Existing paragraph 7 is amended to read as follows:
Furthermore, the risk of the auditor not detecting a material misstatement resulting from management fraud is greater than for employee fraud, because management is frequently in a position to directly or indirectly manipulate accounting records, present fraudulent financial information or override controls procedures designed to prevent similar frauds by other employees.
Existing footnote 6 in paragraph 16 is amended to read as follows:
See ASA 315, paragraph 17‒18 10
Existing paragraph 17 is amended to read as follows:
When performing risk assessment procedures and related activities to obtain an understanding of the entity and its environment, the applicable financial reporting framework and including the entity’s system of internal control, required by ASA 315,7 the auditor shall perform the procedures in paragraphs 2317–4324 to obtain information for use in identifying the risks of material misstatement due to fraud.
Existing paragraph 21 is amended to read as follows:
Unless all of those charged with governance are involved in managing the entity,8 the auditor shall obtain an understanding of how those charged with governance exercise oversight of management’s processes for identifying and responding to the risks of fraud in the entity and the internal controls that management has established to mitigate these risks. (Ref: Para. A20-A22)
Existing footnote 9 in paragraph 26 is amended to read as follows:
See ASA 315, paragraph 2825
Existing paragraph 28 is amended to read as follows:
The auditor shall treat those assessed risks of material misstatement due to fraud as significant risks and accordingly, to the extent not already done so, the auditor shall obtain an understanding of the entity’s related identify the entity’s controls, including control activities, relevant to that address such risks, and evaluate their design and determine whether they have been implemented).[10] (Ref: Para. A32-A33)
As a result of the footnote insertion above, subsequent footnotes of this Auditing Standard are re-numbered and references to these footnotes are updated accordingly.
Existing paragraph 45 is amended to read as follows:
The auditor shall include the following in the audit documentation12 of the auditor’s understanding of the entity and its environment and of the identification and the assessment of the risks of material misstatement required by ASA 315:
The significant decisions reached during the discussion among the engagement team regarding the susceptibility of the entity’s financial report to material misstatement due to fraud; and
The identified and assessed risks of material misstatement due to fraud at the financial statement level and at the assertion level;. and
Identified controls in the control activities component that address assessed risks of material misstatement due to fraud.
Existing paragraph A8 is amended to read as follows:
Maintaining professional scepticism requires an ongoing questioning of whether the information and audit evidence obtained suggests that a material misstatement due to fraud may exist. It includes considering the reliability of the information to be used as audit evidence and the identified controls in the control activities component, if any, over its preparation and maintenance. where relevant. Due to the characteristics of fraud, the auditor’s professional scepticism is particularly important when considering the risks of material misstatement due to fraud.
Existing footnote 17 of paragraph A19 is amended to read as follows:
See ASA 315, paragraphs 14(a) and 24(a)(ii)6 and 23, and ISA 610, Using the Work of Internal Auditors
Existing paragraph A20 is amended to read as follows:
Those charged with governance of an entity oversee the entity’s systems for monitoring risk, financial control and compliance with the law. In many countries, corporate governance practices are well developed and those charged with governance play an active role in oversight of the entity’s assessment of the risks of fraud and of the relevant internal control the controls that address such risks. Since the responsibilities of those charged with governance and management may vary by entity and by country, it is important that the auditor understands their respective responsibilities to enable the auditor to obtain an understanding of the oversight exercised by the appropriate individuals.[18]
Existing paragraph A21 is amended to read as follows:
An understanding of the oversight exercised by those charged with governance may provide insights regarding the susceptibility of the entity to management fraud, the adequacy of internal controls that address over risks of fraud, and the competency and integrity of management. The auditor may obtain this understanding in a number of ways, such as by attending meetings where such discussions take place, reading the minutes from such meetings or making enquiries of those charged with governance.
Existing paragraph A23 is amended to read as follows:
In addition to information obtained from applying analytical procedures, other information obtained about the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control may be helpful in identifying the risks of material misstatement due to fraud. The discussion among team members may provide information that is helpful in identifying such risks. In addition, information obtained from the auditor’s client acceptance and retention processes, and experience gained on other engagements performed for the entity, for example, engagements to review interim financial information, may be relevant in the identification of the risks of material misstatement due to fraud.
Existing paragraph A26 is amended to read as follows:
Examples of fraud risk factors related to fraudulent financial reporting and misappropriation of assets are presented in Appendix 1. These illustrative risk factors are classified based on the three conditions that are generally present when fraud exists:
An incentive or pressure to commit fraud;
A perceived opportunity to commit fraud; and
An ability to rationalise the fraudulent action.
Fraud risk factors may relate to incentives, pressures or opportunities that arise from conditions that create susceptibility to misstatement, before consideration of controls. Fraud risk factors, which include intentional management bias, are, insofar as they affect inherent risk, inherent risk factors.[20] Fraud risk factors may also relate to conditions within the entity’s system of internal control that provide opportunity to commit fraud or that may affect management’s attitude or ability to rationalise fraudulent actions. Fraud rRisk factors reflective of an attitude that permits rationalisation of the fraudulent action may not be susceptible to observation by the auditor. Nevertheless, the auditor may become aware of the existence of such information through, for example, the required understanding of the entity’s control environment.[21] Although the fraud risk factors described in Appendix 1 cover a broad range of situations that may be faced by auditors, they are only examples and other risk factors may exist.
Existing footnote 19 in paragraph A32 is amended to read as follows:
See ASA 315, paragraph A48A75.
Existing paragraph A33 is amended to read as follows:
It is therefore important for the auditor to obtain an understanding of the controls that management has designed, implemented and maintained to prevent and detect fraud. In doing so, In identifying the controls that address the risks of material misstatement due to fraud, the auditor may learn, for example, that management has consciously chosen to accept the risks associated with a lack of segregation of duties. Information from obtaining this understanding identifying these controls, and evaluating their design and determining whether they have been implemented, may also be useful in identifying fraud risks factors that may affect the auditor’s assessment of the risks that the financial report may contain material misstatement due to fraud.
The following footnote 23, is inserted to paragraph A43 of this Auditing Standard, following the wording “Further, the auditor’s consideration of the risks of material misstatement associated with inappropriate override of controls over journal entries”.
See ASA 315, paragraph 26(a)(ii)
As a result of the footnote insertion above, subsequent footnotes of this Auditing Standard are re-numbered and references to these footnotes are updated accordingly.
Existing paragraph A44 is amended to read as follows:
When identifying and selecting journal entries and other adjustments for testing and determining the appropriate method of examining the underlying support for the items selected, the following matters are of relevance:
The identification and assessment of the risks of material misstatement due to fraud – the presence of fraud risk factors and other information obtained during the auditor’s identification and assessment of the risks of material misstatement due to fraud may assist the auditor to identify specific classes of journal entries and other adjustments for testing.
…
The entity’s financial reporting process and the nature of evidence that can be obtained – for many entities routine processing of transactions involves a combination of manual and automated steps and procedures controls. Similarly, the processing of journal entries and other adjustments may involve both manual and automated procedures and controls. Where information technology is used in the financial reporting process, journal entries and other adjustments may exist only in electronic form.
…
Journal entries or other adjustments processed outside the normal course of business – non standard journal entries may not be subject to the same level of internal nature and extent of controls as those journal entries used on a recurring basis to record transactions such as monthly sales, purchases and cash disbursements.
Existing Appendix 1 is amended to read as follows: