Amendments to ASA 330
- Existing footnote 1 of paragraph 1 is amended to read as follows:
See ASA 315, Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment
- Existing paragraph 6 is amended to read as follows:
The auditor shall design and perform further audit procedures whose nature, timing and extent are based on and are responsive to the assessed risks of material misstatement at the assertion level. (Ref: Para. A4–A8; A44-A55)
- Existing paragraph 7 is amended to read as follows:
In designing the further audit procedures to be performed, the auditor shall:
-
Consider the reasons for the assessment given to the risk of material misstatement at the assertion level for each significant class of transactions, account balance, and disclosure, including:
- The likelihood and magnitude of material misstatement due to the particular characteristics of the relevant significant class of transactions, account balance, or disclosure (that is, the inherent risk); and
- Whether the risk assessment takes account of relevant controls that address the risk of material misstatement (that is, the control risk), thereby requiring the auditor to obtain audit evidence to determine whether the controls are operating effectively (that is, the auditor intends to rely onplans to test the operating effectiveness of controls in determining the nature, timing and extent of substantive procedures); and (Ref: Para. A9–A18)
-
Obtain more persuasive audit evidence the higher the auditor’s assessment of risk. (Ref: Para. A19)
-
Existing paragraph 8 is amended to read as follows:
The auditor shall design and perform tests of controls to obtain sufficient appropriate audit evidence as to the operating effectiveness of relevant controls if:
-
The auditor’s assessment of risks of material misstatement at the assertion level includes an expectation that the controls are operating effectively (that is, the auditor intends plans to test to rely on the operating effectiveness of controls in determining the nature, timing and extent of substantive procedures); or
-
Substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level. (Ref: Para. A20–A24)
-
Existing paragraph 10 is amended to read as follows:
In designing and performing tests of controls, the auditor shall:
-
Perform other audit procedures in combination with enquiry to obtain audit evidence about the operating effectiveness of the controls, including:
- How the controls were applied at relevant times during the period under audit;
- The consistency with which they were applied; and
- By whom or by what means they were applied. (Ref: Para. A26–A30)
-
To the extent not already addressed, dDetermine whether the controls to be tested depend upon other controls (indirect controls), and, if so, whether it is necessary to obtain audit evidence supporting the effective operation of those indirect controls. (Ref: Para. A32-A33)
-
Existing paragraph 13 is amended to read as follows:
In determining whether it is appropriate to use audit evidence about the operating effectiveness of controls obtained in previous audits, and, if so, the length of the time period that may elapse before retesting a control, the auditor shall consider the following:
- The effectiveness of other elements components of the entity’s system of internal control, including the control environment, the entity’s process to monitoring of the system of internal controls, and the entity’s risk assessment process;
…
- Existing paragraph 14 is amended to read as follows:
If the auditor plans to use audit evidence from a previous audit about the operating effectiveness of specific controls, the auditor shall establish the continuing relevance and reliability of that evidence by obtaining audit evidence about whether significant changes in those controls have occurred subsequent to the previous audit. The auditor shall obtain this evidence by performing enquiry combined with observation or inspection, to confirm the understanding of those specific controls, and:
…
- Existing paragraph 15 is amended to read as follows:
If the auditor plans intends to rely on controls over a risk the auditor has determined to be a significant risk, the auditor shall test those controls in the current period.
- Existing paragraph 16 is amended to read as follows:
When evaluating the operating effectiveness of relevant controls upon which the auditor intends to rely, the auditor shall evaluate whether misstatements that have been detected by substantive procedures indicate that controls are not operating effectively. The absence of misstatements detected by substantive procedures, however, does not provide audit evidence that controls related to the assertion being tested are effective. (Ref: Para. A42)
- Existing paragraph 17 is amended to read as follows:
If deviations from controls upon which the auditor intends to rely are detected, the auditor shall make specific enquiries to understand these matters and their potential consequences, and shall determine whether: (Ref: Para. A41A43)
…
(c) The potential risks of material misstatement need to be addressed using substantive procedures.
- Existing paragraph 27 is amended to read as follows:
If the auditor has not obtained sufficient appropriate audit evidence as to related to a an material financial statement relevant assertion about a class of transactions, account balance or disclosure, the auditor shall attempt to obtain further audit evidence. If the auditor is unable to obtain sufficient appropriate audit evidence, the auditor shall express a qualified opinion or disclaim an opinion on the financial report.
- Existing paragraph A1 is amended to read as follows:
Overall responses to address the assessed risks of material misstatement at the financial statement level may include:
Emphasising to the engagement team the need to maintain professional scepticism.
Assigning more experienced staff or those with special skills or using experts.
Providing more supervision Changes to the nature, timing and extent of direction and supervision of members of the engagement team and the review of the work performed.
Incorporating additional elements of unpredictability in the selection of further audit procedures to be performed.
Changes to the overall audit strategy as required by ASA 300, or planned audit procedures, and may include changes to:
o The auditor’s determination of performance materiality in accordance with ASA 320.
o The auditor’s plans to tests the operating effectiveness of controls, and the persuasiveness of audit evidence needed to support the planned reliance on the operating effectiveness of the controls, particularly when deficiencies in the control environment or the entity’s monitoring activities are identified.
o The nature, timing and extent of substantive procedures. For example, it may be appropriate to perform substantive procedures at or near the date of the financial report when the risk of material misstatement is assessed as higher.
Making general changes to the nature, timing or extent of audit procedures, for example: performing substantive procedures at the period end instead of at an interim date; or modifying the nature of audit procedures to obtain more persuasive audit evidence.
- Existing paragraph A4 is amended to read as follows:
The auditor’s assessment of the identified risks of material misstatement at the assertion level provides a basis for considering the appropriate audit approach for designing and performing further audit procedures. For example, the auditor may determine that:
- Only by performing tests of controls may the auditor achieve an effective response to the assessed risk of material misstatement for a particular assertion;
- Performing only substantive procedures is appropriate for particular assertions and, therefore, the auditor excludes the effect of controls from the relevant risk assessment of the risk of material misstatement. This may be because the auditor’s risk assessment procedures have not identified any effective controls relevant to the assertion, or because auditor has not identified a risk for which substantive procedures alone cannot provide sufficient appropriate audit evidence and therefore is not required to test the operating effectiveness of controls. testing controls would be inefficient and Ttherefore, the auditor does may not intend to rely on plan to test the operating effectiveness of controls in determining the nature, timing and extent of substantive procedures; or
- A combined approach using both tests of controls and substantive procedures is an effective approach.
The auditor need not design and perform further audit procedures where the assessment of the risk of material misstatement is below the acceptably low level. However, as required by paragraph 18, irrespective of the approach selected and the assessed risk of material misstatement, the auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure.
- Existing paragraph A7 is amended to read as follows:
Extent of an audit procedure refers to the quantity to be performed, for example, a sample size or the number of observations of a control activity.
- Existing paragraph A9 is amended to read as follows and footnote 2 is inserted:
ASA 315 requires that the auditor’s assessment of the risks of material misstatement at the assertion level is performed by assessing inherent risk and control risk. The auditor assesses inherent risk by assessing the likelihood and magnitude of a misstatement taking into account how, and the degree to which the inherent risk factors affect the susceptibility to misstatement of relevant assertions.[2] The auditor’s assessed risks, including the reasons for those assessed risks, may affect both the types of audit procedures to be performed and their combination. For example, when an assessed risk is high, the auditor may confirm the completeness of the terms of a contract with the counterparty, in addition to inspecting the document. Further, certain audit procedures may be more appropriate for some assertions than others. For example, in relation to revenue, tests of controls may be most responsive to the assessed risk of material misstatement of the completeness assertion, whereas substantive procedures may be most responsive to the assessed risk of material misstatement of the occurrence assertion.
- As a result of the footnote insertion above, subsequent footnotes of this Auditing Standard are re-numbered and references to these footnotes are updated accordingly.
- Existing paragraph A10 is amended to read as follows:
The reasons for the assessment given to a risk are relevant in determining the nature of audit procedures. For example, if an assessed risk is lower because of the particular characteristics of a class of transactions without consideration of the related controls, then the auditor may determine that substantive analytical procedures alone provide sufficient appropriate audit evidence. On the other hand, if the assessed risk is lower because of internal the auditor plans to test the operating effectiveness of controls, and the auditor intends to base the substantive procedures on that low assessment, then the auditor performs tests of those controls, as required by paragraph 8(a). This may be the case, for example, for a class of transactions of reasonably uniform, non-complex characteristics that are routinely processed and controlled by the entity’s information system.
- Existing paragraph A18 is amended to read as follows:
In the case of very small entities, there may not be many controls activities that could be identified by the auditor, or the extent to which their existence or operation have been documented by the entity may be limited. In such cases, it may be more efficient for the auditor to perform further audit procedures that are primarily substantive procedures. In some rare cases, however, the absence of controls activities or of other components of the system of internal control may make it impossible to obtain sufficient appropriate audit evidence.
- Existing paragraph A20 is amended to read as follows:
Tests of controls are performed only on those controls that the auditor has determined are suitably designed to prevent, or detect and correct, a material misstatement in an relevant assertion, and the auditor plans to test those controls. If substantially different controls were used at different times during the period under audit, each is considered separately.
- Existing paragraph A24 is amended to read as follows:
In some cases, the auditor may find it impossible to design effective substantive procedures that by themselves provide sufficient appropriate audit evidence at the assertion level.[4] This may occur when an entity conducts its business using IT and no documentation of transactions is produced or maintained, other than through the IT system. In such cases, paragraph 8(b) requires the auditor to perform tests of relevant controls that address the risk for which substantive procedures alone cannot provide sufficient appropriate audit evidence.
- Existing paragraph A27 is amended to read as follows:
The nature of the particular control influences the type of procedure required to obtain audit evidence about whether the control was operating effectively. For example, if operating effectiveness is evidenced by documentation, the auditor may decide to inspect it to obtain audit evidence about operating effectiveness. For other controls, however, documentation may not be available or relevant. For example, documentation of operation may not exist for some factors in the control environment, such as assignment of authority and responsibility, or for some types of controls activities, such as automated controls activities performed by a computer. In such circumstances, audit evidence about operating effectiveness may be obtained through enquiry in combination with other audit procedures such as observation or the use of CAATs.
- Existing paragraph A29 is amended to read as follows:
Because of the inherent consistency of IT processing, it may not be necessary to increase the extent of testing of an automated control. An automated controls can be expected to function consistently unless the program IT application (including the tables, files, or other permanent data used by the program IT application) is changed. Once the auditor determines that an automated control is functioning as intended (which could be done at the time the control is initially implemented or at some other date), the auditor may consider performing tests to determine that the control continues to function effectively. Such tests might may include testing the general IT controls related to the IT application. determining that:
Changes to the program are not made without being subject to the appropriate program change controls;
The authorised version of the program is used for processing transactions; and
Other relevant general controls are effective.
Such tests also might include determining that changes to the programs have not been made, as may be the case when the entity uses packaged software applications without modifying or maintaining them. For example, the auditor may inspect the record of the administration of IT security to obtain audit evidence that unauthorised access has not occurred during the period.
- The following paragraph A30 is inserted following existing paragraph A29 of this Auditing Standard:
Similarly, the auditor may perform tests of controls that address risks of material misstatement related to the integrity of the entity’s data, or the completeness and accuracy of the entity’s system-generated reports, or to address risks of material misstatement for which substantive procedures alone cannot provide sufficient appropriate audit evidence. These tests of controls may include tests of general IT controls that address the matters in paragraph 10(a). When this is the case, the auditor may not need to perform any further testing to obtain audit evidence about the matters in paragraph 10(a).
- The following paragraph A31 has been inserted following the insertion of paragraph A30 above:
When the auditor determines that a general IT control is deficient, the auditor may consider the nature of the related risk(s) arising from the use of IT that were identified in accordance with ASA 315[5] to provide the basis for the design of the auditor’s additional procedures to address the assessed risk of material misstatement. Such procedures may address determining whether:
The related risk(s) arising from IT has occurred. For example, if users have unauthorised access to an IT application (but cannot access or modify the system logs that track access), the auditor may inspect the system logs to obtain audit evidence that those users did not access the IT application during the period.
There are any alternate or redundant general IT controls, or any other controls, that address the related risk(s) arising from the use of IT. If so, the auditor may identify such controls (if not already identified) and therefore evaluate their design, determine that they have been implemented and perform tests of their operating effectiveness. For example, if a general IT control related to user access is deficient, the entity may have an alternate control whereby IT management reviews end user access reports on a timely basis. Circumstances when an application control may address a risk arising from the use of IT may include when the information that may be affected by the general IT control deficiency can be reconciled to external sources (e.g., a bank statement) or internal sources not affected by the general IT control deficiency (e.g., a separate IT application or data source).
- Existing paragraph A30 is amended to read as follows:
In some circumstances, it may be necessary to obtain audit evidence supporting the effective operation of indirect controls (e.g., general IT controls). As explained in paragraphs A29 to A29b, general IT controls may have been identified in accordance with ASA 315 because of their support of the operating effectiveness of automated controls or due to their support in maintaining the integrity of information used in the entity’s financial reporting, including system-generated reports. The requirement in paragraph 10(b) acknowledges that the auditor may have already tested certain indirect controls to address the matters in paragraph 10(a). For example, when the auditor decides to test the effectiveness of a user review of exception reports detailing sales in excess of authorised credit limits, the user review and related follow up is the control that is directly of relevance to the auditor. Controls over the accuracy of the information in the reports (for example, general IT controls) are described as “indirect” controls.
- Existing paragraph A31 has been deleted.
- Existing paragraph A32 has been amended to read as follows:
Audit evidence pertaining only to a point in time may be sufficient for the auditor’s purpose, for example, when testing controls over the entity’s physical inventory counting at the period end. If, on the other hand, the auditor intends to rely on a control over a period, tests that are capable of providing audit evidence that the control operated effectively at relevant times during that period are appropriate. Such tests may include tests of controls in the entity’s process to monitoring of the system of internal controls.
- Existing paragraph A35 has been amended to read as follows:
In certain circumstances, audit evidence obtained from previous audits may provide audit evidence where the auditor performs audit procedures to establish its continuing relevance and reliability. For example, in performing a previous audit, the auditor may have determined that an automated control was functioning as intended. The auditor may obtain audit evidence to determine whether changes to the automated control have been made that affect its continued effective functioning through, for example, enquiries of management and the inspection of logs to indicate what controls have been changed. Consideration of audit evidence about these changes may support either increasing or decreasing the expected audit evidence to be obtained in the current period about the operating effectiveness of the controls.
- Existing paragraph A36 has been amended to read as follows:
Changes may affect the relevance and reliability of the audit evidence obtained in previous audits such that there may no longer be a basis for continued reliance. For example, changes in a system that enable an entity to receive a new report from the system probably do not affect the relevance of audit evidence from a previous audit; however, a change that causes data to be accumulated or calculated differently does affect it.
- Existing paragraph A38 is amended to read as follows:
In general, the higher the risk of material misstatement, or the greater the reliance on controls, the shorter the time period elapsed, if any, is likely to be. Factors that may decrease the period for retesting a control, or result in not relying on audit evidence obtained in previous audits at all, include the following:
…
A Ddeficiencyt in the entity’s process to monitoring of the system of internal controls.
A significant manual element to the relevant controls.
…
- Existing paragraph A42 and the title are amended to read as follows:
Substantive Procedures (Ref: Para. 6, 18)
Paragraph 18 requires the auditor to design and perform substantive procedures for each material class of transactions, account balance, and disclosure, irrespective of the assessed risks of material misstatement. For significant classes of transactions, account balances and disclosures, substantive procedures may have already been performed because paragraph 6 requires the auditor to design and perform further audit procedures that are responsive to the assessed risks of material misstatement at the assertion level. Accordingly, substantive procedures are required to be designed and performed in accordance with paragraph 18:
When the further audit procedures for significant classes of transactions, account balances or disclosures, designed and performed in accordance with paragraph 6, did not include substantive procedures; or
For each class of transactions, account balance or disclosure that is not a significant class of transactions, account balance or disclosure, but that has been identified as material in accordance with ASA 315.[7]
This requirement reflects the facts that: (a) the auditor’s assessment of risk is judgemental and so may not identify all risks of material misstatement; and (b) there are inherent limitations to internal controls, including management override.
- The following paragraph A45 is inserted following existing paragraph A42 of this Auditing Standard:
Not all assertions within a material class of transactions, account balance or disclosure are required to be tested. Rather, in designing the substantive procedures to be performed, the auditor’s consideration of the assertion(s) in which, if a misstatement were to occur, there is a reasonable possibility of the misstatement being material, may assist in identifying the appropriate nature, timing and extent of the procedures to be performed.
- Existing paragraph A45 is amended to read as follows:
The nature assessment of the risk and or the nature of the assertion is relevant to the design of tests of details. For example, tests of details related to the existence or occurrence assertion may involve selecting from items contained in a financial statement amount and obtaining the relevant audit evidence. On the other hand, tests of details related to the completeness assertion may involve selecting from items that are expected to be included in the relevant financial statement amount and investigating whether they are included.
- Existing paragraph A46 is amended to read as follows:
Because the assessment of the risk of material misstatement takes account of internal controls that the auditor plans to test, the extent of substantive procedures may need to be increased when the results from tests of controls are unsatisfactory. However, increasing the extent of an audit procedure is appropriate only if the audit procedure itself is relevant to the specific risk.
- Existing paragraph A56 is amended to read as follows:
Performing substantive procedures at an interim date without undertaking additional procedures at a later date increases the risk that the auditor will not detect misstatements that may exist at the period end. This risk increases as the remaining period is lengthened. Factors such as the following may influence whether to perform substantive procedures at an interim date:
The control environment and other relevant controls.
…
- Existing paragraph A57 is amended to read as follows:
Factors such as the following may influence whether to perform substantive analytical procedures with respect to the period between the interim date and the period end:
…
Whether the information system relevant to financial reporting will provide information concerning the balances at the period end and the transactions in the remaining period that is sufficient to permit investigation of:
…
- Existing paragraph A60 is amended to read as follows:
An audit of financial report is a cumulative and iterative process. As the auditor performs planned audit procedures, the audit evidence obtained may cause the auditor to modify the nature, timing or extent of other planned audit procedures. Information may come to the auditor’s attention that differs significantly from the information on which the risk assessment was based. For example:
…
In such circumstances, the auditor may need to re-evaluate the planned audit procedures, based on the revised consideration of assessed risks of material misstatement for all or some of and the effect on the significant classes of transactions, account balances, or disclosures and related their relevant assertions. ASA 315 contains further guidance on revising the auditor’s risk assessment.[10]
- Existing paragraph A62 is amended to read as follows:
The auditor’s judgement as to what constitutes sufficient appropriate audit evidence is influenced by such factors as the following:
…
Understanding of the entity and its environment, the applicable financial reporting framework and including the entity’s system of internal control.
- Existing paragraph A63 is amended to read as follows:
The form and extent of audit documentation is a matter of professional judgement, and is influenced by the nature, size and complexity of the entity and its system of internal control, availability of information from the entity and the audit methodology and technology used in the audit.
- As a result of the footnotes insertion above, all footnotes of this Auditing Standard are re-numbered and references to these footnotes are updated accordingly.