Auditing Standard ASA 315 Identifying and Assessing the Risks of Material Misstatement
IntroductionIntroduction
Start here
Get a plain-English read of Introduction
Turn the raw legal text into a practical explanation grounded in Auditing Standard ASA 315 Identifying and Assessing the Risks of Material Misstatement.
The Auditing and Assurance Standards Board (AUASB) made Auditing Standard ASA 315 Identifying and Assessing the Risks of Material Misstatement pursuant to section 227B of the Australian Securities and Investments Commission Act 2001 and section 336 of the Corporations Act 2001, on 4 February 2020.
This compiled version of ASA 315 incorporates subsequent amendments contained in another Auditing Standard made by the AUASB up to and including 27 April 2022 (see Compilation Details).
Auditing Standard ASA 315
Identifying and Assessing the Risks of Material Misstatement
Application
Aus 0.1 This Auditing Standard applies to:
(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with the Corporations Act 2001; and
(b) an audit of a financial report, or a complete set of financial statements, for any other purpose.
Aus 0.2 This Auditing Standard also applies, as appropriate, to an audit of other historical financial information.
Operative Date
Aus 0.3 This Auditing Standard is operative for financial reporting periods commencing on or after 15 December 2021. [Note: For operative dates of paragraphs changed or added by an Amending Standard, see Compilation Details.]
Introduction
Scope of this Auditing Standard
This Auditing Standard deals with the auditor’s responsibility to identify and assess the risks of material misstatement in the financial report.
Key Concepts in this ASA
ASA 200 deals with the overall objectives of the auditor in conducting an audit of the financial report,[1] including to obtain sufficient appropriate audit evidence to reduce audit risk to an acceptably low level.[2] Audit risk is a function of the risks of material misstatement and detection risk.[3] ASA 200 explains that the risks of material misstatement may exist at two levels:[4] the overall financial report level; and the assertion level for classes of transactions, account balances and disclosures.
ASA 200 requires the auditor to exercise professional judgement in planning and performing an audit, and to plan and perform an audit with professional scepticism recognising that circumstances may exist that cause the financial report to be materially misstated.[5]
Risks at the financial report level relate pervasively to the financial report as a whole and potentially affect many assertions. Risks of material misstatement at the assertion level consist of two components, inherent and control risk:
Inherent risk is described as the susceptibility of an assertion about a class of transaction, account balance or disclosure to a misstatement that could be material, either individually or when aggregated with other misstatements, before consideration of any related controls.
Control risk is described as the risk that a misstatement that could occur in an assertion about a class of transaction, account balance or disclosure and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity’s system of internal control.
ASA 200 explains that risks of material misstatement are assessed at the assertion level in order to determine the nature, timing and extent of further audit procedures necessary to obtain sufficient appropriate audit evidence.[6] For the identified risks of material misstatement at the assertion level, a separate assessment of inherent risk and control risk is required by this ASA. As explained in ASA 200, inherent risk is higher for some assertions and related classes of transactions, account balances and disclosures than for others. The degree to which inherent risk varies is referred to in this ASA as the ‘spectrum of inherent risk.’
Risks of material misstatement identified and assessed by the auditor include both those due to error and those due to fraud. Although both are addressed by this ASA, the significance of fraud is such that further requirements and guidance are included in ASA 240[7] in relation to risk assessment procedures and related activities to obtain information that is used to identify, assess and respond to the risks of material misstatement due to fraud.
The auditor’s risk identification and assessment process is iterative and dynamic. The auditor’s understanding of the entity and its environment, the applicable financial reporting framework, and the entity’s system of internal control are interdependent with concepts within the requirements to identify and assess the risks of material misstatement. In obtaining the understanding required by this ASA, initial expectations of risks may be developed, which may be further refined as the auditor progresses through the risk identification and assessment process. In addition, this ASA and ASA 330 require the auditor to revise the risk assessments, and modify further overall responses and further audit procedures, based on audit evidence obtained from performing further audit procedures in accordance with ASA 330, or if new information is obtained.
ASA 330 requires the auditor to design and implement overall responses to address the assessed risks of material misstatement at the financial report level.[8] ASA 330 further explains that the auditor’s assessment of the risks of material misstatement at the financial report level, and the auditor’s overall responses, is affected by the auditor’s understanding of the control environment. ASA 330 also requires the auditor to design and perform further audit procedures whose nature, timing and extent are based on and are responsive to the assessed risks of material misstatement at the assertion level.[9]
Scalability
ASA 200 states that some ASAs include scalability considerations which illustrate the application of the requirements to all entities regardless of whether their nature and circumstances are less complex or more complex.[10] This ASA is intended for audits of all entities, regardless of size or complexity and the application material therefore incorporates specific considerations specific to both less and more complex entities, where appropriate. While the size of an entity may be an indicator of its complexity, some smaller entities may be complex and some larger entities may be less complex.
Effective Date
[Deleted by the AUASB. Refer to Aus 0.3]
Objective
The objective of the auditor is to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial report and assertion levels thereby providing a basis for designing and implementing responses to the assessed risks of material misstatement.
Definitions
For the purposes of this Auditing Standard, the following terms have the meanings attributed below:
(a) Assertions – Representations, explicit or otherwise, with respect to the recognition, measurement, presentation and disclosure of information in the financial report which are inherent in management representing that the financial report is prepared in accordance with the applicable financial reporting framework. Assertions are used by the auditor to consider the different types of potential misstatements that may occur when identifying, assessing and responding to the risks of material misstatement. (Ref: Para. A1)
(b) Business risk – A risk resulting from significant conditions, events, circumstances, actions or inactions that could adversely affect an entity’s ability to achieve its objectives and execute its strategies, or from the setting of inappropriate objectives and strategies.
(c) Controls – Policies or procedures that an entity establishes to achieve the control objectives of management or those charged with governance. In this context: (Ref: Para. A2–A5)
Policies are statements of what should, or should not, be done within the entity to effect control. Such statements may be documented, explicitly stated in communications, or implied through actions and decisions.
Procedures are actions to implement policies.
(d) General information technology (IT) controls – Controls over the entity’s IT processes that support the continued proper operation of the IT environment, including the continued effective functioning of information processing controls and the integrity of information (i.e., the completeness, accuracy and validity of information) in the entity’s information system. Also see the definition of IT environment.
(e) Information processing controls – Controls relating to the processing of information in IT applications or manual information processes in the entity’s information system that directly address risks to the integrity of information (i.e., the completeness, accuracy and validity of transactions and other information). (Ref: Para. A6)
(f) Inherent risk factors – Characteristics of events or conditions that affect susceptibility to misstatement, whether due to fraud or error, of an assertion about a class of transactions, account balance or disclosure, before consideration of controls. Such factors may be qualitative or quantitative, and include complexity, subjectivity, change, uncertainty or susceptibility to misstatement due to management bias or other fraud risk factors[11] insofar as they affect inherent risk. (Ref: Para. A7–A8)
(g) IT environment – The IT applications and supporting IT infrastructure, as well as the IT processes and personnel involved in those processes, that an entity uses to support business operations and achieve business strategies. For the purposes of this ASA:
An IT application is a program or a set of programs that is used in the initiation, processing, recording and reporting of transactions or information. IT applications include data warehouses and report writers.
The IT infrastructure comprises the network, operating systems, and databases and their related hardware and software.
The IT processes are the entity’s processes to manage access to the IT environment, manage program changes or changes to the IT environment and manage IT operations.
(h) Relevant assertions – An assertion about a class of transactions, account balance or disclosure is relevant when it has an identified risk of material misstatement. The determination of whether an assertion is a relevant assertion is made before consideration of any related controls (i.e., the inherent risk). (Ref: Para. A9)
(i) Risks arising from the use of IT – Susceptibility of information processing controls to ineffective design or operation, or risks to the integrity of information (i.e., the completeness, accuracy and validity of transactions and other information) in the entity’s information system, due to ineffective design or operation of controls in the entity’s IT processes (see IT environment).
(j) Risk assessment procedures – The audit procedures designed and performed to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial report and assertion levels.
(k) Significant class of transactions, account balance or disclosure – A class of transactions, account balance or disclosure for which there is one or more relevant assertions.
(l) Significant risk – An identified risk of material misstatement: (Ref: Para. A10)
For which the assessment of inherent risk is close to the upper end of the spectrum of inherent risk due to the degree to which inherent risk factors affect the combination of the likelihood of a misstatement occurring and the magnitude of the potential misstatement should that misstatement occur; or
That is to be treated as a significant risk in accordance with the requirements of other ASAs.[12]
(m) System of internal control – The system designed, implemented and maintained by those charged with governance, management and other personnel, to provide reasonable assurance about the achievement of an entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations. For the purposes of the ASAs, the system of internal control consists of five inter-related components:
Control environment;
The entity’s risk assessment process;
The entity’s process to monitor the system of internal control;
The information system and communication; and
Control activities.
Requirements
Risk Assessment Procedures and Related Activities
The auditor shall design and perform risk assessment procedures to obtain audit evidence that provides an appropriate basis for: (Ref: Para. A11–A18)
The identification and assessment of risks of material misstatement, whether due to fraud or error, at the financial report and assertion levels; and
The design of further audit procedures in accordance with ASA 330.
The auditor shall design and perform risk assessment procedures in a manner that is not biased towards obtaining audit evidence that may be corroborative or towards excluding audit evidence that may be contradictory. (Ref: Para. A14)
The risk assessment procedures shall include the following: (Ref: Para. A19–A21)
(a) Enquiries of management and of other appropriate individuals within the entity, including individuals within the internal audit function (if the function exists). (Ref: Para. A22–A26)
(b) Analytical procedures. (Ref: Para. A27–A31)
(c) Observation and inspection. (Ref: Para. A32–A36)
Information from Other Sources
In obtaining audit evidence in accordance with paragraph 13, the auditor shall consider information from: (Ref: Para. A37‒A38)
(a) The auditor’s procedures regarding acceptance or continuance of the client relationship or the audit engagement; and
(b) When applicable, other engagements performed by the engagement partner for the entity.
When the auditor intends to use information obtained from the auditor’s previous experience with the entity and from audit procedures performed in previous audits, the auditor shall evaluate whether such information remains relevant and reliable as audit evidence for the current audit. (Ref: Para. A39‒A41)
Engagement Team Discussion
The engagement partner and other key engagement team members shall discuss the application of the applicable financial reporting framework and the susceptibility of the entity’s financial report to material misstatement. (Ref: Para. A42–A47)
When there are engagement team members not involved in the engagement team discussion, the engagement partner shall determine which matters are to be communicated to those members.
Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework and the Entity’s System of Internal Control (Ref: Para. A48‒A49)
Understanding the Entity and Its Environment, and the Applicable Financial Reporting Framework (Ref: Para. A50‒A55)
The auditor shall perform risk assessment procedures to obtain an understanding of:
The following aspects of the entity and its environment:
The entity’s organisational structure, ownership and governance, and its business model, including the extent to which the business model integrates the use of IT; (Ref: Para. A56‒A67)
Industry, regulatory and other external factors; (Ref: Para. A68‒A73) and
The measures used, internally and externally, to assess the entity’s financial performance; (Ref: Para. A74‒A81)
The applicable financial reporting framework, and the entity’s accounting policies and the reasons for any changes thereto; (Ref: Para. A82‒A84) and
How inherent risk factors affect susceptibility of assertions to misstatement and the degree to which they do so, in the preparation of the financial report in accordance with the applicable financial reporting framework, based on the understanding obtained in (a) and (b). (Ref: Para. A85‒A89)
The auditor shall evaluate whether the entity’s accounting policies are appropriate and consistent with the applicable financial reporting framework.
Understanding the Components of the Entity’s System of Internal Control (Ref: Para. A90 – A95)
Control Environment, the Entity’s Risk Assessment Process and the Entity’s Process to Monitor the System of Internal Control (Ref: Para. A96‒A98)
Control environment
<table cellspacing="0" cellpadding="0" style="width:454.3pt; margin-right:9pt; margin-left:9pt; border:0.75pt solid #000000; border-collapse:collapse; float:left"><thead><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>21.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the control environment relevant to the preparation of the financial report, through performing risk assessment procedures, by: </span><span class="RefParas">(Ref: Para. A99–A100)</span></p></td></tr></thead><tbody><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span><span>(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding the set of controls, processes and structures that address: </span><span class="RefParas">(Ref: Para. A101‒A102)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>How management’s oversight responsibilities are carried out, such as the entity’s culture and management’s commitment to integrity and ethical values;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>When those charged with governance are separate from management, the independence of, and oversight over the entity’s system of internal control by, those charged with governance;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The entity’s assignment of authority and responsibility;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iv)</span></span><span style="width:19.57pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>How the entity attracts, develops, and retains competent individuals; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt; margin-bottom:13pt"><span><span>(v)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>How the entity holds individuals accountable for their responsibilities in the pursuit of the objectives of the system of internal control;</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p><span>and</span></p><p class="ParaLevel2" style="margin-left:35.45pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(b)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Evaluating whether: </span><span class="RefParas">(Ref: Para. A103‒A108)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Management, with the oversight of those charged with governance, has created and maintained a culture of honesty and ethical behaviour;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The control environment provides an appropriate foundation for the other components of the entity’s system of internal control considering the nature and complexity of the entity; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt; margin-bottom:13pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Control deficiencies identified in the control environment undermine the other components of the entity’s system of internal control.</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td></tr></tbody></table>
The entity’s risk assessment process
<table cellspacing="0" cellpadding="0" style="width:454.3pt; border:0.75pt solid #000000; border-collapse:collapse"><tbody><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>22.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the entity’s risk assessment process relevant to the preparation of the financial report, through performing risk assessment procedures, by:</span></p></td></tr><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span><span>(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding the entity’s process for: </span><span class="RefParas">(Ref: Para. A109‒A110)</span></p><ol class="awlist1" style="margin:0pt; padding-left:0pt"><li id="navPoint_52" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt; font-size:9pt"><span style="width:26.96pt; font:7pt 'Times New Roman'; display:inline-block"></span><span style="font-size:11pt">Identifying business risks relevant to financial reporting objectives; </span><span class="RefParas">(Ref: Para. A62)</span></li><li id="navPoint_53" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Assessing the significance of those risks, including the likelihood of their occurrence; and</span></li><li id="navPoint_54" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Addressing those risks;</span></li></ol><p class="ParaPlain" style="margin-top:10pt"><span></span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p><span>and</span></p><ol class="awlist9" style="margin:0pt; padding-left:0pt"><li class="ListParagraph" style="margin-left:35.45pt; margin-bottom:10pt; text-indent:-35.45pt"><span style="width:19.26pt; font:7pt 'Times New Roman'; display:inline-block"></span><span style="display:none"></span><ol class="awlist10" style="margin-right:0pt; margin-left:0pt; padding-left:0pt"><li class="ListParagraph" style="margin-top:10pt; margin-left:35.45pt; margin-bottom:10pt"><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"></span><span style="display:none"></span></li><li id="navPoint_55" class="AParaLevel2" style="margin-top:10pt; margin-left:0pt"><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Evaluating whether the entity’s risk assessment process is appropriate to the entity’s circumstances considering the nature and complexity of the entity.</span><span> </span><span class="RefParas">(Ref: Para. A111‒A113)</span></li></ol></li></ol><p class="ParaPlain" style="margin-top:10pt"><span></span></p></td></tr></tbody></table>
If the auditor identifies risks of material misstatement that management failed to identify, the auditor shall:
Determine whether any such risks are of a kind that the auditor expects would have been identified by the entity’s risk assessment process and, if so, obtain an understanding of why the entity’s risk assessment process failed to identify such risks of material misstatement; and
Consider the implications for the auditor’s evaluation in paragraph 22(b).
The entity’s process to monitor the system of internal control
<table cellspacing="0" cellpadding="0" style="width:454.3pt; margin-right:9pt; margin-left:9pt; border:0.75pt solid #000000; border-collapse:collapse; float:left"><thead><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>24.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the entity’s process for monitoring the system of internal control relevant to the preparation of the financial report, through performing risk assessment procedures, by: </span><span class="RefParas">(Ref: Para. A114–A115)</span></p></td></tr></thead><tbody><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span><span>(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding those aspects of the entity’s process that address:</span></p><ol class="awlist1" style="margin:0pt; padding-left:0pt"><li id="navPoint_59" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Ongoing and separate evaluations for monitoring the effectiveness of controls, and the identification and remediation of control deficiencies identified; </span><span class="RefParas">(Ref: Para. A116‒A117) </span><span>and</span></li><li id="navPoint_60" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt; font-size:9pt"><span style="width:24.45pt; font:7pt 'Times New Roman'; display:inline-block"></span><span style="font-size:11pt">The entity’s internal audit function, if any, including its nature, responsibilities and activities; </span><span class="RefParas">(Ref: Para. A118)</span></li></ol><p class="ParaLevel2" style="margin-top:10pt; margin-left:35.45pt; margin-bottom:13pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(b)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding the sources of the information used in the entity’s process to monitor the system of internal control, and the basis upon which management considers the information to be sufficiently reliable for the purpose; </span><span class="RefParas">(Ref: Para. A119‒A120)</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p><span>and</span></p><p class="ParaLevel2" style="margin-left:35.45pt; margin-bottom:13pt"><span><span>(c)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Evaluating whether the entity’s process for monitoring the system of internal control is appropriate to the entity’s circumstances considering the nature and complexity of the entity.</span><span> </span><span class="RefParas">(Ref: Para. A121‒A122)</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td></tr></tbody></table>
Information System and Communication, and Control Activities (Ref: Para. A123–A130)
The information system and communication
<table cellspacing="0" cellpadding="0" style="width:454.3pt; margin-right:9.05pt; margin-left:9.05pt; border:0.75pt solid #000000; border-collapse:collapse; float:left"><tbody><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>25.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the entity’s information system and communication relevant to the preparation of the financial report, through performing risk assessment procedures, by: </span><span class="RefParas">(Ref: Para. A131)</span></p></td></tr><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding the entity’s information processing activities, including its data and information, the resources to be used in such activities and the policies that define, for significant classes of transactions, account balances and disclosures: </span><span class="RefParas">(Ref: Para. A132‒A143)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>How information flows through the entity’s information system, including how:</span></p><ol class="awlist12" style="margin:0pt; padding-left:0pt"><li class="ParaLevel3" style="margin-top:10pt"><span style="width:27.82pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Transactions are initiated, and how information about them is recorded, processed, corrected as necessary, incorporated in the general ledger and reported in the financial report; and</span></li><li class="ParaLevel3" style="margin-top:10pt"><span style="width:27.2pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Information about events and conditions, other than transactions, is captured, processed and disclosed in the financial report;</span></li></ol><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The accounting records, specific accounts in the financial report and other supporting records relating to the flows of information in the information system;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The financial reporting process used to prepare the entity’s financial report, including disclosures; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iv)</span></span><span style="width:19.57pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The entity’s resources, including the IT environment, relevant to (a)(i) to (a)(iii) above;</span></p><p class="ParaLevel2" style="margin-top:10pt; margin-left:35.45pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(b)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding how the entity communicates significant matters that support the preparation of the financial report and related reporting responsibilities in the information system and other components of the system of internal control: </span><span class="RefParas">(Ref: Para. A144‒A145)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Between people within the entity, including how financial reporting roles and responsibilities are communicated;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Between management and those charged with governance; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt; margin-bottom:13pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>With external parties, such as those with regulatory authorities;</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="TableRow"><span>and</span></p><p class="ParaLevel2" style="margin-top:3pt; margin-left:35.45pt"><span><span>(c)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Evaluating whether the entity’s information system and communication appropriately support the preparation of the entity’s financial report in accordance with the applicable financial reporting framework. </span><span class="RefParas">(Ref: Para. A146)</span></p></td></tr></tbody></table>
Control activities
<table cellspacing="0" cellpadding="0" style="width:454.3pt; margin-right:9pt; margin-left:9pt; border:0.75pt solid #000000; border-collapse:collapse; float:left"><thead><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>26.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the control activities component, through performing risk assessment procedures, by: </span><span class="RefParas">(Ref: Para. A147–A157)</span></p></td></tr></thead><tbody><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span><span>(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Identifying controls that address risks of material misstatement at the assertion level in the control activities component as follows:</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Controls that address a risk that is determined to be a significant risk; </span><span class="RefParas">(Ref: Para. A158‒A159)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Controls over journal entries, including non-standard journal entries used to record non-recurring, unusual transactions or adjustments; </span><span class="RefParas">(Ref: Para. A160‒A161)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Controls for which the auditor plans to test operating effectiveness in determining the nature, timing and extent of substantive testing, which shall include controls that address risks for which substantive procedures alone do not provide sufficient appropriate audit evidence; and </span><span class="RefParas">(Ref: Para. A162‒A164)</span><span></span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(iv)</span></span><span style="width:19.57pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Other controls that the auditor considers are appropriate to enable the auditor to meet the objectives of paragraph 13 with respect to risks at the assertion level, based on the auditor’s professional judgement; </span><span class="RefParas">(Ref: Para. A165)</span></p><p class="ParaLevel2" style="margin-top:10pt; margin-left:35.45pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(b)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Based on controls identified in (a), identifying the IT applications and the other aspects of the entity’s IT environment that are subject to risks arising from the use of IT; </span><span class="RefParas">(Ref: Para. A166‒A172)</span></p><p class="ParaLevel2" style="margin-top:10pt; margin-left:35.45pt"><span><span>(c)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>For such IT applications and other aspects of the IT environment identified in (b), identifying: </span><span class="RefParas">(Ref: Para. A173‒A174)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The related risks arising from the use of IT; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The entity’s general IT controls that address such risks.</span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="TableRow"><span>and</span></p><p class="ParaLevel2" style="margin-top:3pt; margin-left:35.45pt"><span><span>(d)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>For each control identified in (a) or (c)(ii): </span><span class="RefParas">(Ref: Para. A175‒A181)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Evaluating whether the control is designed effectively to address the risk of material misstatement at the assertion level, or effectively designed to support the operation of other controls; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Determining whether the control has been implemented by performing procedures in addition to enquiry of the entity’s personnel.</span></p></td></tr></tbody></table>
Control Deficiencies Within the Entity’s System of Internal Control
Based on the auditor’s evaluation of each of the components of the entity’s system of internal control, the auditor shall determine whether one or more control deficiencies have been identified. (Ref: Para. A182–A183)
Identifying and Assessing the Risks of Material Misstatement (Ref: Para. A184‒A185)
Identifying Risks of Material Misstatement
The auditor shall identify the risks of material misstatement and determine whether they exist at: (Ref: Para. A186–A192)
(a) The financial report level; (Ref: Para. A193–A200) or
(b) The assertion level for classes of transactions, account balances and disclosures. (Ref: Para. A201)
The auditor shall determine the relevant assertions and the related significant classes of transactions, account balances and disclosures. (Ref: Para. A202–A204)
Assessing Risks of Material Misstatement at the Financial Report Level
For identified risks of material misstatement at the financial report level, the auditor shall assess the risks and: (Ref: Para. A193–A200)
(a) Determine whether such risks affect the assessment of risks at the assertion level; and
(b) Evaluate the nature and extent of their pervasive effect on the financial report.
Assessing Risks of Material Misstatement at the Assertion Level
Assessing Inherent Risk (Ref: Para. A205–A217)
For identified risks of material misstatement at the assertion level, the auditor shall assess inherent risk by assessing the likelihood and magnitude of misstatement. In doing so, the auditor shall take into account how, and the degree to which:
(a) Inherent risk factors affect the susceptibility of relevant assertions to misstatement; and
(b) The risks of material misstatement at the financial report level affect the assessment of inherent risk for risks of material misstatement at the assertion level. (Ref: Para. A215‒A216)
The auditor shall determine whether any of the assessed risks of material misstatement are significant risks. (Ref: Para. A218–A221)
The auditor shall determine whether substantive procedures alone cannot provide sufficient appropriate audit evidence for any of the risks of material misstatement at the assertion level. (Ref: Para. A222–A225)
Assessing Control Risk
If the auditor plans to test the operating effectiveness of controls, the auditor shall assess control risk. If the auditor does not plan to test the operating effectiveness of controls, the auditor’s assessment of control risk shall be such that the assessment of the risk of material misstatement is the same as the assessment of inherent risk. (Ref: Para. A226–A229)
Evaluating the Audit Evidence Obtained from the Risk Assessment Procedures
The auditor shall evaluate whether the audit evidence obtained from the risk assessment procedures provides an appropriate basis for the identification and assessment of the risks of material misstatement. If not, the auditor shall perform additional risk assessment procedures until audit evidence has been obtained to provide such a basis. In identifying and assessing the risks of material misstatement, the auditor shall take into account all audit evidence obtained from the risk assessment procedures, whether corroborative or contradictory to assertions made by management. (Ref: Para. A230–A232)
Classes of Transactions, Account Balances and Disclosures that Are Not Significant, but Which Are Material
For material classes of transactions, account balances or disclosures that have not been determined to be significant classes of transactions, account balances or disclosures, the auditor shall evaluate whether the auditor’s determination remains appropriate. (Ref: Para. A233–A235)
Revision of Risk Assessment
If the auditor obtains new information which is inconsistent with the audit evidence on which the auditor originally based the identification or assessments of the risks of material misstatement, the auditor shall revise the identification or assessment. (Ref: Para. A236)
Documentation
The auditor shall include in the audit documentation:[13] (Ref: Para. A237–A241)
(a) The discussion among the engagement team and the significant decisions reached;
(b) Key elements of the auditor’s understanding in accordance with paragraphs 19, 21, 22, 24 and 25; the sources of information from which the auditor’s understanding was obtained; and the risk assessment procedures performed;
(c) The evaluation of the design of identified controls, and determination whether such controls have been implemented, in accordance with the requirements in paragraph 26; and
(d) The identified and assessed risks of material misstatement at the financial report level and at the assertion level, including significant risks and risks for which substantive procedures alone cannot provide sufficient appropriate audit evidence, and the rationale for the significant judgements made.
* * *
Application and Other Explanatory Material
Definitions (Ref: Para. 12)
Assertions (Ref: Para. 12(a))
Categories of assertions are used by auditors to consider the different types of potential misstatements that may occur when identifying, assessing and responding to the risks of material misstatement. Examples of these categories of assertions are described in paragraph A190. The assertions differ from the written representations required by ASA 580,[14] to confirm certain matters or support other audit evidence.
Controls (Ref: Para. 12(c))
Controls are embedded within the components of the entity’s system of internal control.
Policies are implemented through the actions of personnel within the entity, or through the restraint of personnel from taking actions that would conflict with such policies.
Procedures may be mandated, through formal documentation or other communication by management or those charged with governance, or may result from behaviours that are not mandated but are rather conditioned by the entity’s culture. Procedures may be enforced through the actions permitted by the IT applications used by the entity or other aspects of the entity’s IT environment.
Controls may be direct or indirect. Direct controls are controls that are precise enough to address risks of material misstatement at the assertion level. Indirect controls are controls that support direct controls.
Information Processing Controls (Ref: Para. 12(e))
Risks to the integrity of information arise from susceptibility to ineffective implementation of the entity’s information policies, which are policies that define the information flows, records and reporting processes in the entity’s information system. Information processing controls are procedures that support effective implementation of the entity’s information policies. Information processing controls may be automated (i.e., embedded in IT applications) or manual (e.g., input or output controls) and may rely on other controls, including other information processing controls or general IT controls.
Inherent Risk Factors (Ref: Para. 12(f))
Appendix 2 sets out further considerations relating to understanding inherent risk factors.
Inherent risk factors may be qualitative or quantitative and affect the susceptibility of assertions to misstatement. Qualitative inherent risk factors relating to the preparation of information required by the applicable financial reporting framework include:
Complexity;
Subjectivity;
Change;
Uncertainty; or
Susceptibility to misstatement due to management bias or other fraud risk factors insofar as they affect inherent risk.
Other inherent risk factors, that affect susceptibility to misstatement of an assertion about a class of transactions, account balance or disclosure may include:
The quantitative or qualitative significance of the class of transactions, account balance or disclosure; or
The volume or a lack of uniformity in the composition of the items to be processed through the class of transactions or account balance, or to be reflected in the disclosure.
Relevant Assertions (Ref: Para. 12(h))
A risk of material misstatement may relate to more than one assertion, in which case all the assertions to which such a risk relates are relevant assertions. If an assertion does not have an identified risk of material misstatement, then it is not a relevant assertion.
Significant Risk (Ref: Para. 12(l))
Significance can be described as the relative importance of a matter, and is judged by the auditor in the context in which the matter is being considered. For inherent risk, significance may be considered in the context of how, and the degree to which, inherent risk factors affect the combination of the likelihood of a misstatement occurring and the magnitude of the potential misstatement should that misstatement occur.
Risk Assessment Procedures and Related Activities (Ref: Para. 13–18)
The risks of material misstatement to be identified and assessed include both those due to fraud and those due to error, and both are covered by this ASA. However, the significance of fraud is such that further requirements and guidance are included in ASA 240 in relation to risk assessment procedures and related activities to obtain information that is used to identify and assess the risks of material misstatement due to fraud.[15] In addition, the following ASAs provide further requirements and guidance on identifying and assessing risks of material misstatement regarding specific matters or circumstances:
Professional scepticism is necessary for the critical assessment of audit evidence gathered when performing the risk assessment procedures, and assists the auditor in remaining alert to audit evidence that is not biased towards corroborating the existence of risks or that may be contradictory to the existence of risks. Professional scepticism is an attitude that is applied by the auditor when making professional judgements that then provides the basis for the auditor’s actions. The auditor applies professional judgement in determining when the auditor has audit evidence that provides an appropriate basis for risk assessment.
The application of professional scepticism by the auditor may include:
Questioning contradictory information and the reliability of documents;
Considering responses to enquiries and other information obtained from management and those charged with governance;
Being alert to conditions that may indicate possible misstatement due to fraud or error; and
Considering whether audit evidence obtained supports the auditor’s identification and assessment of the risks of material misstatement in light of the entity’s nature and circumstances.
Why Obtaining Audit Evidence in an Unbiased Manner Is Important (Ref: Para. 13)
Designing and performing risk assessment procedures to obtain audit evidence to support the identification and assessment of the risks of material misstatement in an unbiased manner may assist the auditor in identifying potentially contradictory information, which may assist the auditor in exercising professional scepticism in identifying and assessing the risks of material misstatement.
Sources of Audit Evidence (Ref: Para. 13)
Designing and performing risk assessment procedures to obtain audit evidence in an unbiased manner may involve obtaining evidence from multiple sources within and outside the entity. However, the auditor is not required to perform an exhaustive search to identify all possible sources of audit evidence. In addition to information from other sources[19], sources of information for risk assessment procedures may include:
Interactions with management, those charged with governance, and other key entity personnel, such as internal auditors.
Certain external parties such as regulators, whether obtained directly or indirectly.
Publicly available information about the entity, for example entity-issued press releases, materials for analysts or investor group meetings, analysts’ reports or information about trading activity.
Regardless of the source of information, the auditor considers the relevance and reliability of the information to be used as audit evidence in accordance with ASA 500.[20]
Scalability (Ref: Para. 13)
The nature and extent of risk assessment procedures will vary based on the nature and circumstances of the entity (e.g., the formality of the entity’s policies and procedures, and processes and systems). The auditor uses professional judgement to determine the nature and extent of the risk assessment procedures to be performed to meet the requirements of this ASA.
Although the extent to which an entity’s policies and procedures, and processes and systems are formalised may vary, the auditor is still required to obtain the understanding in accordance with paragraphs 19, 21, 22, 24, 25 and 26.
Examples:Some entities, including less complex entities, and particularly owner-managed entities, may not have established structured processes and systems (e.g., a risk assessment process or a process to monitor the system of internal control) or may have established processes or systems with limited documentation or a lack of consistency in how they are undertaken. When such systems and processes lack formality, the auditor may still be able to perform risk assessment procedures through observation and enquiry.Other entities, typically more complex entities, are expected to have more formalised and documented policies and procedures. The auditor may use such documentation in performing risk assessment procedures.
The nature and extent of risk assessment procedures to be performed the first time an engagement is undertaken may be more extensive than procedures for a recurring engagement. In subsequent periods, the auditor may focus on changes that have occurred since the preceding period.
Types of Risk Assessment Procedures (Ref: Para. 14)
ASA 500[21] explains the types of audit procedures that may be performed in obtaining audit evidence from risk assessment procedures and further audit procedures. The nature, timing and extent of the audit procedures may be affected by the fact that some of the accounting data and other evidence may only be available in electronic form or only at certain points in time.[22] The auditor may perform substantive procedures or tests of controls, in accordance with ASA 330, concurrently with risk assessment procedures, when it is efficient to do so. Audit evidence obtained that supports the identification and assessment of risks of material misstatement may also support the detection of misstatements at the assertion level or the evaluation of the operating effectiveness of controls.
Although the auditor is required to perform all the risk assessment procedures described in paragraph 14 in the course of obtaining the required understanding of the entity and its environment, the applicable financial reporting framework, and the entity’s system of internal control (see paragraphs 19–26), the auditor is not required to perform all of them for each aspect of that understanding. Other procedures may be performed when the information to be obtained may be helpful in identifying risks of material misstatement. Examples of such procedures may include making enquiries of the entity’s external legal counsel or external supervisors, or of valuation experts that the entity has used.
Automated Tools and Techniques (Ref: Para. 14)
Using automated tools and techniques, the auditor may perform risk assessment procedures on large volumes of data (from the general ledger, sub-ledgers or other operational data) including for analysis, recalculations, reperformance or reconciliations.
Enquiries of Management and Others within the Entity (Ref: Para. 14(a))
Why Enquiries Are Made of Management and Others Within the Entity
Information obtained by the auditor to support an appropriate basis for the identification and assessment of risks, and the design of further audit procedures, may be obtained through enquiries of management and those responsible for financial reporting.
Enquiries of management and those responsible for financial reporting and of other appropriate individuals within the entity and other employees with different levels of authority may offer the auditor varying perspectives when identifying and assessing risks of material misstatement.
Examples:Enquiries directed towards those charged with governance may help the auditor understand the extent of oversight by those charged with governance over the preparation of the financial report by management. ASA 260[23] identifies the importance of effective two-way communication in assisting the auditor to obtain information from those charged with governance in this regard.Enquiries of employees responsible for initiating, processing or recording complex or unusual transactions may help the auditor to evaluate the appropriateness of the selection and application of certain accounting policies.Enquiries directed towards in-house legal counsel may provide information about such matters as litigation, compliance with laws and regulations, knowledge of fraud or suspected fraud affecting the entity, warranties, post-sales obligations, arrangements (such as joint ventures) with business partners, and the meaning of contractual terms.Enquiries directed towards marketing or sales personnel may provide information about changes in the entity’s marketing strategies, sales trends, or contractual arrangements with its customers.Enquiries directed towards the risk management function (or enquiries of those performing such roles) may provide information about operational and regulatory risks that may affect financial reporting.Enquiries directed towards IT personnel may provide information about system changes, system or control failures, or other IT-related risks.
Considerations Specific to Public Sector Entities
When making enquiries of those who may have information that is likely to assist in identifying risks of material misstatement, auditors of public sector entities may obtain information from additional sources such as from the auditors that are involved in performance or other audits related to the entity.
Enquiries of the Internal Audit Function
Appendix 4 sets out considerations for understanding an entity’s internal audit function.
Why enquiries are made of the internal audit function (if the function exists)
If an entity has an internal audit function, enquiries of the appropriate individuals within the function may assist the auditor in understanding the entity and its environment, and the entity’s system of internal control, in the identification and assessment of risks.
Considerations specific to public sector entities
Auditors of public sector entities often have additional responsibilities with regard to internal control and compliance with applicable laws and regulations. Enquiries of appropriate individuals in the internal audit function may assist the auditors in identifying the risk of material non-compliance with applicable laws and regulations, and the risk of control deficiencies related to financial reporting.
Analytical Procedures (Ref: Para. 14(b))
Why Analytical Procedures Are Performed as a Risk Assessment Procedure
Analytical procedures help identify inconsistencies, unusual transactions or events, and amounts, ratios, and trends that indicate matters that may have audit implications. Unusual or unexpected relationships that are identified may assist the auditor in identifying risks of material misstatement, especially risks of material misstatement due to fraud.
Analytical procedures performed as risk assessment procedures may therefore assist in identifying and assessing the risks of material misstatement by identifying aspects of the entity of which the auditor was unaware or understanding how inherent risk factors, such as change, affect susceptibility of assertions to misstatement.
Types of Analytical Procedures
Analytical procedures performed as risk assessment procedures may:
Include both financial and non-financial information, for example, the relationship between sales and square footage of selling space or volume of goods sold (non-financial).
Use data aggregated at a high level. Accordingly, the results of those analytical procedures may provide a broad initial indication about the likelihood of a material misstatement.
Example:In the audit of many entities, including those with less complex business models and processes, and a less complex information system, the auditor may perform a simple comparison of information, such as the change in interim or monthly account balances from balances in prior periods, to obtain an indication of potentially higher risk areas.
This ASA deals with the auditor’s use of analytical procedures as risk assessment procedures. ASA 520[24] deals with the auditor's use of analytical procedures as substantive procedures (“substantive analytical procedures”) and the auditor’s responsibility to perform analytical procedures near the end of the audit. Accordingly, analytical procedures performed as risk assessment procedures are not required to be performed in accordance with the requirements of ASA 520. However, the requirements and application material in ASA 520 may provide useful guidance to the auditor when performing analytical procedures as part of the risk assessment procedures.
Automated tools and techniques
Analytical procedures can be performed using a number of tools or techniques, which may be automated. Applying automated analytical procedures to the data may be referred to as data analytics.
Example:The auditor may use a spreadsheet to perform a comparison of actual recorded amounts to budgeted amounts, or may perform a more advanced procedure by extracting data from the entity’s information system, and further analysing this data using visualization techniques to identify classes of transactions, account balances or disclosures for which further specific risk assessment procedures may be warranted.
Observation and Inspection (Ref: Para. 14(c))
Why Observation and Inspection Are Performed as Risk Assessment Procedures
Observation and inspection may support, corroborate or contradict enquiries of management and others, and may also provide information about the entity and its environment.
Scalability
Where policies or procedures are not documented, or the entity has less formalised controls, the auditor may still be able to obtain some audit evidence to support the identification and assessment of the risks of material misstatement through observation or inspection of the performance of the control.
Examples:The auditor may obtain an understanding of controls over an inventory count, even if they have not been documented by the entity, through direct observation.The auditor may be able to observe segregation of duties.The auditor may be able to observe passwords being entered.
Observation and Inspection as Risk Assessment Procedures
Risk assessment procedures may include observation or inspection of the following:
The entity’s operations.
Internal documents (such as business plans and strategies), records, and internal control manuals.
Reports prepared by management (such as quarterly management reports and interim financial reports) and those charged with governance (such as minutes of board of directors’ meetings).
The entity’s premises and plant facilities.
Information obtained from external sources such as trade and economic journals; reports by analysts, banks, or rating agencies; regulatory or financial publications; or other external documents about the entity’s financial performance (such as those referred to in paragraph A79).
The behaviours and actions of management or those charged with governance (such as the observation of an audit committee meeting).
Automated tools and techniques
Automated tools or techniques may also be used to observe or inspect, in particular assets, for example through the use of remote observation tools (e.g., a drone).
Considerations Specific to Public Sector Entities
Risk assessment procedures performed by auditors of public sector entities may also include observation and inspection of documents prepared by management for the legislature, for example documents related to mandatory performance reporting.
Information from Other Sources (Ref: Para. 15)
Why the Auditor Considers Information from Other Sources
Information obtained from other sources may be relevant to the identification and assessment of the risks of material misstatement by providing information and insights about:
The nature of the entity and its business risks, and what may have changed from previous periods.
The integrity and ethical values of management and those charged with governance, which may also be relevant to the auditor’s understanding of the control environment.
The applicable financial reporting framework and its application to the nature and circumstances of the entity.
Other Relevant Sources
Other relevant sources of information include:
The auditor’s procedures regarding acceptance or continuance of the client relationship or the audit engagement in accordance with ASA 220, including the conclusions reached thereon.[25]
Other engagements performed for the entity by the engagement partner. The engagement partner may have obtained knowledge relevant to the audit, including about the entity and its environment, when performing other engagements for the entity. Such engagements may include agreed-upon procedures engagements or other audit or assurance engagements, including engagements to address incremental reporting requirements in the jurisdiction.
Information from the Auditor’s Previous Experience with the Entity and Previous Audits (Ref: Para. 16)
Why information from previous audits is important to the current audit
The auditor’s previous experience with the entity and from audit procedures performed in previous audits may provide the auditor with information that is relevant to the auditor’s determination of the nature and extent of risk assessment procedures, and the identification and assessment of risks of material misstatement.
Nature of the Information from Previous Audits
The auditor’s previous experience with the entity and audit procedures performed in previous audits may provide the auditor with information about such matters as:
Past misstatements and whether they were corrected on a timely basis.
The nature of the entity and its environment, and the entity’s system of internal control (including control deficiencies).
Significant changes that the entity or its operations may have undergone since the prior financial period.
Those particular types of transactions and other events or account balances (and related disclosures) where the auditor experienced difficulty in performing the necessary audit procedures, for example, due to their complexity.
The auditor is required to determine whether information obtained from the auditor’s previous experience with the entity and from audit procedures performed in previous audits remains relevant and reliable, if the auditor intends to use that information for the purposes of the current audit. If the nature or circumstances of the entity have changed, or new information has been obtained, the information from prior periods may no longer be relevant or reliable for the current audit. To determine whether changes have occurred that may affect the relevance or reliability of such information, the auditor may make enquiries and perform other appropriate audit procedures, such as walk-throughs of relevant systems. If the information is not reliable, the auditor may consider performing additional procedures that are appropriate in the circumstances.
Engagement Team Discussion (Ref: Para. 17–18)
Why the Engagement Team Is Required to Discuss the Application of the Applicable Financial Reporting Framework and the Susceptibility of the Entity’s Financial report to Material Misstatement
The discussion among the engagement team about the application of the applicable financial reporting framework and the susceptibility of the entity’s financial report to material misstatement:
Provides an opportunity for more experienced engagement team members, including the engagement partner, to share their insights based on their knowledge of the entity. Sharing information contributes to an enhanced understanding by all engagement team members.
Allows the engagement team members to exchange information about the business risks to which the entity is subject, how inherent risk factors may affect the susceptibility to misstatement of classes of transactions, account balances and disclosures, and about how and where the financial report might be susceptible to material misstatement due to fraud or error.
Assists the engagement team members to gain a better understanding of the potential for material misstatement of the financial report in the specific areas assigned to them, and to understand how the results of the audit procedures that they perform may affect other aspects of the audit, including the decisions about the nature, timing and extent of further audit procedures. In particular, the discussion assists engagement team members in further considering contradictory information based on each member’s own understanding of the nature and circumstances of the entity.
Provides a basis upon which engagement team members communicate and share new information obtained throughout the audit that may affect the assessment of risks of material misstatement or the audit procedures performed to address these risks.
ASA 240 requires the engagement team discussion to place particular emphasis on how and where the entity’s financial report may be susceptible to material misstatement due to fraud, including how fraud may occur.[26]
Professional scepticism is necessary for the critical assessment of audit evidence, and a robust and open engagement team discussion, including for recurring audits, may lead to improved identification and assessment of the risks of material misstatement. Another outcome from the discussion may be that the auditor identifies specific areas of the audit for which exercising professional scepticism may be particularly important, and may lead to the involvement of more experienced members of the engagement team who are appropriately skilled to be involved in the performance of audit procedures related to those areas.
Scalability
When the engagement is carried out by a single individual, such as a sole practitioner (i.e., where an engagement team discussion would not be possible), consideration of the matters referred to in paragraphs A42 and A46 nonetheless may assist the auditor in identifying where there may be risks of material misstatement.
When an engagement is carried out by a large engagement team, such as for an audit of a group financial report, it is not always necessary or practical for the discussion to include all members in a single discussion (for example, in a multi-location audit), nor is it necessary for all the members of the engagement team to be informed of all the decisions reached in the discussion. The engagement partner may discuss matters with key members of the engagement team including, if considered appropriate, those with specific skills or knowledge, and those responsible for the work to be performed at components, while delegating discussion with others, taking into account the extent of communication considered necessary throughout the engagement team. A communications plan, agreed by the engagement partner, may be useful.
Discussion of Disclosures in the Applicable Financial Reporting Framework
As part of the discussion among the engagement team, consideration of the disclosure requirements of the applicable financial reporting framework assists in identifying early in the audit where there may be risks of material misstatement in relation to disclosures, even in circumstances where the applicable financial reporting framework only requires simplified disclosures. Matters the engagement team may discuss include:
Changes in financial reporting requirements that may result in significant new or revised disclosures;
Changes in the entity’s environment, financial condition or activities that may result in significant new or revised disclosures, for example, a significant business combination in the period under audit;
Disclosures for which obtaining sufficient appropriate audit evidence may have been difficult in the past; and
Disclosures about complex matters, including those involving significant management judgement as to what information to disclose.
Considerations Specific to Public Sector Entities
As part of the discussion among the engagement team by auditors of public sector entities, consideration may also be given to any additional broader objectives, and related risks, arising from the audit mandate or obligations for public sector entities.
Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework and the Entity’s System of Internal Control (Ref: Para. 19‒27)
Appendices 1 through 6 set out further considerations relating to obtaining an understanding of the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control.
Obtaining the Required Understanding (Ref: Para. 19‒27)
Obtaining an understanding of the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control is a dynamic and iterative process of gathering, updating and analysing information and continues throughout the audit. Therefore, the auditor’s expectations may change as new information is obtained.
The auditor’s understanding of the entity and its environment and the applicable financial reporting framework may also assist the auditor in developing initial expectations about the classes of transactions, account balances and disclosures that may be significant classes of transactions, account balances and disclosures. These expected significant classes of transactions, account balances and disclosures form the basis for the scope of the auditor’s understanding of the entity’s information system.
Why an Understanding of the Entity and Its Environment, and the Applicable Financial Reporting Framework Is Required (Ref: Para. 19‒20)
The auditor’s understanding of the entity and its environment, and the applicable financial reporting framework, assists the auditor in understanding the events and conditions that are relevant to the entity, and in identifying how inherent risk factors affect the susceptibility of assertions to misstatement in the preparation of the financial report, in accordance with the applicable financial reporting framework, and the degree to which they do so. Such information establishes a frame of reference within which the auditor identifies and assesses risks of material misstatement. This frame of reference also assists the auditor in planning the audit and exercising professional judgement and professional scepticism throughout the audit, for example, when:
Identifying and assessing risks of material misstatement of the financial report in accordance with ASA 315 or other relevant standards (e.g., relating to risks of fraud in accordance with ASA 240 or when identifying or assessing risks related to accounting estimates in accordance with ASA 540);
Performing procedures to help identify instances of non-compliance with laws and regulations that may have a material effect on the financial report in accordance with ASA 250;[27]
Evaluating whether the financial report provide adequate disclosures in accordance with ASA 700;[28]
Determining materiality or performance materiality in accordance with ASA 320;[29] or
Considering the appropriateness of the selection and application of accounting policies, and the adequacy of financial report disclosures.
The auditor’s understanding of the entity and its environment, and the applicable financial reporting framework, also informs how the auditor plans and performs further audit procedures, for example, when:
Developing expectations for use when performing analytical procedures in accordance with ASA 520;[30]
Designing and performing further audit procedures to obtain sufficient appropriate audit evidence in accordance with ASA 330; and
Evaluating the sufficiency and appropriateness of audit evidence obtained (e.g., relating to assumptions or management’s oral and written representations).
Scalability
The nature and extent of the required understanding is a matter of the auditor’s professional judgement and varies from entity to entity based on the nature and circumstances of the entity, including:
The size and complexity of the entity, including its IT environment;
The auditor’s previous experience with the entity;
The nature of the entity’s systems and processes, including whether they are formalised or not; and
The nature and form of the entity’s documentation.
The auditor’s risk assessment procedures to obtain the required understanding may be less extensive in audits of less complex entities and more extensive for entities that are more complex. The depth of the understanding that is required by the auditor is expected to be less than that possessed by management in managing the entity.
Some financial reporting frameworks allow smaller entities to provide simpler and less detailed disclosures in the financial report. However, this does not relieve the auditor of the responsibility to obtain an understanding of the entity and its environment and the applicable financial reporting framework as it applies to the entity.
The entity’s use of IT and the nature and extent of changes in the IT environment may also affect the specialised skills that are needed to assist with obtaining the required understanding.
The Entity and Its Environment (Ref: Para. 19(a))
The Entity’s Organisational Structure, Ownership and Governance, and Business Model (Ref: Para. 19(a)(i))
The entity’s organisational structure and ownership
An understanding of the entity’s organisational structure and ownership may enable the auditor to understand such matters as:
The complexity of the entity’s structure.
Example:The entity may be a single entity or the entity’s structure may include subsidiaries, divisions or other components in multiple locations. Further, the legal structure may be different from the operating structure. Complex structures often introduce factors that may give rise to increased susceptibility to risks of material misstatement. Such issues may include whether goodwill, joint ventures, investments, or special-purpose entities are accounted for appropriately and whether adequate disclosure of such issues in the financial report has been made.
The ownership, and relationships between owners and other people or entities, including related parties. This understanding may assist in determining whether related party transactions have been appropriately identified, accounted for, and adequately disclosed in the financial report.[31]
The distinction between the owners, those charged with governance and management.
Example:In less complex entities, owners of the entity may be involved in managing the entity, therefore there is little or no distinction. In contrast, such as in some listed entities, there may be a clear distinction between management, the owners of the entity, and those charged with governance.[32]
The structure and complexity of the entity’s IT environment.
Examples:An entity may:Have multiple legacy IT systems in diverse businesses that are not well integrated resulting in a complex IT environment.Be using external or internal service providers for aspects of its IT environment (e.g., outsourcing the hosting of its IT environment to a third party or using a shared service centre for central management of IT processes in a group).
Automated tools and techniques
The auditor may use automated tools and techniques to understand flows of transactions and processing as part of the auditor’s procedures to understand the information system. An outcome of these procedures may be that the auditor obtains information about the entity’s organisational structure or those with whom the entity conducts business (e.g., vendors, customers, related parties).
Considerations specific to public sector entities
Ownership of a public sector entity may not have the same relevance as in the private sector because decisions related to the entity may be made outside of the entity as a result of political processes. Therefore, management may not have control over certain decisions that are made. Matters that may be relevant include understanding the ability of the entity to make unilateral decisions, and the ability of other public sector entities to control or influence the entity’s mandate and strategic direction.
Example:A public sector entity may be subject to laws or other directives from authorities that require it to obtain approval from parties external to the entity of its strategy and objectives prior to it implementing them. Therefore, matters related to understanding the legal structure of the entity may include applicable laws and regulations, and the classification of the entity (i.e., whether the entity is a ministry, department, agency or other type of entity).
Governance
Why the auditor obtains an understanding of governance
Understanding the entity’s governance may assist the auditor with understanding the entity’s ability to provide appropriate oversight of its system of internal control. However, this understanding may also provide evidence of deficiencies, which may indicate an increase in the susceptibility of the entity’s financial report to risks of material misstatement.
Understanding the entity’s governance
Matters that may be relevant for the auditor to consider in obtaining an understanding of the governance of the entity include:
Whether any or all of those charged with governance are involved in managing the entity.
The existence (and separation) of a non-executive Board, if any, from executive management.
Whether those charged with governance hold positions that are an integral part of the entity’s legal structure, for example as directors.
The existence of sub-groups of those charged with governance, such as an audit committee, and the responsibilities of such a group.
The responsibilities of those charged with governance for oversight of financial reporting, including approval of the financial report.
The Entity’s Business Model
Appendix 1 sets out additional considerations for obtaining an understanding of the entity and its business model, as well as additional considerations for auditing special purpose entities.
Why the auditor obtains an understanding of the entity’s business model
Understanding the entity’s objectives, strategy and business model helps the auditor to understand the entity at a strategic level, and to understand the business risks the entity takes and faces. An understanding of the business risks that have an effect on the financial report assists the auditor in identifying risks of material misstatement, since most business risks will eventually have financial consequences and, therefore, an effect on the financial report.
Examples:An entity’s business model may rely on the use of IT in different ways:The entity sells shoes from a physical store, and uses an advanced stock and point of sale system to record the selling of shoes; orThe entity sells shoes online so that all sales transactions are processed in an IT environment, including initiation of the transactions through a website.For both of these entities the business risks arising from a significantly different business model would be substantially different, notwithstanding both entities sell shoes.
Understanding the entity’s business model
Not all aspects of the business model are relevant to the auditor’s understanding. Business risks are broader than the risks of material misstatement of the financial report, although business risks include the latter. The auditor does not have a responsibility to understand or identify all business risks because not all business risks give rise to risks of material misstatement.
Business risks increasing the susceptibility to risks of material misstatement may arise from:
Inappropriate objectives or strategies, ineffective execution of strategies, or change or complexity.
A failure to recognise the need for change may also give rise to business risk, for example, from:
The development of new products or services that may fail;
A market which, even if successfully developed, is inadequate to support a product or service; or
Flaws in a product or service that may result in legal liability and reputational risk.
Incentives and pressures on management, which may result in intentional or unintentional management bias, and therefore affect the reasonableness of significant assumptions and the expectations of management or those charged with governance.
Examples of matters that the auditor may consider when obtaining an understanding of the entity’s business model, objectives, strategies and related business risks that may result in a risk of material misstatement of the financial report include:
Industry developments, such as the lack of personnel or expertise to deal with the changes in the industry;
New products and services that may lead to increased product liability;
Expansion of the entity’s business, and demand has not been accurately estimated;
New accounting requirements where there has been incomplete or improper implementation;
Regulatory requirements resulting in increased legal exposure;
Current and prospective financing requirements, such as loss of financing due to the entity’s inability to meet requirements;
Use of IT, such as the implementation of a new IT system that will affect both operations and financial reporting; or
The effects of implementing a strategy, particularly any effects that will lead to new accounting requirements.
Ordinarily, management identifies business risks and develops approaches to address them. Such a risk assessment process is part of the entity’s system of internal control and is discussed in paragraph 22, and paragraphs A109–A113.
Considerations specific to public sector entities
Entities operating in the public sector may create and deliver value in different ways to those creating wealth for owners but will still have a ‘business model’ with a specific objective. Matters public sector auditors may obtain an understanding of that are relevant to the business model of the entity, include:
Knowledge of relevant government activities, including related programs.
Program objectives and strategies, including public policy elements.
For the audits of public sector entities, “management objectives” may be influenced by requirements to demonstrate public accountability and may include objectives which have their source in law, regulation or other authority.
Industry, Regulatory and Other External Factors (Ref: Para. 19(a)(ii))
Industry factors
Relevant industry factors include industry conditions such as the competitive environment, supplier and customer relationships, and technological developments. Matters the auditor may consider include:
The market and competition, including demand, capacity, and price competition.
Cyclical or seasonal activity.
Product technology relating to the entity’s products.
Energy supply and cost.
The industry in which the entity operates may give rise to specific risks of material misstatement arising from the nature of the business or the degree of regulation.
Example:In the construction industry, long-term contracts may involve significant estimates of revenues and expenses that give rise to risks of material misstatement. In such cases, it is important that the engagement team include members with the appropriate competence and capabilities.[33]
Regulatory factors
Relevant regulatory factors include the regulatory environment. The regulatory environment encompasses, among other matters, the applicable financial reporting framework and the legal and political environment and any changes thereto. Matters the auditor may consider include:
Regulatory framework for a regulated industry, for example, prudential requirements, including related disclosures.
Legislation and regulation that significantly affect the entity’s operations, for example, labour laws and regulations.
Taxation legislation and regulations.
Government policies currently affecting the conduct of the entity’s business, such as monetary, including foreign exchange controls, fiscal, financial incentives (for example, government aid programs), and tariffs or trade restriction policies.
Environmental requirements affecting the industry and the entity’s business.
ASA 250 includes some specific requirements related to the legal and regulatory framework applicable to the entity and the industry or sector in which the entity operates.[34]
Considerations specific to public sector entities
For the audits of public sector entities, there may be particular laws or regulations that affect the entity’s operations. Such elements may be an essential consideration when obtaining an understanding of the entity and its environment.
Other external factors
Other external factors affecting the entity that the auditor may consider include the general economic conditions, interest rates and availability of financing, and inflation or currency revaluation.
Measures Used by Management to Assess the Entity’s Financial Performance (Ref: Para. 19(a)(iii))
Why the auditor understands measures used by management
An understanding of the entity’s measures assists the auditor in considering whether such measures, whether used externally or internally, create pressures on the entity to achieve performance targets. These pressures may motivate management to take actions that increase the susceptibility to misstatement due to management bias or fraud (e.g., to improve the business performance or to intentionally misstate the financial report) (see ASA 240 for requirements and guidance in relation to the risks of fraud).
Measures may also indicate to the auditor the likelihood of risks of material misstatement of related financial report information. For example, performance measures may indicate that the entity has unusually rapid growth or profitability when compared to that of other entities in the same industry.
Measures used by management
Management and others ordinarily measure and review those matters they regard as important. Enquiries of management may reveal that it relies on certain key indicators, whether publicly available or not, for evaluating financial performance and taking action. In such cases, the auditor may identify relevant performance measures, whether internal or external, by considering the information that the entity uses to manage its business. If such enquiry indicates an absence of performance measurement or review, there may be an increased risk of misstatements not being detected and corrected.
Key indicators used for evaluating financial performance may include:
Key performance indicators (financial and non-financial) and key ratios, trends and operating statistics.
Period-on-period financial performance analyses.
Budgets, forecasts, variance analyses, segment information and divisional, departmental or other level performance reports.
Employee performance measures and incentive compensation policies.
Comparisons of an entity’s performance with that of competitors.
Scalability (Ref: Para. 19(a)(iii))
The procedures undertaken to understand the entity’s measures may vary depending on the size or complexity of the entity, as well as the involvement of owners or those charged with governance in the management of the entity.
Examples:For some less complex entities, the terms of the entity’s bank borrowings (i.e., bank covenants) may be linked to specific performance measures related to the entity’s performance or financial position (e.g., a maximum working capital amount). The auditor’s understanding of the performance measures used by the bank may help identify areas where there is increased susceptibility to the risk of material misstatement.For some entities whose nature and circumstances are more complex, such as those operating in the insurance or banking industries, performance or financial position may be measured against regulatory requirements (e.g., regulatory ratio requirements such as capital adequacy and liquidity ratios performance hurdles). The auditor’s understanding of these performance measures may help identify areas where there is increased susceptibility to the risk of material misstatement.
Other considerations
External parties may also review and analyse the entity’s financial performance, in particular for entities where financial information is publicly available. The auditor may also consider publicly available information to help the auditor further understand the business or identify contradictory information such as information from:
Analysts or credit agencies.
News and other media, including social media.
Taxation authorities.
Regulators.
Trade unions.
Providers of finance.
Such financial information can often be obtained from the entity being audited.
The measurement and review of financial performance is not the same as the monitoring of the system of internal control (discussed as a component of the system of internal control in paragraphs A114–A122), though their purposes may overlap:
The measurement and review of performance is directed at whether business performance is meeting the objectives set by management (or third parties).
In contrast, monitoring of the system of internal control is concerned with monitoring the effectiveness of controls including those related to management’s measurement and review of financial performance.
In some cases, however, performance indicators also provide information that enables management to identify control deficiencies.
Considerations specific to public sector entities
In addition to considering relevant measures used by a public sector entity to assess the entity’s financial performance, auditors of public sector entities may also consider non-financial information such as achievement of public benefit outcomes (for example, the number of people assisted by a specific program).
The Applicable Financial Reporting Framework (Ref: Para. 19(b))
Understanding the Applicable Financial Reporting Framework and the Entity’s Accounting Policies
Matters that the auditor may consider when obtaining an understanding of the entity’s applicable financial reporting framework, and how it applies in the context of the nature and circumstances of the entity and its environment include:
The entity’s financial reporting practices in terms of the applicable financial reporting framework, such as:
Accounting principles and industry-specific practices, including for industry-specific significant classes of transactions, account balances and related disclosures in the financial report (for example, loans and investments for banks, or research and development for pharmaceuticals).
Revenue recognition.
Accounting for financial instruments, including related credit losses.
Foreign currency assets, liabilities and transactions.
Accounting for unusual or complex transactions including those in controversial or emerging areas (for example, accounting for cryptocurrency).
An understanding of the entity’s selection and application of accounting policies, including any changes thereto as well as the reasons therefore, may encompass such matters as:
The methods the entity uses to recognise, measure, present and disclose significant and unusual transactions.
The effect of significant accounting policies in controversial or emerging areas for which there is a lack of authoritative guidance or consensus.
Changes in the environment, such as changes in the applicable financial reporting framework or tax reforms that may necessitate a change in the entity’s accounting policies.
Financial reporting standards and laws and regulations that are new to the entity and when and how the entity will adopt, or comply with, such requirements.
Obtaining an understanding of the entity and its environment may assist the auditor in considering where changes in the entity’s financial reporting (e.g., from prior periods) may be expected.
Example:If the entity has had a significant business combination during the period, the auditor would likely expect changes in classes of transactions, account balances and disclosures associated with that business combination. Alternatively, if there were no significant changes in the financial reporting framework during the period the auditor’s understanding may help confirm that the understanding obtained in the prior period remains applicable.
Considerations specific to public sector entities
The applicable financial reporting framework in a public sector entity is determined by the legislative and regulatory frameworks relevant to each jurisdiction or within each geographical area. Matters that may be considered in the entity’s application of the applicable financial reporting requirements, and how it applies in the context of the nature and circumstances of the entity and its environment, include whether the entity applies a full accrual basis of accounting or a cash basis of accounting in accordance with the International Public Sector Accounting Standards, or a hybrid.
How Inherent Risk Factors Affect Susceptibility of Assertions to Misstatement (Ref: Para. 19(c))
Appendix 2 provides examples of events and conditions that may give rise to the existence of risks of material misstatement, categorised by inherent risk factor.
Why the auditor understands inherent risk factors when understanding the entity and its environment and the applicable financial reporting framework
Understanding the entity and its environment, and the applicable financial reporting framework, assists the auditor in identifying events or conditions, the characteristics of which may affect the susceptibility of assertions about classes of transactions, account balances or disclosures to misstatement. These characteristics are inherent risk factors. Inherent risk factors may affect susceptibility of assertions to misstatement by influencing the likelihood of occurrence of a misstatement or the magnitude of the misstatement if it were to occur. Understanding how inherent risk factors affect the susceptibility of assertions to misstatement may assist the auditor with a preliminary understanding of the likelihood or magnitude of misstatements, which assists the auditor in identifying risks of material misstatement at the assertion level in accordance with paragraph 28(b). Understanding the degree to which inherent risk factors affect susceptibility of assertions to misstatement also assists the auditor in assessing the likelihood and magnitude of a possible misstatement when assessing inherent risk in accordance with paragraph 31(a). Accordingly, understanding the inherent risk factors may also assist the auditor in designing and performing further audit procedures in accordance with ASA 330.
The auditor’s identification of risks of material misstatement at the assertion level and assessment of inherent risk may also be influenced by audit evidence obtained by the auditor in performing other risk assessment procedures, further audit procedures or in fulfilling other requirements in the ASAs (see paragraphs A95, A103, A111, A121, A124 and A151).
The effect of inherent risk factors on a class of transactions, account balance or disclosure
The extent of susceptibility to misstatement of a class of transactions, account balance or disclosure arising from complexity or subjectivity is often closely related to the extent to which it is subject to change or uncertainty.
Example:If the entity has an accounting estimate that is based on assumptions, the selection of which are subject to significant judgement, the measurement of the accounting estimate is likely to be affected by both subjectivity and uncertainty.
The greater the extent to which a class of transactions, account balance or disclosure is susceptible to misstatement because of complexity or subjectivity, the greater the need for the auditor to apply professional scepticism. Further, when a class of transactions, account balance or disclosure is susceptible to misstatement because of complexity, subjectivity, change or uncertainty, these inherent risk factors may create opportunity for management bias, whether unintentional or intentional, and affect susceptibility to misstatement due to management bias. The auditor’s identification of risks of material misstatement, and assessment of inherent risk at the assertion level, are also affected by the interrelationships among inherent risk factors.
Events or conditions that may affect susceptibility to misstatement due to management bias may also affect susceptibility to misstatement due to other fraud risk factors. Accordingly, this may be relevant information for use in accordance with paragraph 24 of ASA 240, which requires the auditor to evaluate whether the information obtained from the other risk assessment procedures and related activities indicates that one or more fraud risk factors are present.
Obtaining an Understanding of the Entity’s System of Internal Control (Ref: Para. 21‒27)
Appendix 3 further describes the nature of the entity’s system of internal control and inherent limitations of internal control, respectively. Appendix 3 also provides further explanation of the components of a system of internal control for the purposes of the ASAs.
The auditor’s understanding of the entity’s system of internal control is obtained through risk assessment procedures performed to understand and evaluate each of the components of the system of internal control as set out in paragraphs 21 to 27.
The components of the entity’s system of internal control for the purpose of this ASA may not necessarily reflect how an entity designs, implements and maintains its system of internal control, or how it may classify any particular component. Entities may use different terminology or frameworks to describe the various aspects of the system of internal control. For the purpose of an audit, auditors may also use different terminology or frameworks provided all the components described in this ASA are addressed.
Scalability
The way in which the entity’s system of internal control is designed, implemented and maintained varies with an entity’s size and complexity. For example, less complex entities may use less structured or simpler controls (i.e., policies and procedures) to achieve their objectives.
Considerations Specific to Public Sector Entities
Auditors of public sector entities often have additional responsibilities with respect to internal control, for example, to report on compliance with an established code of practice or reporting on spending against budget. Auditors of public sector entities may also have responsibilities to report on compliance with law, regulation or other authority. As a result, their considerations about the system of internal control may be broader and more detailed.
Information Technology in the Components of the Entity’s System of Internal Control
Appendix 5 provides further guidance on understanding the entity’s use of IT in the components of the system of internal control.
The overall objective and scope of an audit does not differ whether an entity operates in a mainly manual environment, a completely automated environment, or an environment involving some combination of manual and automated elements (i.e., manual and automated controls and other resources used in the entity’s system of internal control).
Understanding the Nature of the Components of the Entity’s System of Internal Control
In evaluating the effectiveness of the design of controls and whether they have been implemented (see paragraphs A175 to A181) the auditor’s understanding of each of the components of the entity’s system of internal control provides a preliminary understanding of how the entity identifies business risks and how it responds to them. It may also influence the auditor’s identification and assessment of the risks of material misstatement in different ways (see paragraph A86). This assists the auditor in designing and performing further audit procedures, including any plans to test the operating effectiveness of controls. For example:
The auditor’s understanding of the entity’s control environment, the entity’s risk assessment process, and the entity’s process to monitor controls components are more likely to affect the identification and assessment of risks of material misstatement at the financial report level.
The auditor’s understanding of the entity’s information system and communication, and the entity’s control activities component, are more likely to affect the identification and assessment of risks of material misstatement at the assertion level.
Control Environment, The Entity’s Risk Assessment Process and the Entity’s Process to Monitor the System of Internal Control (Ref: Para. 21–24)
The controls in the control environment, the entity’s risk assessment process and the entity’s process to monitor the system of internal control are primarily indirect controls (i.e., controls that are not sufficiently precise to prevent, detect or correct misstatements at the assertion level but which support other controls and may therefore have an indirect effect on the likelihood that a misstatement will be detected or prevented on a timely basis). However, some controls within these components may also be direct controls.
Why the auditor is required to understand the control environment, the entity’s risk assessment process and the entity’s process to monitor the system of internal control
The control environment provides an overall foundation for the operation of the other components of the system of internal control. The control environment does not directly prevent, or detect and correct, misstatements. It may, however, influence the effectiveness of controls in the other components of the system of internal control. Similarly, the entity’s risk assessment process and its process for monitoring the system of internal control are designed to operate in a manner that also supports the entire system of internal control.
Because these components are foundational to the entity’s system of internal control, any deficiencies in their operation could have pervasive effects on the preparation of the financial report. Therefore, the auditor’s understanding and evaluations of these components affect the auditor’s identification and assessment of risks of material misstatement at the financial report level, and may also affect the identification and assessment of risks of material misstatement at the assertion level. Risks of material misstatement at the financial report level affect the auditor’s design of overall responses, including, as explained in ASA 330, an influence on the nature, timing and extent of the auditor’s further procedures.[35]
Obtaining an understanding of the control environment (Ref: Para. 21)
Scalability
The nature of the control environment in a less complex entity is likely to be different from the control environment in a more complex entity. For example, those charged with governance in less complex entities may not include an independent or outside member, and the role of governance may be undertaken directly by the owner-manager where there are no other owners. Accordingly, some considerations about the entity’s control environment may be less relevant or may not be applicable.
In addition, audit evidence about elements of the control environment in less complex entities may not be available in documentary form, in particular where communication between management and other personnel is informal, but the evidence may still be appropriately relevant and reliable in the circumstances.
Examples:The organisational structure in a less complex entity will likely be simpler and may include a small number of employees involved in roles related to financial reporting.If the role of governance is undertaken directly by the owner-manager, the auditor may determine that the independence of those charged with governance is not relevant.Less complex entities may not have a written code of conduct but, instead, develop a culture that emphasises the importance of integrity and ethical behaviour through oral communication and by management example. Consequently, the attitudes, awareness and actions of management or the owner-manager are of particular importance to the auditor’s understanding of a less complex entity’s control environment.
Understanding the control environment (Ref: Para. 21(a))
Audit evidence for the auditor’s understanding of the control environment may be obtained through a combination of enquiries and other risk assessment procedures (i.e., corroborating enquiries through observation or inspection of documents).
In considering the extent to which management demonstrates a commitment to integrity and ethical values, the auditor may obtain an understanding through enquiries of management and employees, and through considering information from external sources, about:
How management communicates to employees its views on business practices and ethical behaviour; and
Inspecting management’s written code of conduct and observing whether management acts in a manner that supports that code.
Evaluating the control environment (Ref: Para. 21(b))
Why the auditor evaluates the control environment
The auditor’s evaluation of how the entity demonstrates behaviour consistent with the entity’s commitment to integrity and ethical values; whether the control environment provides an appropriate foundation for the other components of the entity’s system of internal control; and whether any identified control deficiencies undermine the other components of the system of internal control, assists the auditor in identifying potential issues in the other components of the system of internal control. This is because the control environment is foundational to the other components of the entity’s system of internal control. This evaluation may also assist the auditor in understanding risks faced by the entity and therefore in identifying and assessing the risks of material misstatement at the financial report and assertion levels (see paragraph A86).
The auditor’s evaluation of the control environment
The auditor’s evaluation of the control environment is based on the understanding obtained in accordance with paragraph 21(a).
Some entities may be dominated by a single individual who may exercise a great deal of discretion. The actions and attitudes of that individual may have a pervasive effect on the culture of the entity, which in turn may have a pervasive effect on the control environment. Such an effect may be positive or negative.
Example:Direct involvement by a single individual may be key to enabling the entity to meet its growth and other objectives, and can also contribute significantly to an effective system of internal control. On the other hand, such concentration of knowledge and authority can also lead to an increased susceptibility to misstatement through management override of controls.
The auditor may consider how the different elements of the control environment may be influenced by the philosophy and operating style of senior management taking into account the involvement of independent members of those charged with governance.
Although the control environment may provide an appropriate foundation for the system of internal control and may help reduce the risk of fraud, an appropriate control environment is not necessarily an effective deterrent to fraud.
Example:Human resource policies and procedures directed toward hiring competent financial, accounting, and IT personnel may mitigate the risk of errors in processing and recording financial information. However, such policies and procedures may not mitigate the override of controls by senior management (e.g., to overstate earnings).
The auditor’s evaluation of the control environment as it relates to the entity’s use of IT may include such matters as:
Whether governance over IT is commensurate with the nature and complexity of the entity and its business operations enabled by IT, including the complexity or maturity of the entity’s technology platform or architecture and the extent to which the entity relies on IT applications to support its financial reporting.
The management organisational structure regarding IT and the resources allocated (for example, whether the entity has invested in an appropriate IT environment and necessary enhancements, or whether a sufficient number of appropriately skilled individuals have been employed including when the entity uses commercial software (with no or limited modifications)).
Obtaining an understanding of the entity’s risk assessment process (Ref: Para. 22–23)
Understanding the entity’s risk assessment process (Ref: Para. 22(a))
As explained in paragraph A62, not all business risks give rise to risks of material misstatement. In understanding how management and those charged with governance have identified business risks relevant to the preparation of the financial report, and decided about actions to address those risks, matters the auditor may consider include how management or, as appropriate, those charged with governance, has:
Specified the entity’s objectives with sufficient precision and clarity to enable the identification and assessment of the risks relating to the objectives;
Identified the risks to achieving the entity’s objectives and analysed the risks as a basis for determining how the risks should be managed; and
Considered the potential for fraud when considering the risks to achieving the entity’s objectives.[36]
The auditor may consider the implications of such business risks for the preparation of the entity’s financial report and other aspects of its system of internal control.
Evaluating the entity’s risk assessment process (Ref: Para. 22(b))
Why the auditor evaluates whether the entity’s risk assessment process is appropriate
The auditor’s evaluation of the entity’s risk assessment process may assist the auditor in understanding where the entity has identified risks that may occur, and how the entity has responded to those risks. The auditor’s evaluation of how the entity identifies its business risks, and how it assesses and addresses those risks assists the auditor in understanding whether the risks faced by the entity have been identified, assessed and addressed as appropriate to the nature and complexity of the entity. This evaluation may also assist the auditor with identifying and assessing financial report level and assertion level risks of material misstatement (see paragraph A86).
Evaluating whether the entity’s risk assessment process is appropriate (Ref: Para. 22(b))
The auditor’s evaluation of the appropriateness of the entity’s risk assessment process is based on the understanding obtained in accordance with paragraph 22(a).
Scalability
Whether the entity’s risk assessment process is appropriate to the entity’s circumstances considering the nature and complexity of the entity is a matter of the auditor’s professional judgement.
Example:In some less complex entities, and particularly owner-managed entities, an appropriate risk assessment may be performed through the direct involvement of management or the owner-manager (e.g., the manager or owner-manager may routinely devote time to monitoring the activities of competitors and other developments in the market place to identify emerging business risks). The evidence of this risk assessment occurring in these types of entities is often not formally documented, but it may be evident from the discussions the auditor has with management that management are in fact performing risk assessment procedures.
Obtaining an understanding of the entity’s process to monitor the entity’s system of internal control (Ref: Para. 24)
Scalability
In less complex entities, and in particular owner-manager entities, the auditor’s understanding of the entity’s process to monitor the system of internal control is often focused on how management or the owner-manager is directly involved in operations, as there may not be any other monitoring activities.
Example:Management may receive complaints from customers about inaccuracies in their monthly statement that alerts the owner-manager to issues with the timing of when customer payments are being recognised in the accounting records.
For entities where there is no formal process for monitoring the system of internal control, understanding the process to monitor the system of internal control may include understanding periodic reviews of management accounting information that are designed to contribute to how the entity prevents or detects misstatements.
Understanding the entity’s process to monitor the system of internal control (Ref: Para. 24(a))
Matters that may be relevant for the auditor to consider when understanding how the entity monitors its system of internal control include:
The design of the monitoring activities, for example whether it is periodic or ongoing monitoring;
The performance and frequency of the monitoring activities;
The evaluation of the results of the monitoring activities, on a timely basis, to determine whether the controls have been effective; and
How identified deficiencies have been addressed through appropriate remedial actions, including timely communication of such deficiencies to those responsible for taking remedial action.
The auditor may also consider how the entity’s process to monitor the system of internal control addresses monitoring information processing controls that involve the use of IT. This may include, for example:
Controls to monitor complex IT environments that:
Evaluate the continuing design effectiveness of information processing controls and modify them, as appropriate, for changes in conditions; or
Evaluate the operating effectiveness of information processing controls.
Controls that monitor the permissions applied in automated information processing controls that enforce the segregation of duties.
Controls that monitor how errors or control deficiencies related to the automation of financial reporting are identified and addressed.
Understanding the entity’s internal audit function (Ref: Para. 24(a)(ii))
Appendix 4 sets out further considerations for understanding the entity’s internal audit function.
The auditor’s enquiries of appropriate individuals within the internal audit function help the auditor obtain an understanding of the nature of the internal audit function’s responsibilities. If the auditor determines that the function’s responsibilities are related to the entity’s financial reporting, the auditor may obtain further understanding of the activities performed, or to be performed, by the internal audit function by reviewing the internal audit function’s audit plan for the period, if any, and discussing that plan with the appropriate individuals within the function. This understanding, together with the information obtained from the auditor’s enquiries, may also provide information that is directly relevant to the auditor’s identification and assessment of the risks of material misstatement. If, based on the auditor’s preliminary understanding of the internal audit function, the auditor expects to use the work of the internal audit function to modify the nature or timing, or reduce the extent, of audit procedures to be performed, ASA 610[37] applies.
Other sources of information used in the entity’s process to monitor the system of internal control
Understanding the sources of information (Ref: Para. 24(b))
Management’s monitoring activities may use information in communications from external parties such as customer complaints or regulator comments that may indicate problems or highlight areas in need of improvement.
Why the auditor is required to understand the sources of information used for the entity’s monitoring of the system of internal control
The auditor’s understanding of the sources of information used by the entity in monitoring the entity’s system of internal control, including whether the information used is relevant and reliable, assists the auditor in evaluating whether the entity’s process to monitor the entity’s system of internal control is appropriate. If management assumes that information used for monitoring is relevant and reliable without having a basis for that assumption, errors that may exist in the information could potentially lead management to draw incorrect conclusions from its monitoring activities.
Evaluating the entity’s process to monitor the system of internal control (Ref: Para 24(c))
Why the auditor evaluates whether the entity’s process to monitor the system of internal control is appropriate
The auditor’s evaluation about how the entity undertakes ongoing and separate evaluations for monitoring the effectiveness of controls assists the auditor in understanding whether the other components of the entity’s system of internal control are present and functioning, and therefore assists with understanding the other components of the entity’s system of internal control. This evaluation may also assist the auditor with identifying and assessing financial report level and assertion level risks of material misstatement (see paragraph A86).
Evaluating whether the entity’s process to monitor the system of internal control is appropriate (Ref: Para. 24(c))
The auditor’s evaluation of the appropriateness of the entity’s process to monitor the system of internal control is based on the auditor’s understanding of the entity’s process to monitor the system of internal control.
Information System and Communication, and Control Activities (Ref: Para. 25‒26)
The controls in the information system and communication, and control activities components are primarily direct controls (i.e., controls that are sufficiently precise to prevent, detect or correct misstatements at the assertion level).
Why the auditor Is required to understand the information system and communication and controls in the control activities component
The auditor is required to understand the entity’s information system and communication because understanding the entity’s policies that define the flows of transactions and other aspects of the entity’s information processing activities relevant to the preparation of the financial report, and evaluating whether the component appropriately supports the preparation of the entity’s financial report, supports the auditor’s identification and assessment of risks of material misstatement at the assertion level. This understanding and evaluation may also result in the identification of risks of material misstatement at the financial report level when the results of the auditor’s procedures are inconsistent with expectations about the entity’s system of internal control that may have been set based on information obtained during the engagement acceptance or continuance process (see paragraph A86).
The auditor is required to identify specific controls in the control activities component, and evaluate the design and determine whether the controls have been implemented, as it assists the auditor’s understanding about management’s approach to addressing certain risks and therefore provides a basis for the design and performance of further audit procedures responsive to these risks as required by ASA 330. The higher on the spectrum of inherent risk a risk is assessed, the more persuasive the audit evidence needs to be. Even when the auditor does not plan to test the operating effectiveness of identified controls, the auditor’s understanding may still affect the design of the nature, timing and extent of substantive audit procedures that are responsive to the related risks of material misstatement.
The iterative nature of the auditor’s understanding and evaluation of the information system and communication, and control activities
As explained in paragraph A49, the auditor’s understanding of the entity and its environment, and the applicable financial reporting framework, may assist the auditor in developing initial expectations about the classes of transactions, account balances and disclosures that may be significant classes of transactions, account balances and disclosures. In obtaining an understanding of the information system and communication component in accordance with paragraph 25(a), the auditor may use these initial expectations for the purpose of determining the extent of understanding of the entity’s information processing activities to be obtained.
The auditor’s understanding of the information system includes understanding the policies that define flows of information relating to the entity’s significant classes of transactions, account balances, and disclosures, and other related aspects of the entity’s information processing activities. This information, and the information obtained from the auditor’s evaluation of the information system may confirm or further influence the auditor’s expectations about the significant classes of transactions, account balances and disclosures initially identified (see paragraph A126).
In obtaining an understanding of how information relating to significant classes of transactions, account balances and disclosures flows into, through, and out of the entity’s information system, the auditor may also identify controls in the control activities component that are required to be identified in accordance with paragraph 26(a). The auditor’s identification and evaluation of controls in the control activities component may first focus on controls over journal entries and controls that the auditor plans to test the operating effectiveness of in designing the nature, timing and extent of substantive procedures.
The auditor’s assessment of inherent risk may also influence the identification of controls in the control activities component. For example, the auditor’s identification of controls relating to significant risks may only be identifiable when the auditor has assessed inherent risk at the assertion level in accordance with paragraph 31. Furthermore, controls addressing risks for which the auditor has determined that substantive procedures alone do not provide sufficient appropriate audit evidence (in accordance with paragraph 33) may also only be identifiable once the auditor’s inherent risk assessments have been undertaken.
The auditor’s identification and assessment of risks of material misstatement at the assertion level is influenced by both the auditor’s:
Understanding of the entity’s policies for its information processing activities in the information system and communication component, and
Identification and evaluation of controls in the control activities component.
Obtaining an understanding of the information system and communication (Ref: Para. 25)
Appendix 3, Paragraphs 15–19, sets out further considerations relating to the information system and communication.
Scalability
The information system, and related business processes, in less complex entities are likely to be less sophisticated than in larger entities, and are likely to involve a less complex IT environment; however, the role of the information system is just as important. Less complex entities with direct management involvement may not need extensive descriptions of accounting procedures, sophisticated accounting records, or written policies. Understanding the relevant aspects of the entity’s information system may therefore require less effort in an audit of a less complex entity, and may involve a greater amount of enquiry than observation or inspection of documentation. The need to obtain an understanding, however, remains important to provide a basis for the design of further audit procedures in accordance with ASA 330 and may further assist the auditor in identifying or assessing risks of material misstatement (see paragraph A86).
Obtaining an understanding of the information system (Ref: Para. 25(a))
Included within the entity’s system of internal control are aspects that relate to the entity’s reporting objectives, including its financial reporting objectives, but may also include aspects that relate to its operations or compliance objectives, when such aspects are relevant to financial reporting. Understanding how the entity initiates transactions and captures information as part of the auditor’s understanding of the information system may include information about the entity’s systems (its policies) designed to address compliance and operations objectives because such information is relevant to the preparation of the financial report. Further, some entities may have information systems that are highly integrated such that controls may be designed in a manner to simultaneously achieve financial reporting, compliance and operational objectives, and combinations thereof.
Understanding the entity’s information system also includes an understanding of the resources to be used in the entity’s information processing activities. Information about the human resources involved that may be relevant to understanding risks to the integrity of the information system include:
The competence of the individuals undertaking the work;
Whether there are adequate resources; and
Whether there is appropriate segregation of duties.
Matters the auditor may consider when understanding the policies that define the flows of information relating to the entity’s significant classes of transactions, account balances, and disclosures in the information system and communication component include the nature of:
The data or information relating to transactions, other events and conditions to be processed;
The information processing to maintain the integrity of that data or information; and
The information processes, personnel and other resources used in the information processing process.
Obtaining an understanding of the entity’s business processes, which include how transactions are originated, assists the auditor in obtaining an understanding of the entity’s information system in a manner that is appropriate to the entity’s circumstances.
The auditor’s understanding of the information system may be obtained in various ways and may include:
Enquiries of relevant personnel about the procedures used to initiate, record, process and report transactions or about the entity’s financial reporting process;
Inspection of policy or process manuals or other documentation of the entity’s information system;
Observation of the performance of the policies or procedures by entity’s personnel; or
Selecting transactions and tracing them through the applicable process in the information system (i.e., performing a walk-through).
Automated tools and techniques
The auditor may also use automated techniques to obtain direct access to, or a digital download from, the databases in the entity’s information system that store accounting records of transactions. By applying automated tools or techniques to this information, the auditor may confirm the understanding obtained about how transactions flow through the information system by tracing journal entries, or other digital records related to a particular transaction, or an entire population of transactions, from initiation in the accounting records through to recording in the general ledger. Analysis of complete or large sets of transactions may also result in the identification of variations from the normal, or expected, processing procedures for these transactions, which may result in the identification of risks of material misstatement.
Information obtained from outside of the general and subsidiary ledgers
Financial reports may contain information that is obtained from outside of the general and subsidiary ledgers. Examples of such information that the auditor may consider include:
Information obtained from lease agreements relevant to disclosures in the financial report.
Information disclosed in the financial report that is produced by an entity’s risk management system.
Fair value information produced by management’s experts and disclosed in the financial report.
Information disclosed in the financial report that has been obtained from models, or from other calculations used to develop accounting estimates recognised or disclosed in the financial report, including information relating to the underlying data and assumptions used in those models, such as:
Assumptions developed internally that may affect an asset’s useful life; or
Data such as interest rates that are affected by factors outside the control of the entity.
Information disclosed in the financial report about sensitivity analyses derived from financial models that demonstrates that management has considered alternative assumptions.
Information recognised or disclosed in the financial report that has been obtained from an entity’s tax returns and records.
Information disclosed in the financial report that has been obtained from analyses prepared to support management’s assessment of the entity’s ability to continue as a going concern, such as disclosures, if any, related to events or conditions that have been identified that may cast significant doubt on the entity’s ability to continue as a going concern.[38]
Certain amounts or disclosures in the entity’s financial report (such as disclosures about credit risk, liquidity risk, and market risk) may be based on information obtained from the entity’s risk management system. However, the auditor is not required to understand all aspects of the risk management system, and uses professional judgement in determining the necessary understanding.
The entity’s use of information technology in the information system
Why does the auditor understand the IT environment relevant to the information system
The auditor’s understanding of the information system includes the IT environment relevant to the flows of transactions and processing of information in the entity’s information system because the entity’s use of IT applications or other aspects in the IT environment may give rise to risks arising from the use of IT.
The understanding of the entity’s business model and how it integrates the use of IT may also provide useful context to the nature and extent of IT expected in the information system.
Understanding the entity’s use of IT
The auditor’s understanding of the IT environment may focus on identifying, and understanding the nature and number of, the specific IT applications and other aspects of the IT environment that are relevant to the flows of transactions and processing of information in the information system. Changes in the flow of transactions, or information within the information system may result from program changes to IT applications, or direct changes to data in databases involved in processing, or storing those transactions or information.
The auditor may identify the IT applications and supporting IT infrastructure concurrently with the auditor’s understanding of how information relating to significant classes of transactions, account balances and disclosures flows into, through and out the entity’s information system.
Obtaining an understanding of the entity’s communication (Ref: Para. 25(b))
Scalability
In larger, more complex entities, information the auditor may consider when understanding the entity’s communication may come from policy manuals and financial reporting manuals.
In less complex entities, communication may be less structured (e.g., formal manuals may not be used) due to fewer levels of responsibility and management’s greater visibility and availability. Regardless of the size of the entity, open communication channels facilitate the reporting of exceptions and acting on them.
Evaluating whether the relevant aspects of the information system support the preparation of the entity’s financial report (Ref: Para. 25(c))
The auditor’s evaluation of whether the entity’s information system and communication appropriately supports the preparation of the financial report is based on the understanding obtained in paragraphs 25(a)‒(b).
Control Activities (Ref: Para. 26)
Controls in the control activities component
Appendix 3, Paragraphs 20 and 21 set out further considerations relating to control activities.
The control activities component includes controls that are designed to ensure the proper application of policies (which are also controls) in all the other components of the entity’s system of internal control, and includes both direct and indirect controls.
Example:The controls that an entity has established to ensure that its personnel are properly counting and recording the annual physical inventory relate directly to the risks of material misstatement relevant to the existence and completeness assertions for the inventory account balance.
The auditor’s identification and evaluation of controls in the control activities component is focused on information processing controls, which are controls applied during the processing of information in the entity’s information system that directly address risks to the integrity of information (i.e., the completeness, accuracy and validity of transactions and other information). However, the auditor is not required to identify and evaluate all information processing controls related to the entity’s policies that define the flows of transactions and other aspects of the entity’s information processing activities for the significant classes of transactions, account balances and disclosures.
There may also be direct controls that exist in the control environment, the entity’s risk assessment process or the entity’s process to monitor the system of internal control, which may be identified in accordance with paragraph 26. However, the more indirect the relationship between controls that support other controls and the control that is being considered, the less effective that control may be in preventing, or detecting and correcting, related misstatements.
Example:A sales manager’s review of a summary of sales activity for specific stores by region ordinarily is only indirectly related to the risks of material misstatement relevant to the completeness assertion for sales revenue. Accordingly, it may be less effective in addressing those risks than controls more directly related thereto, such as matching shipping documents with billing documents.
Paragraph 26 also requires the auditor to identify and evaluate general IT controls for IT applications and other aspects of the IT environment that the auditor has determined to be subject to risks arising from the use of IT, because general IT controls support the continued effective functioning of information processing controls. A general IT control alone is typically not sufficient to address a risk of material misstatement at the assertion level.
The controls that the auditor is required to identify and evaluate the design, and determine the implementation of, in accordance with paragraph 26 are those:
Controls which the auditor plans to test the operating effectiveness of in determining the nature, timing and extent of substantive procedures. The evaluation of such controls provides the basis for the auditor’s design of test of control procedures in accordance with ASA 330. These controls also include controls that address risks for which substantive procedures alone do not provide sufficient appropriate audit evidence.
Controls include controls that address significant risks and controls over journal entries. The auditor’s identification and evaluation of such controls may also influence the auditor’s understanding of the risks of material misstatement, including the identification of additional risks of material misstatement (see paragraph A95). This understanding also provides the basis for the auditor’s design of the nature, timing and extent of substantive audit procedures that are responsive to the related assessed risks of material misstatement.
Other controls that the auditor considers are appropriate to enable the auditor to meet the objectives of paragraph 13 with respect to risks at the assertion level, based on the auditor’s professional judgement.
Controls in the control activities component are required to be identified when such controls meet one or more of the criteria included in paragraph 26(a). However, when multiple controls each achieve the same objective, it is unnecessary to identify each of the controls related to such objective.
Types of controls in the control activities component (Ref: Para. 26)
Examples of controls in the control activities component include authorisations and approvals, reconciliations, verifications (such as edit and validation checks or automated calculations), segregation of duties, and physical or logical controls, including those addressing safeguarding of assets.
Controls in the control activities component may also include controls established by management that address risks of material misstatement related to disclosures not being prepared in accordance with the applicable financial reporting framework. Such controls may relate to information included in the financial report that is obtained from outside of the general and subsidiary ledgers.
Regardless of whether controls are within the IT environment or manual systems, controls may have various objectives and may be applied at various organisational and functional levels.
Scalability (Ref: Para. 26)
Controls in the control activities component for less complex entities are likely to be similar to those in larger entities, but the formality with which they operate may vary. Further, in less complex entities, more controls may be directly applied by management.
Example:Management’s sole authority for granting credit to customers and approving significant purchases can provide strong control over important account balances and transactions.
It may be less practicable to establish segregation of duties in less complex entities that have fewer employees. However, in an owner-managed entity, the owner-manager may be able to exercise more effective oversight through direct involvement than in a larger entity, which may compensate for the generally more limited opportunities for segregation of duties. Although, as also explained in ASA 240, domination of management by a single individual can be a potential control deficiency since there is an opportunity for management override of controls.[39]
Controls that address risks of material misstatement at the assertion level (Ref: Para. 26(a))
Controls that address risks that are determined to be a significant risk (Ref: Para. 26(a)(i))
Regardless of whether the auditor plans to test the operating effectiveness of controls that address significant risks, the understanding obtained about management’s approach to addressing those risks may provide a basis for the design and performance of substantive procedures responsive to significant risks as required by ASA 330.[40] Although risks relating to significant non-routine or judgemental matters are often less likely to be subject to routine controls, management may have other responses intended to deal with such risks. Accordingly, the auditor’s understanding of whether the entity has designed and implemented controls for significant risks arising from non-routine or judgemental matters may include whether and how management responds to the risks. Such responses may include:
Controls, such as a review of assumptions by senior management or experts.
Documented processes for accounting estimations.
Approval by those charged with governance.
Example:Where there are one-off events such as the receipt of a notice of a significant lawsuit, consideration of the entity’s response may include such matters as whether it has been referred to appropriate experts (such as internal or external legal counsel), whether an assessment has been made of the potential effect, and how it is proposed that the circumstances are to be disclosed in the financial report.
ASA 240[41] requires the auditor to understand controls related to assessed risks of material misstatement due to fraud (which are treated as significant risks), and further explains that it is important for the auditor to obtain an understanding of the controls that management has designed, implemented and maintained to prevent and detect fraud.
Controls over journal entries (Ref: Para. 26(a)(ii))
Controls that address risks of material misstatement at the assertion level that are expected to be identified for all audits are controls over journal entries, because the manner in which an entity incorporates information from transaction processing into the general ledger ordinarily involves the use of journal entries, whether standard or non-standard, or automated or manual. The extent to which other controls are identified may vary based on the nature of the entity and the auditor’s planned approach to further audit procedures.
Example:In an audit of a less complex entity, the entity’s information system may not be complex and the auditor may not plan to rely on the operating effectiveness of controls. Further, the auditor may not have identified any significant risks or any other risks of material misstatement for which it is necessary for the auditor to evaluate the design of controls and determine that they have been implemented. In such an audit, the auditor may determine that there are no identified controls other than the entity’s controls over journal entries.
Automated tools and techniques
In manual general ledger systems, non-standard journal entries may be identified through inspection of ledgers, journals, and supporting documentation. When automated procedures are used to maintain the general ledger and prepare financial reports, such entries may exist only in electronic form and may therefore be more easily identified through the use of automated techniques.
Example:In the audit of a less complex entity, the auditor may be able to extract a total listing of all journal entries into a simple spreadsheet. It may then be possible for the auditor to sort the journal entries by applying a variety of filters such as currency amount, name of the preparer or reviewer, journal entries that gross up the balance sheet and income statement only, or to view the listing by the date the journal entry was posted to the general ledger, to assist the auditor in designing responses to the risks identified relating to journal entries.
Controls for which the auditor plans to test the operating effectiveness (Ref: Para. 26(a)(iii))
The auditor determines whether there are any risks of material misstatement at the assertion level for which it is not possible to obtain sufficient appropriate audit evidence through substantive procedures alone. The auditor is required, in accordance with ASA 330,[42] to design and perform tests of controls that address such risks of material misstatement when substantive procedures alone do not provide sufficient appropriate audit evidence at the assertion level. As a result, when such controls exist that address these risks, they are required to be identified and evaluated.
In other cases, when the auditor plans to take into account the operating effectiveness of controls in determining the nature, timing and extent of substantive procedures in accordance with ASA 330, such controls are also required to be identified because ASA 330[43] requires the auditor to design and perform tests of those controls.
Examples:The auditor may plan to test the operating effectiveness of controls:Over routine classes of transactions because such testing may be more effective or efficient for large volumes of homogenous transactions.Over the completeness and accuracy of information produced by the entity (e.g., controls over the preparation of system-generated reports), to determine the reliability of that information, when the auditor intends to take into account the operating effectiveness of those controls in designing and performing further audit procedures.Relating to operations and compliance objectives when they relate to data the auditor evaluates or uses in applying audit procedures.
The auditor’s plans to test the operating effectiveness of controls may also be influenced by the identified risks of material misstatement at the financial report level. For example, if deficiencies are identified related to the control environment, this may affect the auditor’s overall expectations about the operating effectiveness of direct controls.
Other controls that the auditor considers appropriate (Ref: Para. 26(a)(iv))
Other controls that the auditor may consider are appropriate to identify, and evaluate the design and determine the implementation, may include:
Controls that address risks assessed as higher on the spectrum of inherent risk but have not been determined to be a significant risk;
Controls related to reconciling detailed records to the general ledger; or
Complementary user entity controls, if using a service organisation.[44]
Identifying IT applications and other aspects of the IT environment, risks arising from the use of IT and general IT controls (Ref: Para. 26(b)‒(c))
Appendix 5 includes example characteristics of IT applications and other aspects of the IT environment, and guidance related to those characteristics, that may be relevant in identifying IT applications and other aspects of the IT environment subject to risks arising from the use of IT.
Identifying IT applications and other aspects of the IT environment (Ref: Para. 26(b))
Why the auditor identifies risks arising from the use of IT and general IT controls related to identified IT applications and other aspects of the IT environment
Understanding the risks arising from the use of IT and the general IT controls implemented by the entity to address those risks may affect:
The auditor’s decision about whether to test the operating effectiveness of controls to address risks of material misstatement at the assertion level;
Example:When general IT controls are not designed effectively or appropriately implemented to address risks arising from the use of IT (e.g., controls do not appropriately prevent or detect unauthorised program changes or unauthorised access to IT applications), this may affect the auditor’s decision to rely on automated controls within the affected IT applications.
The auditor’s assessment of control risk at the assertion level;
Example:The ongoing operating effectiveness of an information processing control may depend on certain general IT controls that prevent or detect unauthorised program changes to the IT information processing control (i.e., program change controls over the related IT application). In such circumstances, the expected operating effectiveness (or lack thereof) of the general IT control may affect the auditor’s assessment of control risk (e.g., control risk may be higher when such general IT controls are expected to be ineffective or if the auditor does not plan to test the general IT controls).
The auditor’s strategy for testing information produced by the entity that is produced by or involves information from the entity’s IT applications;
Example:When information produced by the entity to be used as audit evidence is produced by IT applications, the auditor may determine to test controls over system-generated reports, including identification and testing of the general IT controls that address risks of inappropriate or unauthorised program changes or direct data changes to the reports.
The auditor’s assessment of inherent risk at the assertion level; or
Example:When there are significant or extensive programming changes to an IT application to address new or revised reporting requirements of the applicable financial reporting framework, this may be an indicator of the complexity of the new requirements and their effect on the entity’s financial report. When such extensive programming or data changes occur, the IT application is also likely to be subject to risks arising from the use of IT.
The design of further audit procedures.
Example:If information processing controls depend on general IT controls, the auditor may determine to test the operating effectiveness of the general IT controls, which will then require the design of tests of controls for such general IT controls. If, in the same circumstances, the auditor determines not to test the operating effectiveness of the general IT controls, or the general IT controls are expected to be ineffective, the related risks arising from the use of IT may need to be addressed through the design of substantive procedures. However, the risks arising from the use of IT may not be able to be addressed when such risks relate to risks for which substantive procedures alone do not provide sufficient appropriate audit evidence. In such circumstances, the auditor may need to consider the implications for the audit opinion.
Identifying IT applications that are subject to risks arising from the use of IT
For the IT applications relevant to the information system, understanding the nature and complexity of the specific IT processes and general IT controls that the entity has in place may assist the auditor in determining which IT applications the entity is relying upon to accurately process and maintain the integrity of information in the entity’s information system. Such IT applications may be subject to risks arising from the use of IT.
Identifying the IT applications that are subject to risks arising from the use of IT involves taking into account controls identified by the auditor because such controls may involve the use of IT or rely on IT. The auditor may focus on whether an IT application includes automated controls that management is relying on and that the auditor has identified, including controls that address risks for which substantive procedures alone do not provide sufficient appropriate audit evidence. The auditor may also consider how information is stored and processed in the information system relating to significant classes of transactions, account balances and disclosures and whether management is relying on general IT controls to maintain the integrity of that information.
The controls identified by the auditor may depend on system-generated reports, in which case the IT applications that produce those reports may be subject to risks arising from the use of IT. In other cases, the auditor may not plan to rely on controls over the system-generated reports and plan to directly test the inputs and outputs of such reports, in which case the auditor may not identify the related IT applications as being subject to risks arising from IT.
Scalability
The extent of the auditor’s understanding of the IT processes, including the extent to which the entity has general IT controls in place, will vary with the nature and the circumstances of the entity and its IT environment, as well as based on the nature and extent of controls identified by the auditor. The number of IT applications that are subject to risks arising from the use of IT also will vary based on these factors.
Examples:An entity that uses commercial software and does not have access to the source code to make any program changes is unlikely to have a process for program changes, but may have a process or procedures to configure the software (e.g., the chart of accounts, reporting parameters or thresholds). In addition, the entity may have a process or procedures to manage access to the application (e.g., a designated individual with administrative access to the commercial software). In such circumstances, the entity is unlikely to have or need formalised general IT controls.In contrast, a larger entity may rely on IT to a great extent and the IT environment may involve multiple IT applications and the IT processes to manage the IT environment may be complex (e.g., a dedicated IT department exists that develops and implements program changes and manages access rights), including that the entity has implemented formalised general IT controls over its IT processes.When management is not relying on automated controls or general IT controls to process transactions or maintain the data, and the auditor has not identified any automated controls or other information processing controls (or any that depend on general IT controls), the auditor may plan to directly test any information produced by the entity involving IT and may not identify any IT applications that are subject to risks arising from the use of IT.When management relies on an IT application to process or maintain data and the volume of data is significant, and management relies upon the IT application to perform automated controls that the auditor has also identified, the IT application is likely to be subject to risks arising from the use of IT.
When an entity has greater complexity in its IT environment, identifying the IT applications and other aspects of the IT environment, determining the related risks arising from the use of IT, and identifying general IT controls is likely to require the involvement of team members with specialised skills in IT. Such involvement is likely to be essential, and may need to be extensive, for complex IT environments.
Identifying other aspects of the IT environment that are subject to risks arising from the use of IT
The other aspects of the IT environment that may be subject to risks arising from the use of IT include the network, operating system and databases, and, in certain circumstances, interfaces between IT applications. Other aspects of the IT environment are generally not identified when the auditor does not identify IT applications that are subject to risks arising from the use of IT. When the auditor has identified IT applications that are subject to risks arising from IT, other aspects of the IT environment (e.g., database, operating system, network) are likely to be identified because such aspects support and interact with the identified IT applications.
Identifying risks arising from the use of IT and general IT controls (Ref: Para. 26(c))
Appendix 6 sets out considerations for understanding general IT controls.
In identifying the risks arising from the use of IT, the auditor may consider the nature of the identified IT application or other aspect of the IT environment and the reasons for it being subject to risks arising from the use of IT. For some identified IT applications or other aspects of the IT environment, the auditor may identify applicable risks arising from the use of IT that relate primarily to unauthorised access or unauthorised program changes, as well as that address risks related to inappropriate data changes (e.g., the risk of inappropriate changes to the data through direct database access or the ability to directly manipulate information).
The extent and nature of the applicable risks arising from the use of IT vary depending on the nature and characteristics of the identified IT applications and other aspects of the IT environment. Applicable IT risks may result when the entity uses external or internal service providers for identified aspects of its IT environment (e.g., outsourcing the hosting of its IT environment to a third party or using a shared service centre for central management of IT processes in a group). Applicable risks arising from the use of IT may also be identified related to cybersecurity. It is more likely that there will be more risks arising from the use of IT when the volume or complexity of automated application controls is higher and management is placing greater reliance on those controls for effective processing of transactions or the effective maintenance of the integrity of underlying information.
Evaluating the design, and determining implementation, of identified controls in the control activities component (Ref: Para 26(d))
Evaluating the design of an identified control involves the auditor’s consideration of whether the control, individually or in combination with other controls, is capable of effectively preventing, or detecting and correcting, material misstatements (i.e., the control objective).
The auditor determines the implementation of an identified control by establishing that the control exists and that the entity is using it. There is little point in the auditor assessing the implementation of a control that is not designed effectively. Therefore, the auditor evaluates the design of a control first. An improperly designed control may represent a control deficiency.
Risk assessment procedures to obtain audit evidence about the design and implementation of identified controls in the control activities component may include:
Enquiring of entity personnel.
Observing the application of specific controls.
Inspecting documents and reports.
Enquiry alone, however, is not sufficient for such purposes.
The auditor may expect, based on experience from the previous audit or based on current period risk assessment procedures, that management does not have effectively designed or implemented controls to address a significant risk. In such instances, the procedures performed to address the requirement in paragraph 26(d) may consist of determining that such controls have not been effectively designed or implemented. If the results of the procedures indicate that controls have been newly designed or implemented, the auditor is required to perform the procedures in paragraph 26(b)‒(d) on the newly designed or implemented controls.
The auditor may conclude that a control, which is effectively designed and implemented, may be appropriate to test in order to take its operating effectiveness into account in designing substantive procedures. However, when a control is not designed or implemented effectively, there is no benefit in testing it. When the auditor plans to test a control, the information obtained about the extent to which the control addresses the risk(s) of material misstatement is an input to the auditor’s control risk assessment at the assertion level.
Evaluating the design and determining the implementation of identified controls in the control activities component is not sufficient to test their operating effectiveness. However, for automated controls, the auditor may plan to test the operating effectiveness of automated controls by identifying and testing general IT controls that provide for the consistent operation of an automated control instead of performing tests of operating effectiveness on the automated controls directly. Obtaining audit evidence about the implementation of a manual control at a point in time does not provide audit evidence about the operating effectiveness of the control at other times during the period under audit. Tests of the operating effectiveness of controls, including tests of indirect controls, are further described in ASA 330.[45]
When the auditor does not plan to test the operating effectiveness of identified controls, the auditor’s understanding may still assist in the design of the nature, timing and extent of substantive audit procedures that are responsive to the related risks of material misstatement.
Example:The results of these risk assessment procedures may provide a basis for the auditor’s consideration of possible deviations in a population when designing audit samples.
Control Deficiencies Within the Entity’s System of Internal Control (Ref: Para. 27)
In performing the evaluations of each of the components of the entity’s system of internal control,[46] the auditor may determine that certain of the entity’s policies in a component are not appropriate to the nature and circumstances of the entity. Such a determination may be an indicator that assists the auditor in identifying control deficiencies. If the auditor has identified one or more control deficiencies, the auditor may consider the effect of those control deficiencies on the design of further audit procedures in accordance with ASA 330.
If the auditor has identified one or more control deficiencies, ASA 265[47] requires the auditor to determine whether, individually or in combination, the deficiencies constitute a significant deficiency. The auditor uses professional judgement in determining whether a deficiency represents a significant control deficiency.[48]
Examples:Circumstances that may indicate a significant control deficiency exists include matters such as:The identification of fraud of any magnitude that involves senior management;Identified internal processes that are inadequate relating to the reporting and communication of deficiencies noted by internal audit;Previously communicated deficiencies that are not corrected by management in a timely manner;Failure by management to respond to significant risks, for example, by not implementing controls over significant risks; andThe restatement of previously issued financial reports.
Identifying and Assessing the Risks of Material Misstatement (Ref: Para. 28‒37)
Why the Auditor Identifies and Assesses the Risks of Material Misstatement
Risks of material misstatement are identified and assessed by the auditor in order to determine the nature, timing and extent of further audit procedures necessary to obtain sufficient appropriate audit evidence. This evidence enables the auditor to express an opinion on the financial report at an acceptably low level of audit risk.
Information gathered by performing risk assessment procedures is used as audit evidence to provide the basis for the identification and assessment of the risks of material misstatement. For example, the audit evidence obtained when evaluating the design of identified controls and determining whether those controls have been implemented in the control activities component, is used as audit evidence to support the risk assessment. Such evidence also provides a basis for the auditor to design overall responses to address the assessed risks of material misstatement at the financial report level, as well as designing and performing further audit procedures whose nature, timing and extent are responsive to the assessed risks of material misstatement at the assertion level, in accordance with ASA 330.
Identifying Risks of Material Misstatement (Ref: Para. 28)
The identification of risks of material misstatement is performed before consideration of any related controls (i.e., the inherent risk), and is based on the auditor’s preliminary consideration of misstatements that have a reasonable possibility of both occurring, and being material if they were to occur.[49]
Identifying the risks of material misstatement also provides the basis for the auditor’s determination of relevant assertions, which assists the auditor’s determination of the significant classes of transactions, account balances and disclosures.
Assertions
Why the Auditor Uses Assertions
In identifying and assessing the risks of material misstatement, the auditor uses assertions to consider the different types of potential misstatements that may occur. Assertions for which the auditor has identified related risks of material misstatement are relevant assertions.
The Use of Assertions
In identifying and assessing the risks of material misstatement, the auditor may use the categories of assertions as described in paragraph A190(a)‒(b) below or may express them differently provided all aspects described below have been covered. The auditor may choose to combine the assertions about classes of transactions and events, and related disclosures, with the assertions about account balances, and related disclosures.
Assertions used by the auditor in considering the different types of potential misstatements that may occur may fall into the following categories:
Assertions about classes of transactions and events, and related disclosures, for the period under audit:
Occurrence—transactions and events that have been recorded or disclosed have occurred, and such transactions and events pertain to the entity.
Completeness—all transactions and events that should have been recorded have been recorded, and all related disclosures that should have been included in the financial report have been included.
Accuracy—amounts and other data relating to recorded transactions and events have been recorded appropriately, and related disclosures have been appropriately measured and described.
Cut-off—transactions and events have been recorded in the correct accounting period.
Classification—transactions and events have been recorded in the proper accounts.
Presentation—transactions and events are appropriately aggregated or disaggregated and clearly described, and related disclosures are relevant and understandable in the context of the requirements of the applicable financial reporting framework.
Assertions about account balances, and related disclosures, at the period end:
Existence—assets, liabilities and equity interests exist.
Rights and obligations—the entity holds or controls the rights to assets, and liabilities are the obligations of the entity.
Completeness—all assets, liabilities and equity interests that should have been recorded have been recorded, and all related disclosures that should have been included in the financial report have been included.
Accuracy, valuation and allocation—assets, liabilities and equity interests have been included in the financial report at appropriate amounts and any resulting valuation or allocation adjustments have been appropriately recorded, and related disclosures have been appropriately measured and described.
Classification—assets, liabilities and equity interests have been recorded in the proper accounts.
Presentation—assets, liabilities and equity interests are appropriately aggregated or disaggregated and clearly described, and related disclosures are relevant and understandable in the context of the requirements of the applicable financial reporting framework.
The assertions described in paragraph A190(a)‒(b) above, adapted as appropriate, may also be used by the auditor in considering the different types of misstatements that may occur in disclosures not directly related to recorded classes of transactions, events or account balances.
Example:An example of such a disclosure includes where the entity may be required by the applicable financial reporting framework to describe its exposure to risks arising from financial instruments, including how the risks arise; the objectives, policies and processes for managing the risks; and the methods used to measure the risks.
Considerations Specific to Public Sector Entities
When making assertions about the financial report of public sector entities, in addition to those assertions set out in paragraph A190(a)‒(b), management may often assert that transactions and events have been carried out in accordance with law, regulation or other authority. Such assertions may fall within the scope of the financial report audit.
Risks of Material Misstatement at the Financial Report Level (Ref: Para. 28(a) and 30)
Why the Auditor Identifies and Assesses Risks of Material Misstatement at the Financial Report Level
The auditor identifies risks of material misstatement at the financial report level to determine whether the risks have a pervasive effect on the financial report, and would therefore require an overall response in accordance with ASA 330.[50]
In addition, risks of material misstatement at the financial report level may also affect individual assertions, and identifying these risks may assist the auditor in assessing risks of material misstatement at the assertion level, and in designing further audit procedures to address the identified risks.
Identifying and Assessing Risks of Material Misstatement at the Financial Report Level
Risks of material misstatement at the financial report level refer to risks that relate pervasively to the financial report as a whole, and potentially affect many assertions. Risks of this nature are not necessarily risks identifiable with specific assertions at the class of transactions, account balance or disclosure level (e.g., risk of management override of controls). Rather, they represent circumstances that may pervasively increase the risks of material misstatement at the assertion level. The auditor’s evaluation of whether risks identified relate pervasively to the financial report supports the auditor’s assessment of the risks of material misstatement at the financial report level. In other cases, a number of assertions may also be identified as susceptible to the risk, and may therefore affect the auditor’s risk identification and assessment of risks of material misstatement at the assertion level.
Example:The entity faces operating losses and liquidity issues and is reliant on funding that has not yet been secured. In such a circumstance, the auditor may determine that the going concern basis of accounting gives rise to a risk of material misstatement at the financial report level. In this situation, the accounting framework may need to be applied using a liquidation basis, which would likely affect all assertions pervasively.
The auditor’s identification and assessment of risks of material misstatement at the financial report level is influenced by the auditor’s understanding of the entity’s system of internal control, in particular the auditor’s understanding of the control environment, the entity’s risk assessment process and the entity’s process to monitor the system of internal control, and:
The outcome of the related evaluations required by paragraphs 21(b), 22(b), 24(c) and 25(c); and
Any control deficiencies identified in accordance with paragraph 27.
In particular, risks at the financial report level may arise from deficiencies in the control environment or from external events or conditions such as declining economic conditions.
Risks of material misstatement due to fraud may be particularly relevant to the auditor’s consideration of the risks of material misstatement at the financial report level.
Example:The auditor understands from enquiries of management that the entity’s financial report is to be used in discussions with lenders in order to secure further financing to maintain working capital. The auditor may therefore determine that there is a greater susceptibility to misstatement due to fraud risk factors that affect inherent risk (i.e., the susceptibility of the financial report to material misstatement because of the risk of fraudulent financial reporting, such as overstatement of assets and revenue and under-statement of liabilities and expenses to ensure that financing will be obtained).
The auditor’s understanding, including the related evaluations, of the control environment and other components of the system of internal control may raise doubts about the auditor’s ability to obtain audit evidence on which to base the audit opinion or be cause for withdrawal from the engagement where withdrawal is possible under applicable law or regulation.
Examples:As a result of evaluating the entity’s control environment, the auditor has concerns about the integrity of the entity’s management, which may be so serious as to cause the auditor to conclude that the risk of intentional misrepresentation by management in the financial report is such that an audit cannot be conducted.As a result of evaluating the entity’s information system and communication, the auditor determines that significant changes in the IT environment have been poorly managed, with little oversight from management and those charged with governance. The auditor concludes that there are significant concerns about the condition and reliability of the entity’s accounting records. In such circumstances, the auditor may determine that it is unlikely that sufficient appropriate audit evidence will be available to support an unmodified opinion on the financial report.
ASA 705[51] establishes requirements and provides guidance in determining whether there is a need for the auditor to express a qualified opinion or disclaim an opinion or, as may be required in some cases, to withdraw from the engagement where withdrawal is possible under applicable law or regulation.
Considerations Specific to Public Sector Entities
For public sector entities, the identification of risks at the financial report level may include consideration of matters related to the political climate, public interest and program sensitivity.
Risks of Material Misstatement at the Assertion Level (Ref: Para. 28(b))
Appendix 2 sets out examples, in the context of inherent risk factors, of events or conditions that may indicate susceptibility to misstatement that may be material.
Risks of material misstatements that do not relate pervasively to the financial report are risks of material misstatement at the assertion level.
Relevant Assertions and Significant Classes of Transactions, Account Balances and Disclosures (Ref: Para. 29)
Why Relevant Assertions and Significant Classes of Transactions, Account Balances and Disclosures Are Determined
Determining relevant assertions and the significant classes of transactions, account balances and disclosures provides the basis for the scope of the auditor’s understanding of the entity’s information system required to be obtained in accordance with paragraph 25(a). This understanding may further assist the auditor in identifying and assessing risks of material misstatement (see A86).
Automated Tools and Techniques
The auditor may use automated techniques to assist in the identification of significant classes of transactions, account balances and disclosures.
Examples:An entire population of transactions may be analysed using automated tools and techniques to understand their nature, source, size and volume. By applying automated techniques, the auditor may, for example, identify that an account with a zero balance at period end was comprised of numerous offsetting transactions and journal entries occurring during the period, indicating that the account balance or class of transactions may be significant (e.g., a payroll clearing account). This same payroll clearing account may also identify expense re-imbursements to management (and other employees), which could be a significant disclosure due to these payments being made to related parties.By analysing the flows of an entire population of revenue transactions, the auditor may more easily identify a significant class of transactions that had not previously been identified.
Disclosures that May Be Significant
Significant disclosures include both quantitative and qualitative disclosures for which there is one or more relevant assertions. Examples of disclosures that have qualitative aspects and that may have relevant assertions and may therefore be considered significant by the auditor include disclosures about:
Liquidity and debt covenants of an entity in financial distress.
Events or circumstances that have led to the recognition of an impairment loss.
Key sources of estimation uncertainty, including assumptions about the future.
The nature of a change in accounting policy, and other relevant disclosures required by the applicable financial reporting framework, where, for example, new financial reporting requirements are expected to have a significant impact on the financial position and financial performance of the entity.
Share-based payment arrangements, including information about how any amounts recognised were determined, and other relevant disclosures.
Related parties, and related party transactions.
Sensitivity analysis, including the effects of changes in assumptions used in the entity’s valuation techniques intended to enable users to understand the underlying measurement uncertainty of a recorded or disclosed amount.
Assessing Risks of Material Misstatement at the Assertion Level
Assessing Inherent Risk (Ref: Para. 31‒33)
Assessing the likelihood and magnitude of misstatement (Ref: Para: 31)
Why the auditor assesses likelihood and magnitude of misstatement
The auditor assesses the likelihood and magnitude of misstatement for identified risks of material misstatement because the significance of the combination of the likelihood of a misstatement occurring and the magnitude of the potential misstatement were the misstatement to occur determines where on the spectrum of inherent risk the identified risk is assessed, which informs the auditor’s design of further audit procedures to address the risk.
Assessing the inherent risk of identified risks of material misstatement also assists the auditor in determining significant risks. The auditor determines significant risks because specific responses to significant risks are required in accordance with ASA 330 and other ASAs.
Inherent risk factors influence the auditor’s assessment of the likelihood and magnitude of misstatement for the identified risks of material misstatement at the assertion level. The greater the degree to which a class of transactions, account balance or disclosure is susceptible to material misstatement, the higher the inherent risk assessment is likely to be. Considering the degree to which inherent risk factors affect the susceptibility of an assertion to misstatement assists the auditor in appropriately assessing inherent risk for risks of material misstatement at the assertion level and in designing a more precise response to such a risk.
Spectrum of inherent risk
In assessing inherent risk, the auditor uses professional judgement in determining the significance of the combination of the likelihood and magnitude of a misstatement.
The assessed inherent risk relating to a particular risk of material misstatement at the assertion level represents a judgement within a range, from lower to higher, on the spectrum of inherent risk. The judgement about where in the range inherent risk is assessed may vary based on the nature, size and complexity of the entity, and takes into account the assessed likelihood and magnitude of the misstatement and inherent risk factors.
In considering the likelihood of a misstatement, the auditor considers the possibility that a misstatement may occur, based on consideration of the inherent risk factors.
In considering the magnitude of a misstatement, the auditor considers the qualitative and quantitative aspects of the possible misstatement (i.e., misstatements in assertions about classes of transactions, account balances or disclosures may be judged to be material due to size, nature or circumstances).
The auditor uses the significance of the combination of the likelihood and magnitude of a possible misstatement in determining where on the spectrum of inherent risk (i.e., the range) inherent risk is assessed. The higher the combination of likelihood and magnitude, the higher the assessment of inherent risk; the lower the combination of likelihood and magnitude, the lower the assessment of inherent risk.
For a risk to be assessed as higher on the spectrum of inherent risk, it does not mean that both the magnitude and likelihood need to be assessed as high. Rather, it is the intersection of the magnitude and likelihood of the material misstatement on the spectrum of inherent risk that will determine whether the assessed inherent risk is higher or lower on the spectrum of inherent risk. A higher inherent risk assessment may also arise from different combinations of likelihood and magnitude, for example a higher inherent risk assessment could result from a lower likelihood but a very high magnitude.
In order to develop appropriate strategies for responding to risks of material misstatement, the auditor may designate risks of material misstatement within categories along the spectrum of inherent risk, based on their assessment of inherent risk. These categories may be described in different ways. Regardless of the method of categorisation used, the auditor’s assessment of inherent risk is appropriate when the design and implementation of further audit procedures to address the identified risks of material misstatement at the assertion level is appropriately responsive to the assessment of inherent risk and the reasons for that assessment.
Pervasive Risks of Material Misstatement at the Assertion Level (Ref: Para 31(b))
In assessing the identified risks of material misstatement at the assertion level, the auditor may conclude that some risks of material misstatement relate more pervasively to the financial report as a whole and potentially affect many assertions, in which case the auditor may update the identification of risks of material misstatement at the financial report level.
In circumstances in which risks of material misstatement are identified as financial report level risks due to their pervasive effect on a number of assertions, and are identifiable with specific assertions, the auditor is required to take into account those risks when assessing inherent risk for risks of material misstatement at the assertion level.
Considerations Specific to Public Sector Entities
In exercising professional judgement as to the assessment of the risk of material misstatement, public sector auditors may consider the complexity of the regulations and directives, and the risks of non-compliance with authorities.
Significant Risks (Ref: Para. 32)
Why significant risks are determined and the implications for the audit
The determination of significant risks allows for the auditor to focus more attention on those risks that are on the upper end of the spectrum of inherent risk, through the performance of certain required responses, including:
Controls that address significant risks are required to be identified in accordance with paragraph 26(a)(i), with a requirement to evaluate whether the control has been designed effectively and implemented in accordance with paragraph 26(d).
ASA 330 requires controls that address significant risks to be tested in the current period (when the auditor intends to rely on the operating effectiveness of such controls) and substantive procedures to be planned and performed that are specifically responsive to the identified significant risk.[52]
ASA 330 requires the auditor to obtain more persuasive audit evidence the higher the auditor’s assessment of risk.[53]
ASA 260 requires communicating with those charged with governance about the significant risks identified by the auditor.[54]
ASA 701 requires the auditor to take into account significant risks when determining those matters that required significant auditor attention, which are matters that may be key audit matters.[55]
Timely review of audit documentation by the engagement partner at the appropriate stages during the audit allows significant matters, including significant risks, to be resolved on a timely basis to the engagement partner’s satisfaction on or before the date of the auditor’s report.[56]
ASA 600 requires the group auditor to evaluate the appropriateness of the design and performance of further audit procedures for areas of higher assessed risks of material misstatement of the group financial report, or significant risks, on which a component auditor is determining the further audit procedures to be performed.[57]
Determining significant risks
In determining significant risks, the auditor may first identify those assessed risks of material misstatement that have been assessed higher on the spectrum of inherent risk to form the basis for considering which risks may be close to the upper end. Being close to the upper end of the spectrum of inherent risk will differ from entity to entity, and will not necessarily be the same for an entity period on period. It may depend on the nature and circumstances of the entity for which the risk is being assessed.
The determination of which of the assessed risks of material misstatement are close to the upper end of the spectrum of inherent risk, and are therefore significant risks, is a matter of professional judgement, unless the risk is of a type specified to be treated as a significant risk in accordance with the requirements of another ASA. ASA 240 provides further requirements and guidance in relation to the identification and assessment of the risks of material misstatement due to fraud.[58]
Example:Cash at a supermarket retailer would ordinarily be determined to be a high likelihood of possible misstatement (due to the risk of cash being misappropriated), however the magnitude would typically be very low (due to the low levels of physical cash handled in the stores). The combination of these two factors on the spectrum of inherent risk would be unlikely to result in the existence of cash being determined to be a significant risk.An entity is in negotiations to sell a business segment. The auditor considers the effect on goodwill impairment, and may determine there is a higher likelihood of possible misstatement and a higher magnitude due to the impact of inherent risk factors of subjectivity, uncertainty and susceptibility to management bias or other fraud risk factors. This may result in goodwill impairment being determined to be a significant risk.
The auditor also takes into the account the relative effects of inherent risk factors when assessing inherent risk. The lower the effect of inherent risk factors, the lower the assessed risk is likely to be. Risks of material misstatement that may be assessed as having higher inherent risk and may therefore be determined to be a significant risk, may arise from matters such as the following:
Transactions for which there are multiple acceptable accounting treatments such that subjectivity is involved.
Accounting estimates that have high estimation uncertainty or complex models.
Complexity in data collection and processing to support account balances.
Account balances or quantitative disclosures that involve complex calculations.
Accounting principles that may be subject to differing interpretation.
Changes in the entity’s business that involve changes in accounting, for example, mergers and acquisitions.
Risks for Which Substantive Procedures Alone Do Not Provide Sufficient Appropriate Audit Evidence (Ref: Para. 33)
Why risks for which substantive procedures alone do not provide sufficient appropriate audit evidence are required to be identified
Due to the nature of a risk of material misstatement, and the control activities that address that risk, in some circumstances the only way to obtain sufficient appropriate audit evidence is to test the operating effectiveness of controls. Accordingly, there is a requirement for the auditor to identify any such risks because of the implications for the design and performance of further audit procedures in accordance with ASA 330 to address risks of material misstatement at the assertion level.
Paragraph 26(a)(iii) also requires the identification of controls that address risks for which substantive procedures alone cannot provide sufficient appropriate audit evidence because the auditor is required, in accordance with ASA 330,[59] to design and perform tests of such controls.
Determining risks for which substantive procedures alone do not provide sufficient appropriate audit evidence
Where routine business transactions are subject to highly automated processing with little or no manual intervention, it may not be possible to perform only substantive procedures in relation to the risk. This may be the case in circumstances where a significant amount of an entity’s information is initiated, recorded, processed, or reported only in electronic form such as in an information system that involves a high degree of integration across its IT applications. In such cases:
Audit evidence may be available only in electronic form, and its sufficiency and appropriateness usually depend on the effectiveness of controls over its accuracy and completeness.
The potential for improper initiation or alteration of information to occur and not be detected may be greater if appropriate controls are not operating effectively.
Example:It is typically not possible to obtain sufficient appropriate audit evidence relating to revenue for a telecommunications entity based on substantive procedures alone. This is because the evidence of call or data activity does not exist in a form that is observable. Instead, substantial controls testing is typically performed to determine that the origination and completion of calls, and data activity is correctly captured (e.g., minutes of a call or volume of a download) and recorded correctly in the entity’s billing system.
ASA 540 provides further guidance related to accounting estimates about risks for which substantive procedures alone do not provide sufficient appropriate audit evidence.[60] In relation to accounting estimates this may not be limited to automated processing, but may also be applicable to complex models.
Assessing Control Risk (Ref: Para. 34)
The auditor’s plans to test the operating effectiveness of controls is based on the expectation that controls are operating effectively, and this will form the basis of the auditor’s assessment of control risk. The initial expectation of the operating effectiveness of controls is based on the auditor’s evaluation of the design, and the determination of implementation, of the identified controls in the control activities component. Once the auditor has tested the operating effectiveness of the controls in accordance with ASA 330, the auditor will be able to confirm the initial expectation about the operating effectiveness of controls. If the controls are not operating effectively as expected, then the auditor will need to revise the control risk assessment in accordance with paragraph 37.
The auditor’s assessment of control risk may be performed in different ways depending on preferred audit techniques or methodologies, and may be expressed in different ways.
If the auditor plans to test the operating effectiveness of controls, it may be necessary to test a combination of controls to confirm the auditor’s expectation that the controls are operating effectively. The auditor may plan to test both direct and indirect controls, including general IT controls, and, if so, take into account the combined expected effect of the controls when assessing control risk. To the extent that the control to be tested does not fully address the assessed inherent risk , the auditor determines the implications on the design of further audit procedures to reduce audit risk to an acceptably low level.
When the auditor plans to test the operating effectiveness of an automated control, the auditor may also plan to test the operating effectiveness of the relevant general IT controls that support the continued functioning of that automated control to address the risks arising from the use of IT, and to provide a basis for the auditor’s expectation that the automated control operated effectively throughout the period. When the auditor expects related general IT controls to be ineffective, this determination may affect the auditor’s assessment of control risk at the assertion level and the auditor’s further audit procedures may need to include substantive procedures to address the applicable risks arising from the use of IT. Further guidance about the procedures that the auditor may perform in these circumstances is provided in ASA 330.[61]
Evaluating the Audit Evidence Obtained from the Risk Assessment Procedures (Ref: Para 35)
Why the Auditor Evaluates the Audit Evidence from the Risk Assessment Procedures
Audit evidence obtained from performing risk assessment procedures provides the basis for the identification and assessment of the risks of material misstatement. This provides the basis for the auditor’s design of the nature, timing and extent of further audit procedures responsive to the assessed risks of material misstatement, at the assertion level, in accordance with ASA 330. Accordingly, the audit evidence obtained from the risk assessment procedures provides a basis for the identification and assessment of risks of material misstatement whether due to fraud or error, at the financial report and assertion levels.
The Evaluation of the Audit Evidence
Audit evidence from risk assessment procedures comprises both information that supports and corroborates management’s assertions, and any information that contradicts such assertions.[62]
Professional Scepticism
In evaluating the audit evidence from the risk assessment procedures, the auditor considers whether sufficient understanding about the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control has been obtained to be able to identify the risks of material misstatement, as well as whether there is any evidence that is contradictory that may indicate a risk of material misstatement.
Classes of Transactions, Account Balances and Disclosures that Are Not Significant, but Which Are Material (Ref: Para. 36)
As explained in ASA 320,[63] materiality and audit risk are considered when identifying and assessing the risks of material misstatement in classes of transactions, account balances and disclosures. The auditor’s determination of materiality is a matter of professional judgement, and is affected by the auditor’s perception of the financial information needs of users of the financial report.[64] For the purpose of this ASA and paragraph 18 of ASA 330, classes of transactions, account balances or disclosures are material if omitting, misstating or obscuring information about them could reasonably be expected to influence the economic decisions of users taken on the basis of the financial report as a whole.
There may be classes of transactions, account balances or disclosures that are material but have not been determined to be significant classes of transactions, account balances or disclosures (i.e., there are no relevant assertions identified).
Example:The entity may have a disclosure about executive compensation for which the auditor has not identified a risk of material misstatement. However, the auditor may determine that this disclosure is material based on the considerations in paragraph A233.
Audit procedures to address classes of transactions, account balances or disclosures that are material but are not determined to be significant are addressed in ASA 330.[65] When a class of transactions, account balance or disclosure is determined to be significant as required by paragraph 29, the class of transactions, account balance or disclosure is also a material class of transactions, account balance or disclosure for the purposes of paragraph 18 of ASA 330.
Revision of Risk Assessment (Ref: Para. 37)
During the audit, new or other information may come to the auditor’s attention that differs significantly from the information on which the risk assessment was based.
Example:The entity’s risk assessment may be based on an expectation that certain controls are operating effectively. In performing tests of those controls, the auditor may obtain audit evidence that they were not operating effectively at relevant times during the audit. Similarly, in performing substantive procedures the auditor may detect misstatements in amounts or frequency greater than is consistent with the auditor’s risk assessments. In such circumstances, the risk assessment may not appropriately reflect the true circumstances of the entity and the further planned audit procedures may not be effective in detecting material misstatements. Paragraphs 16 and 17 of ASA 330 provide further guidance about evaluating the operating effectiveness of controls.
Documentation (Ref: Para. 38)
For recurring audits, certain documentation may be carried forward, updated as necessary to reflect changes in the entity’s business or processes.
ASA 230 notes that, among other considerations, although there may be no single way in which the auditor’s exercise of professional scepticism is documented, the audit documentation may nevertheless provide evidence of the auditor’s exercise of professional scepticism.[66] For example, when the audit evidence obtained from risk assessment procedures includes evidence that both corroborates and contradicts management’s assertions, the documentation may include how the auditor evaluated that evidence, including the professional judgements made in evaluating whether the audit evidence provides an appropriate basis for the auditor’s identification and assessment of the risks of material misstatement. Examples of other requirements in this ASA for which documentation may provide evidence of the exercise of professional scepticism by the auditor include:
Paragraph 13, which requires the auditor to design and perform risk assessment procedures in a manner that is not biased towards obtaining audit evidence that may corroborate the existence of risks or towards excluding audit evidence that may contradict the existence of risks;
Paragraph 17, which requires a discussion among key engagement team members of the application of the applicable financial reporting framework and the susceptibility of the entity’s financial report to material misstatement;
Paragraphs 19(b) and 20, which require the auditor to obtain an understanding of the reasons for any changes to the entity’s accounting policies and to evaluate whether the entity’s accounting policies are appropriate and consistent with the applicable financial reporting framework;
Paragraphs 21(b), 22(b), 23(b), 24(c), 25(c), 26(d) and 27, which require the auditor to evaluate, based on the required understanding obtained, whether the components of the entity’s system of internal control are appropriate to the entity’s circumstances considering the nature and complexity of the entity, and to determine whether one of more control deficiencies have been identified;
Paragraph 35, which requires the auditor to take into account all audit evidence obtained from the risk assessment procedures, whether corroborative or contradictory to assertions made by management, and to evaluate whether the audit evidence obtained from the risk assessment procedures provides an appropriate basis for the identification and assessment of the risks of material misstatement; and
Paragraph 36, which requires the auditor to evaluate, when applicable, whether the auditor’s determination that there are no risks of material misstatement for a material class of transactions, account balance or disclosure remains appropriate.
Scalability
The manner in which the requirements of paragraph 38 are documented is for the auditor to determine using professional judgement.
More detailed documentation, that is sufficient to enable an experienced auditor, having no previous experience with the audit, to understand the nature, timing and extent of the audit procedures performed, may be required to support the rationale for difficult judgements made.
For the audits of less complex entities, the form and extent of documentation may be simple and relatively brief. The form and extent of the auditor’s documentation is influenced by the nature, size and complexity of the entity and its system of internal control, availability of information from the entity and the audit methodology and technology used in the course of the audit. It is not necessary to document the entirety of the auditor’s understanding of the entity and matters related to it. Key elements[67] of understanding documented by the auditor may include those on which the auditor based the assessment of the risks of material misstatement. However, the auditor is not required to document every inherent risk factor that was taken into account in identifying and assessing the risks of material misstatement at the assertion level.
Example:In audits of less complex entities audit documentation may be incorporated in the auditor’s documentation of the overall strategy and audit plan.[68] Similarly, for example, the results of the risk assessment may be documented separately, or may be documented as part of the auditor’s documentation of further audit procedures.[69]
Appendix 1
(Ref: Para. A61‒A67)
Considerations for Understanding the Entity and its Business Model
This appendix explains the objectives and scope of the entity’s business model and provides examples of matters that the auditor may consider in understanding the activities of the entity that may be included in the business model. The auditor’s understanding of the entity’s business model, and how it is affected by its business strategy and business objectives, may assist the auditor in identifying business risks that may have an effect on the financial report. In addition, this may assist the auditor in identifying risks of material misstatement.
Objectives and Scope of an Entity’s Business Model
An entity’s business model describes how an entity considers, for example its organisational structure, operations or scope of activities, business lines (including competitors and customers thereof), processes, growth opportunities, globalization, regulatory requirements and technologies. The entity’s business model describes how the entity creates, preserves and captures financial or broader value, for its stakeholders.
Strategies are the approaches by which management plans to achieve the entity’s objectives, including how the entity plans to address the risks and opportunities that it faces. An entity’s strategies are changed over time by management, to respond to changes in its objectives and in the internal and external circumstances in which it operates.
A description of a business model typically includes:
The scope of the entity’s activities, and why it does them.
The entity’s structure and scale of its operations.
The markets or geographical or demographic spheres, and parts of the value chain, in which it operates, how it engages with those markets or spheres (main products, customer segments and distribution methods), and the basis on which it competes.
The entity’s business or operating processes (e.g., investment, financing and operating processes) employed in performing its activities, focusing on those parts of the business processes that are important in creating, preserving or capturing value.
The resources (e.g., financial, human, intellectual, environmental and technological) and other inputs and relationships (e.g., customers, competitors, suppliers and employees) that are necessary or important to its success.
How the entity’s business model integrates the use of IT in its interactions with customers, suppliers, lenders and other stakeholders through IT interfaces and other technologies.
A business risk may have an immediate consequence for the risk of material misstatement for classes of transactions, account balances, and disclosures at the assertion level or the financial report level. For example, the business risk arising from a significant fall in real estate market values may increase the risk of material misstatement associated with the valuation assertion for a lender of medium-term real estate backed loans. However, the same risk, particularly in combination with a severe economic downturn that concurrently increases the underlying risk of lifetime credit losses on its loans, may also have a longer-term consequence. The resulting net exposure to credit losses may cast significant doubt on the entity’s ability to continue as a going concern. If so, this could have implications for management’s, and the auditor’s, conclusion as to the appropriateness of the entity’s use of the going concern basis of accounting, and determination as to whether a material uncertainty exists. Whether a business risk may result in a risk of material misstatement is, therefore, considered in light of the entity’s circumstances. Examples of events and conditions that may give rise to the existence of risks of material misstatement are indicated in Appendix 2.
Activities of the Entity
Examples of matters that the auditor may consider when obtaining an understanding of the activities of the entity (included in the entity’s business model) include:
(e) Business operations such as:
Nature of revenue sources, products or services, and markets, including involvement in electronic commerce such as Internet sales and marketing activities.
Conduct of operations (for example, stages and methods of production, or activities exposed to environmental risks).
Alliances, joint ventures, and outsourcing activities.
Geographic dispersion and industry segmentation.
Location of production facilities, warehouses, and offices, and location and quantities of inventories.
Key customers and important suppliers of goods and services, employment arrangements (including the existence of union contracts, superannuation and other post- employment benefits, stock option or incentive bonus arrangements, and government regulation related to employment matters).
Research and development activities and expenditures.
Transactions with related parties.
(f) Investments and investment activities such as:
Planned or recently executed acquisitions or divestitures.
Investments and dispositions of securities and loans.
Capital investment activities.
Investments in non-consolidated entities, including non-controlled partnerships, joint ventures and non-controlled special-purpose entities.
(g) Financing and financing activities such as:
Ownership structure of major subsidiaries and associated entities, including consolidated and non-consolidated structures.
Debt structure and related terms, including off-balance-sheet financing arrangements and leasing arrangements.
Beneficial owners (for example, local, foreign, business reputation and experience) and related parties.
Use of derivative financial instruments.
Nature of Special-Purpose Entities
A special-purpose entity (sometimes referred to as a special-purpose vehicle) is an entity that is generally established for a narrow and well-defined purpose, such as to effect a lease or a securitisation of financial assets, or to carry out research and development activities. It may take the form of a corporation, trust, partnership or unincorporated entity. The entity on behalf of which the special-purpose entity has been created may often transfer assets to the latter (for example, as part of a derecognition transaction involving financial assets), obtain the right to use the latter’s assets, or perform services for the latter, while other parties may provide the funding to the latter. As ASA 550 indicates, in some circumstances, a special-purpose entity may be a related party of the entity.[70]
Financial reporting frameworks often specify detailed conditions that are deemed to amount to control, or circumstances under which the special-purpose entity should be considered for consolidation. The interpretation of the requirements of such frameworks often demands a detailed knowledge of the relevant agreements involving the special-purpose entity.