Section Obtaining an Understanding of the Entity - Auditing Standard ASA 315 Identifying and Assessing the Risks of Material Misstatement - Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework and the Entity’s System of Internal Control (Ref: Para. A48‒A49) | Zoe
Auditing Standard ASA 315 Identifying and Assessing the Risks of Material Misstatement
Obtaining an Understanding of the EntityObtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework and the Entity’s System of Internal Control (Ref: Para. A48‒A49)
Start here
Get a plain-English read of Obtaining an Understanding of the Entity
Turn the raw legal text into a practical explanation grounded in Auditing Standard ASA 315 Identifying and Assessing the Risks of Material Misstatement.
Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework and the Entity’s System of Internal Control (Ref: Para. A48‒A49)
Understanding the Entity and Its Environment, and the Applicable Financial Reporting Framework (Ref: Para. A50‒A55)
The auditor shall perform risk assessment procedures to obtain an understanding of:
The following aspects of the entity and its environment:
The entity’s organisational structure, ownership and governance, and its business model, including the extent to which the business model integrates the use of IT; (Ref: Para. A56‒A67)
Industry, regulatory and other external factors; (Ref: Para. A68‒A73) and
The measures used, internally and externally, to assess the entity’s financial performance; (Ref: Para. A74‒A81)
The applicable financial reporting framework, and the entity’s accounting policies and the reasons for any changes thereto; (Ref: Para. A82‒A84) and
How inherent risk factors affect susceptibility of assertions to misstatement and the degree to which they do so, in the preparation of the financial report in accordance with the applicable financial reporting framework, based on the understanding obtained in (a) and (b). (Ref: Para. A85‒A89)
The auditor shall evaluate whether the entity’s accounting policies are appropriate and consistent with the applicable financial reporting framework.
Understanding the Components of the Entity’s System of Internal Control (Ref: Para. A90 – A95)
Control Environment, the Entity’s Risk Assessment Process and the Entity’s Process to Monitor the System of Internal Control (Ref: Para. A96‒A98)
Control environment
<table cellspacing="0" cellpadding="0" style="width:454.3pt; margin-right:9pt; margin-left:9pt; border:0.75pt solid #000000; border-collapse:collapse; float:left"><thead><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>21.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the control environment relevant to the preparation of the financial report, through performing risk assessment procedures, by: </span><span class="RefParas">(Ref: Para. A99–A100)</span></p></td></tr></thead><tbody><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span><span>(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding the set of controls, processes and structures that address: </span><span class="RefParas">(Ref: Para. A101‒A102)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>How management’s oversight responsibilities are carried out, such as the entity’s culture and management’s commitment to integrity and ethical values;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>When those charged with governance are separate from management, the independence of, and oversight over the entity’s system of internal control by, those charged with governance;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The entity’s assignment of authority and responsibility;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iv)</span></span><span style="width:19.57pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>How the entity attracts, develops, and retains competent individuals; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt; margin-bottom:13pt"><span><span>(v)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>How the entity holds individuals accountable for their responsibilities in the pursuit of the objectives of the system of internal control;</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p><span>and</span></p><p class="ParaLevel2" style="margin-left:35.45pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(b)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Evaluating whether: </span><span class="RefParas">(Ref: Para. A103‒A108)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Management, with the oversight of those charged with governance, has created and maintained a culture of honesty and ethical behaviour;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The control environment provides an appropriate foundation for the other components of the entity’s system of internal control considering the nature and complexity of the entity; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt; margin-bottom:13pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Control deficiencies identified in the control environment undermine the other components of the entity’s system of internal control.</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td></tr></tbody></table>
The entity’s risk assessment process
<table cellspacing="0" cellpadding="0" style="width:454.3pt; border:0.75pt solid #000000; border-collapse:collapse"><tbody><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>22.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the entity’s risk assessment process relevant to the preparation of the financial report, through performing risk assessment procedures, by:</span></p></td></tr><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span><span>(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding the entity’s process for: </span><span class="RefParas">(Ref: Para. A109‒A110)</span></p><ol class="awlist1" style="margin:0pt; padding-left:0pt"><li id="navPoint_52" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt; font-size:9pt"><span style="width:26.96pt; font:7pt 'Times New Roman'; display:inline-block"></span><span style="font-size:11pt">Identifying business risks relevant to financial reporting objectives; </span><span class="RefParas">(Ref: Para. A62)</span></li><li id="navPoint_53" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Assessing the significance of those risks, including the likelihood of their occurrence; and</span></li><li id="navPoint_54" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Addressing those risks;</span></li></ol><p class="ParaPlain" style="margin-top:10pt"><span></span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p><span>and</span></p><ol class="awlist9" style="margin:0pt; padding-left:0pt"><li class="ListParagraph" style="margin-left:35.45pt; margin-bottom:10pt; text-indent:-35.45pt"><span style="width:19.26pt; font:7pt 'Times New Roman'; display:inline-block"></span><span style="display:none"></span><ol class="awlist10" style="margin-right:0pt; margin-left:0pt; padding-left:0pt"><li class="ListParagraph" style="margin-top:10pt; margin-left:35.45pt; margin-bottom:10pt"><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"></span><span style="display:none"></span></li><li id="navPoint_55" class="AParaLevel2" style="margin-top:10pt; margin-left:0pt"><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Evaluating whether the entity’s risk assessment process is appropriate to the entity’s circumstances considering the nature and complexity of the entity.</span><span> </span><span class="RefParas">(Ref: Para. A111‒A113)</span></li></ol></li></ol><p class="ParaPlain" style="margin-top:10pt"><span></span></p></td></tr></tbody></table>
If the auditor identifies risks of material misstatement that management failed to identify, the auditor shall:
Determine whether any such risks are of a kind that the auditor expects would have been identified by the entity’s risk assessment process and, if so, obtain an understanding of why the entity’s risk assessment process failed to identify such risks of material misstatement; and
Consider the implications for the auditor’s evaluation in paragraph 22(b).
The entity’s process to monitor the system of internal control
<table cellspacing="0" cellpadding="0" style="width:454.3pt; margin-right:9pt; margin-left:9pt; border:0.75pt solid #000000; border-collapse:collapse; float:left"><thead><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>24.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the entity’s process for monitoring the system of internal control relevant to the preparation of the financial report, through performing risk assessment procedures, by: </span><span class="RefParas">(Ref: Para. A114–A115)</span></p></td></tr></thead><tbody><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span><span>(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding those aspects of the entity’s process that address:</span></p><ol class="awlist1" style="margin:0pt; padding-left:0pt"><li id="navPoint_59" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Ongoing and separate evaluations for monitoring the effectiveness of controls, and the identification and remediation of control deficiencies identified; </span><span class="RefParas">(Ref: Para. A116‒A117) </span><span>and</span></li><li id="navPoint_60" class="AParaLevel3" style="margin-top:10pt; margin-left:70.9pt; font-size:9pt"><span style="width:24.45pt; font:7pt 'Times New Roman'; display:inline-block"></span><span style="font-size:11pt">The entity’s internal audit function, if any, including its nature, responsibilities and activities; </span><span class="RefParas">(Ref: Para. A118)</span></li></ol><p class="ParaLevel2" style="margin-top:10pt; margin-left:35.45pt; margin-bottom:13pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(b)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding the sources of the information used in the entity’s process to monitor the system of internal control, and the basis upon which management considers the information to be sufficiently reliable for the purpose; </span><span class="RefParas">(Ref: Para. A119‒A120)</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p><span>and</span></p><p class="ParaLevel2" style="margin-left:35.45pt; margin-bottom:13pt"><span><span>(c)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Evaluating whether the entity’s process for monitoring the system of internal control is appropriate to the entity’s circumstances considering the nature and complexity of the entity.</span><span> </span><span class="RefParas">(Ref: Para. A121‒A122)</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td></tr></tbody></table>
Information System and Communication, and Control Activities (Ref: Para. A123–A130)
The information system and communication
<table cellspacing="0" cellpadding="0" style="width:454.3pt; margin-right:9.05pt; margin-left:9.05pt; border:0.75pt solid #000000; border-collapse:collapse; float:left"><tbody><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>25.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the entity’s information system and communication relevant to the preparation of the financial report, through performing risk assessment procedures, by: </span><span class="RefParas">(Ref: Para. A131)</span></p></td></tr><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding the entity’s information processing activities, including its data and information, the resources to be used in such activities and the policies that define, for significant classes of transactions, account balances and disclosures: </span><span class="RefParas">(Ref: Para. A132‒A143)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>How information flows through the entity’s information system, including how:</span></p><ol class="awlist12" style="margin:0pt; padding-left:0pt"><li class="ParaLevel3" style="margin-top:10pt"><span style="width:27.82pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Transactions are initiated, and how information about them is recorded, processed, corrected as necessary, incorporated in the general ledger and reported in the financial report; and</span></li><li class="ParaLevel3" style="margin-top:10pt"><span style="width:27.2pt; font:7pt 'Times New Roman'; display:inline-block"></span><span>Information about events and conditions, other than transactions, is captured, processed and disclosed in the financial report;</span></li></ol><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The accounting records, specific accounts in the financial report and other supporting records relating to the flows of information in the information system;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The financial reporting process used to prepare the entity’s financial report, including disclosures; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iv)</span></span><span style="width:19.57pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The entity’s resources, including the IT environment, relevant to (a)(i) to (a)(iii) above;</span></p><p class="ParaLevel2" style="margin-top:10pt; margin-left:35.45pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(b)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Understanding how the entity communicates significant matters that support the preparation of the financial report and related reporting responsibilities in the information system and other components of the system of internal control: </span><span class="RefParas">(Ref: Para. A144‒A145)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Between people within the entity, including how financial reporting roles and responsibilities are communicated;</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Between management and those charged with governance; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt; margin-bottom:13pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>With external parties, such as those with regulatory authorities;</span></p><p class="TableRow" style="margin-top:13pt"><span></span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="TableRow"><span>and</span></p><p class="ParaLevel2" style="margin-top:3pt; margin-left:35.45pt"><span><span>(c)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Evaluating whether the entity’s information system and communication appropriately support the preparation of the entity’s financial report in accordance with the applicable financial reporting framework. </span><span class="RefParas">(Ref: Para. A146)</span></p></td></tr></tbody></table>
Control activities
<table cellspacing="0" cellpadding="0" style="width:454.3pt; margin-right:9pt; margin-left:9pt; border:0.75pt solid #000000; border-collapse:collapse; float:left"><thead><tr><td colspan="2" style="width:442.75pt; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel1"><span><span>26.</span></span><span style="width:21.7pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The auditor shall obtain an understanding of the control activities component, through performing risk assessment procedures, by: </span><span class="RefParas">(Ref: Para. A147–A157)</span></p></td></tr></thead><tbody><tr><td style="width:215.95pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaLevel2" style="margin-left:35.45pt"><span><span>(a)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Identifying controls that address risks of material misstatement at the assertion level in the control activities component as follows:</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Controls that address a risk that is determined to be a significant risk; </span><span class="RefParas">(Ref: Para. A158‒A159)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Controls over journal entries, including non-standard journal entries used to record non-recurring, unusual transactions or adjustments; </span><span class="RefParas">(Ref: Para. A160‒A161)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(iii)</span></span><span style="width:18.96pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Controls for which the auditor plans to test operating effectiveness in determining the nature, timing and extent of substantive testing, which shall include controls that address risks for which substantive procedures alone do not provide sufficient appropriate audit evidence; and </span><span class="RefParas">(Ref: Para. A162‒A164)</span><span></span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(iv)</span></span><span style="width:19.57pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Other controls that the auditor considers are appropriate to enable the auditor to meet the objectives of paragraph 13 with respect to risks at the assertion level, based on the auditor’s professional judgement; </span><span class="RefParas">(Ref: Para. A165)</span></p><p class="ParaLevel2" style="margin-top:10pt; margin-left:35.45pt"><span class="RefParas"><span class="RefParas" style="font-size:11pt">(b)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Based on controls identified in (a), identifying the IT applications and the other aspects of the entity’s IT environment that are subject to risks arising from the use of IT; </span><span class="RefParas">(Ref: Para. A166‒A172)</span></p><p class="ParaLevel2" style="margin-top:10pt; margin-left:35.45pt"><span><span>(c)</span></span><span style="width:23.24pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>For such IT applications and other aspects of the IT environment identified in (b), identifying: </span><span class="RefParas">(Ref: Para. A173‒A174)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The related risks arising from the use of IT; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>The entity’s general IT controls that address such risks.</span></p></td><td style="width:216pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="TableRow"><span>and</span></p><p class="ParaLevel2" style="margin-top:3pt; margin-left:35.45pt"><span><span>(d)</span></span><span style="width:22.62pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>For each control identified in (a) or (c)(ii): </span><span class="RefParas">(Ref: Para. A175‒A181)</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(i)</span></span><span style="width:25.07pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Evaluating whether the control is designed effectively to address the risk of material misstatement at the assertion level, or effectively designed to support the operation of other controls; and</span></p><p class="ParaLevel3" style="margin-top:10pt; margin-left:70.9pt"><span><span>(ii)</span></span><span style="width:22.01pt; font:7pt 'Times New Roman'; display:inline-block"> </span><span>Determining whether the control has been implemented by performing procedures in addition to enquiry of the entity’s personnel.</span></p></td></tr></tbody></table>
Control Deficiencies Within the Entity’s System of Internal Control
Based on the auditor’s evaluation of each of the components of the entity’s system of internal control, the auditor shall determine whether one or more control deficiencies have been identified. (Ref: Para. A182–A183)