The Firm’s Risk Assessment ProcessThe Firm’s Risk Assessment Process

The Firm’s Risk Assessment Process

1. The firm shall design and implement a risk assessment process to establish quality objectives, identify and assess quality risks and design and implement responses to address the quality risks. (Ref: Para. A39–A41)

2. The firm shall establish the quality objectives specified by this ASQM and any additional quality objectives considered necessary by the firm to achieve the objectives of the system of quality management. (Ref: Para. A42–A44)

3. The firm shall identify and assess quality risks to provide a basis for the design and implementation of responses. In doing so, the firm shall:

   1. Obtain an understanding of the conditions, events, circumstances, actions or inactions that may adversely affect the achievement of the quality objectives, including: (Ref: Para. A45–A47)

      1. With respect to the nature and circumstances of the firm, those relating to:
         1. The complexity and operating characteristics of the firm;
         2. The strategic and operational decisions and actions, business processes and business model of the firm;
         3. The characteristics and management style of leadership;
         4. The resources of the firm, including the resources provided by service providers;
         5. Law, regulation, AUASB standards and the environment in which the firm operates; and
         6. In the case of a firm that belongs to a network, the nature and extent of the network requirements and network services, if any.
      2. With respect to the nature and circumstances of the engagements performed by the firm, those relating to:
         1. The types of engagements performed by the firm and the reports to be issued; and
         2. The types of entities for which such engagements are undertaken.

   2. Take into account how, and the degree to which, the conditions, events, circumstances, actions or inactions in paragraph 25(a) may adversely affect the achievement of the quality objectives. (Ref: Para. A48)

4. The firm shall design and implement responses to address the quality risks in a manner that is based on, and responsive to, the reasons for the assessments given to the quality risks. The firm’s responses shall also include the responses specified in paragraph 34. (Ref: Para. A49–A51)

5. The firm shall establish policies or procedures that are designed to identify information that indicates additional quality objectives, or additional or modified quality risks or responses, are needed due to changes in the nature and circumstances of the firm or its engagements. If such information is identified, the firm shall consider the information and when appropriate: (Ref: Para. A52–A53)