Documentation (Ref: Para. 38)Documentation (Ref: Para. 38)

Documentation (Ref: Para. 38)

1. For recurring audits, certain documentation may be carried forward, updated as necessary to reflect changes in the entity’s business or processes.
2. ASA 230 notes that, among other considerations, although there may be no single way in which the auditor’s exercise of professional scepticism is documented, the audit documentation may nevertheless provide evidence of the auditor’s exercise of professional scepticism.[66] For example, when the audit evidence obtained from risk assessment procedures includes evidence that both corroborates and contradicts management’s assertions, the documentation may include how the auditor evaluated that evidence, including the professional judgements made in evaluating whether the audit evidence provides an appropriate basis for the auditor’s identification and assessment of the risks of material misstatement. Examples of other requirements in this ASA for which documentation may provide evidence of the exercise of professional scepticism by the auditor include:

• Paragraph 13, which requires the auditor to design and perform risk assessment procedures in a manner that is not biased towards obtaining audit evidence that may corroborate the existence of risks or towards excluding audit evidence that may contradict the existence of risks;
• Paragraph 17, which requires a discussion among key engagement team members of the application of the applicable financial reporting framework and the susceptibility of the entity’s financial report to material misstatement;
• Paragraphs 19(b) and 20, which require the auditor to obtain an understanding of the reasons for any changes to the entity’s accounting policies and to evaluate whether the entity’s accounting policies are appropriate and consistent with the applicable financial reporting framework;
• Paragraphs 21(b), 22(b), 23(b), 24(c), 25(c), 26(d) and 27, which require the auditor to evaluate, based on the required understanding obtained, whether the components of the entity’s system of internal control are appropriate to the entity’s circumstances considering the nature and complexity of the entity, and to determine whether one of more control deficiencies have been identified;
• Paragraph 35, which requires the auditor to take into account all audit evidence obtained from the risk assessment procedures, whether corroborative or contradictory to assertions made by management, and to evaluate whether the audit evidence obtained from the risk assessment procedures provides an appropriate basis for the identification and assessment of the risks of material misstatement; and
• Paragraph 36, which requires the auditor to evaluate, when applicable, whether the auditor’s determination that there are no risks of material misstatement for a material class of transactions, account balance or disclosure remains appropriate.