differs significantly from the information on which the risk assessment was based. For example, the extent of misstatements that the auditor detects by performing substantive procedures may alter the auditor’s judgement about the risk assessments and may indicate a material weakness in internal control. In addition, analytical procedures performed at the overall review stage of the audit may indicate a previously unrecognised risk of material misstatement. In such circumstances, the auditor may need to reevaluate the planned audit procedures, based on the revised consideration of assessed risks for all or some of the classes of transactions, account balances, or disclosures and related assertions. ASA 315 contains further explanatory guidance on revising the auditor’s risk assessment.

92 The concept of effectiveness of the operation of controls recognises that some deviations in the way controls are applied by the entity may occur. Deviations from prescribed controls may be caused by such factors as changes in key personnel, significant seasonal fluctuations in volume of transactions and human error. When such deviations are detected during the performance of tests of controls, the auditor ordinarily makes specific enquiries to understand these matters and their potential consequences, for example, by enquiring about the timing of personnel changes in key internal control functions. The auditor ordinarily determines whether the tests of controls performed provide an appropriate basis for reliance on the controls, whether additional tests of controls are necessary, or whether the potential risks of misstatement need to be addressed using substantive procedures.

93 The auditor cannot assume that an instance of fraud or error is an isolated occurrence, and therefore ordinarily considers how the detection of a misstatement affects the assessed risks of material misstatement. Before the conclusion of the audit, under paragraphs 90 and 97 of this Auditing Standard, the auditor needs to evaluate whether audit risk has been reduced to an acceptably low level and whether the nature, timing, and extent of the audit procedures may need to be reconsidered. For example, the auditor reconsiders the following:

• the nature, timing, and extent of substantive procedures; and