Section Audit Procedures Responsive to the Asses - ASA 330 - The Auditor’s Responses to Assessed Risks - October 2009 - Audit Procedures Responsive to the Assessed Risks of Material Misstatement at the Assertion Level | Zoe
Audit Procedures Responsive to the Assessed Risks of Material Misstatement at the Assertion Level
The auditor shall design and perform further audit procedures whose nature, timing, and extent are based on and are responsive to the assessed risks of material misstatement at the assertion level. (Ref: Para. A4-A8; A43-A54)
In designing the further audit procedures to be performed, the auditor shall:
Consider the reasons for the assessment given to the risk of material misstatement at the assertion level for each significant class of transactions, account balance, and disclosure, including:
The likelihood and magnitude of misstatement due to the particular characteristics of the significant class of transactions, account balance, or disclosure (that is, the inherent risk); and
Whether the risk assessment takes account of controls that address the risk of material misstatement (that is, the control risk), thereby requiring the auditor to obtain audit evidence to determine whether the controls are operating effectively (that is, the auditor plans to test the operating effectiveness of controls in determining the nature, timing and extent of substantive procedures); and (Ref: Para. A9-A18)
Obtain more persuasive audit evidence the higher the auditor’s assessment of risk.
(Ref: Para. A19)
Tests of Controls
The auditor shall design and perform tests of controls to obtain sufficient appropriate audit evidence as to the operating effectiveness of controls if:
The auditor’s assessment of risks of material misstatement at the assertion level includes an expectation that the controls are operating effectively (that is, the auditor plans to test the operating effectiveness of controls in determining the nature, timing and extent of substantive procedures); or
Substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level. (Ref: Para. A20-A24)
In designing and performing tests of controls, the auditor shall obtain more persuasive audit evidence the greater the reliance the auditor places on the effectiveness of a control.
(Ref: Para. A25)
Nature and Extent of Tests of Controls
In designing and performing tests of controls, the auditor shall:
Perform other audit procedures in combination with enquiry to obtain audit evidence about the operating effectiveness of the controls, including:
How the controls were applied at relevant times during the period under audit;
The consistency with which they were applied; and
By whom or by what means they were applied. (Ref: Para. A26-A30)
To the extent not already addressed, determine whether the controls to be tested depend upon other controls (indirect controls), and if so, whether it is necessary to obtain audit evidence supporting the effective operation of those indirect controls. (Ref: Para. A32-A33)
Timing of Tests of Controls
The auditor shall test controls for the particular time, or throughout the period, for which the auditor intends to rely on those controls, subject to paragraphs 12 and 15 of this Auditing Standard, in order to provide an appropriate basis for the auditor’s intended reliance.
(Ref: Para. A33)
Using audit evidence obtained during an interim period
If the auditor obtains audit evidence about the operating effectiveness of controls during an interim period, the auditor shall:
Obtain audit evidence about significant changes to those controls subsequent to the interim period; and
Determine the additional audit evidence to be obtained for the remaining period.
(Ref: Para. A34-A35)
Using audit evidence obtained in previous audits
In determining whether it is appropriate to use audit evidence about the operating effectiveness of controls obtained in previous audits, and, if so, the length of the time period that may elapse before retesting a control, the auditor shall consider the following:
The effectiveness of other components of the entity’s system of internal control, including the control environment, the entity’s process to monitor the system of internal control, and the entity’s risk assessment process;
The risks arising from the characteristics of the control, including whether it is manual or automated;
The effectiveness of general IT-controls;
The effectiveness of the control and its application by the entity, including the nature and extent of deviations in the application of the control noted in previous audits, and whether there have been personnel changes that significantly affect the application of the control;
Whether the lack of a change in a particular control poses a risk due to changing circumstances; and
The risks of material misstatement and the extent of reliance on the control.
(Ref: Para. A36)
If the auditor plans to use audit evidence from a previous audit about the operating effectiveness of specific controls, the auditor shall establish the continuing relevance and reliability of that evidence by obtaining audit evidence about whether significant changes in those controls have occurred subsequent to the previous audit. The auditor shall obtain this evidence by performing enquiry combined with observation or inspection, to confirm the understanding of those specific controls, and:
If there have been changes that affect the continuing relevance of the audit evidence from the previous audit, the auditor shall test the controls in the current audit.
(Ref: Para. A37)
If there have not been such changes, the auditor shall test the controls at least once in every third audit, and shall test some controls each audit to avoid the possibility of testing all the controls on which the auditor intends to rely in a single audit period with no testing of controls in the subsequent two audit periods. (Ref: Para. A38-A40)
Controls over significant risks
If the auditor intends to rely on controls over a risk the auditor has determined to be a significant risk, the auditor shall test those controls in the current period.
Evaluating the Operating Effectiveness of Controls
When evaluating the operating effectiveness of controls upon which the auditor intends to rely, the auditor shall evaluate whether misstatements that have been detected by substantive procedures indicate that controls are not operating effectively. The absence of misstatements detected by substantive procedures, however, does not provide audit evidence that controls related to the assertion being tested are effective. (Ref: Para. A41)
If deviations from controls upon which the auditor intends to rely are detected, the auditor shall make specific enquiries to understand these matters and their potential consequences, and shall determine whether: (Ref: Para. A42)
The tests of controls that have been performed provide an appropriate basis for reliance on the controls;
Additional tests of controls are necessary; or
The risks of material misstatement need to be addressed using substantive procedures.
Substantive Procedures
Irrespective of the assessed risks of material misstatement, the auditor shall design and perform substantive procedures for each material class of transactions, account balance, and disclosure. (Ref: Para. A43-A49)
The auditor shall consider whether external confirmation procedures are to be performed as substantive audit procedures. (Ref: Para. A50-A53)
Substantive Procedures Related to the Financial Report Closing Process
The auditor’s substantive procedures shall include the following audit procedures related to the financial report closing process:
Agreeing or reconciling information in the financial report with the underlying accounting records, including agreeing or reconciling information in disclosures, whether such information is obtained from within or outside of the general and subsidiary ledgers; and
Examining material journal entries and other adjustments made during the course of preparing the financial report. (Ref: Para. A54)
Substantive Procedures Responsive to Significant Risks
If the auditor has determined that an assessed risk of material misstatement at the assertion level is a significant risk, the auditor shall perform substantive procedures that are specifically responsive to that risk. When the approach to a significant risk consists only of substantive procedures, those procedures shall include tests of details. (Ref: Para. A55)
If substantive procedures are performed at an interim date, the auditor shall cover the remaining period by performing:
substantive procedures, combined with tests of controls for the intervening period; or
if the auditor determines that it is sufficient, further substantive procedures only,
that provide a reasonable basis for extending the audit conclusions from the interim date to the period end. (Ref: Para. A56-A59)
If misstatements that the auditor did not expect when assessing the risks of material misstatement are detected at an interim date, the auditor shall evaluate whether the related assessment of risk and the planned nature, timing, or extent of substantive procedures covering the remaining period need to be modified. (Ref: Para. A60)