Get a plain-English read of Risk Assessment Procedures
Turn the raw legal text into a practical explanation grounded in Standard on Sustainability Assurance ASSA 5000 General Requirements for Sustainability Assurance Engagements.
Designing and Performing Risk Assessment Procedures
Limited Assurance
Reasonable Assurance
103L. The practitioner shall design and perform risk assessment procedures sufficient to: (Ref: Para. A313–A318, A416L)Identify and assess risks of material misstatement, whether due to fraud or error, at the disclosure level; andDesign and perform further procedures.
103R. The practitioner shall design and perform risk assessment procedures sufficient to: (Ref: Para. A313–A318, A415R)Identify and assess risks of material misstatement, whether due to fraud or error, at the assertion level for the disclosures; andDesign and perform further procedures.
When designing and performing risk assessment procedures in accordance with paragraphs 103L and 103R, the practitioner shall consider information from the practitioner’s procedures regarding acceptance and continuance of the client relationship or the sustainability assurance engagement. (Ref: Para. A319)
The engagement leader and other key members of the engagement team, and any key practitioner’s external experts, shall discuss the susceptibility of the disclosures to material misstatement, whether due to fraud or error, and the application of the applicable criteria to the entity’s facts and circumstances. The engagement leader shall determine which matters are to be communicated to members of the engagement team and to any practitioner’s external experts not involved in the discussion. (Ref: Para. A320–A321)
Understanding the Sustainability Matters and the Sustainability Information
The practitioner shall obtain an understanding of the sustainability matters and the sustainability information, including the characteristics of events or conditions that could give rise to material misstatement of the disclosures. (Ref: Para. A322–A325)
Determining the Suitability of the Applicable Criteria
The practitioner shall determine whether the applicable criteria are suitable for the engagement circumstances, including that they exhibit the characteristics in paragraph 78. (Ref: Para. A199–A201, A326–A342)
Understanding the Entity’s Reporting Policies
The practitioner shall obtain an understanding of the entity’s reporting policies and the reason for any changes thereto. (Ref: Para. A2, A197, A343)
The practitioner shall evaluate whether the entity’s reporting policies are appropriate and consistent with: (Ref: Para. A2, A343–A344)
The applicable criteria; and
Criteria used in the relevant industry.
Understanding the Entity and Its Environment
The practitioner shall obtain an understanding of the entity and its environment, including:
The nature of the entity’s operations, legal and organisational structure, ownership and governance, and business model; (Ref: Para. A345–A346)
The reporting boundary and activities within the reporting boundary; and (Ref: Para. A347)
Goals, targets, or strategic objectives related to sustainability matters and measures used to assess the entity's performance or determine management compensation. (Ref: Para. A348)
Understanding the Legal and Regulatory Framework
The practitioner shall obtain an understanding of: (Ref: Para. A349–A351)
The legal and regulatory framework applicable to the entity and the industry or sector in which the entity operates, in the context of the entity’s sustainability information; and
How the entity is complying with that framework.
Enquiries and Discussion with Appropriate Parties
The practitioner shall make enquiries of appropriate parties and, when appropriate, others within the entity regarding whether: (Ref: Para. A352–A353)
They have knowledge of any fraud or suspected fraud or identified or suspected non-compliance with laws and regulations affecting the sustainability information; and
The entity has an internal audit function and, if so, make further enquiries to obtain an understanding of the activities and main findings, if any, of the internal audit function with respect to the sustainability information.
Understanding the Components of the Entity’s System of Internal Control
Limited Assurance
Reasonable Assurance
113L. The practitioner shall obtain an understanding, through enquiry, of the components of the entity’s system of internal control relevant to the sustainability matters and the preparation of the sustainability information, in accordance with paragraphs 114L, 115L, 116L, 117 and 120L. (Ref: Para. A354–A359)
113R. The practitioner shall obtain an understanding, through enquiry and other procedures, of the components of the entity’s system of internal control relevant to the sustainability matters and the preparation of the sustainability information, in accordance with paragraphs 114R, 115R, 116R, 117, and 119R. (Ref: Para. A354–A356, A358–A359)
The Control Environment
Limited Assurance
Reasonable Assurance
114L. The practitioner shall obtain an understanding of the entity’s control environment relevant to the sustainability matters and the preparation of the sustainability information. (Ref: Para. A360, A362–A363)
114R. The practitioner shall obtain an understanding of the entity’s control environment relevant to the sustainability matters and the preparation of the sustainability information, including evaluating whether: (Ref: Para. A360–A363)Management, with the oversight of those charged with governance, has created and maintained a culture of honesty and ethical behaviour;The control environment provides an appropriate foundation for the other components of the system of internal control considering the nature and complexity of the entity; andControl deficiencies identified in the control environment undermine the other components of the system of internal control.
The Entity’s Risk Assessment Process
Limited Assurance
Reasonable Assurance
115L. The practitioner shall obtain an understanding of the results of the entity’s risk assessment process relevant to the sustainability matters and the preparation of the sustainability information. (Ref: Para. A364, A366, A368)
115R. The practitioner shall obtain an understanding of the entity’s risk assessment process relevant to the sustainability matters and the preparation of the sustainability information, including: (Ref: Para. A364–A368)Understanding the entity’s process for:Identifying risks relevant to sustainability information reporting objectives;Assessing the significance of those risks, including the likelihood of their occurrence; andAddressing those risks;Understanding the results of the entity’s risk assessment process; andBased on the understanding in (a) and (b), evaluating whether the entity’s risk assessment process is appropriate to the entity’s circumstances.
The Entity’s Process for Monitoring the System of Internal Control
Limited Assurance
Reasonable Assurance
116L. The practitioner shall obtain an understanding of the results of the entity’s process to monitor the system of internal control relevant to the sustainability matters and the preparation of the sustainability information. (Ref: Para. A369–A370)
116R. The practitioner shall:Obtain an understanding of: (Ref: Para. A369–A370)The entity’s process to monitor the system of internal control relevant to the sustainability matters and the preparation of the sustainability information; andThe results thereof; andBased on this understanding, evaluate whether the entity’s process to monitor the system of internal control relevant to the sustainability matters and the preparation of the sustainability information is appropriate to the entity’s circumstances. (Ref: Para. A371R–A376R)
The Information System and Communication
The practitioner shall obtain an understanding of the entity’s information system and communication relevant to the sustainability matters and the preparation of the sustainability information, including: (Ref: Para. A377–A381)
The entity’s process to identify sustainability information to be reported. (Ref: Para. A382–A384)
How information from external sources, such as service organisations or other organisations in the entity’s value chain, is recorded, processed, corrected as necessary, and incorporated into the sustainability information. (Ref: Para. A385)
For estimates and forward-looking information, how the entity identifies the relevant methods, assumptions or sources of data, and the need for changes in them, that are appropriate in the context of the applicable criteria.
Based on the practitioner’s understanding of the information system and communication in accordance with paragraph 117, the practitioner shall evaluate whether the entity’s information system appropriately supports the preparation of the sustainability information in accordance with the applicable criteria. (Ref: Para. A386)
Control Activities
119R. The practitioner shall obtain an understanding of control activities by identifying: (Ref: Para. A387–A392)
Controls for which the practitioner plans to obtain evidence by testing their operating effectiveness, which shall include:
Controls that address risks for which substantive procedures alone do not provide sufficient appropriate evidence; or
If applicable, any complementary user entity controls identified in an assurance report of another practitioner that are determined to be relevant to the user entity in accordance with paragraph 52;
Based on the controls identified in (a), the IT applications and the other aspects of the entity’s IT environment that are subject to risks arising from the use of IT;
The entity’s general IT controls that address risks arising from the use of IT identified in (b); and
Other controls that the practitioner considers are appropriate to identify and assess the risks of material misstatement at the assertion level for disclosures and design further procedures responsive to those assessed risks.
Design and Implementation of Controls
Limited Assurance
Reasonable Assurance
120L. If the practitioner plans to obtain evidence by testing the operating effectiveness of controls, the practitioner shall obtain an understanding of: (Ref: Para. A387–A392, A399L)The controls the practitioner plans to test, including if applicable, any complementary user entity controls identified in the assurance report of another practitioner that are determined to be relevant to the user entity in accordance with paragraph 52; andThe entity’s general IT controls that address risks arising from the use of IT related to the controls identified in (a).by: (Ref: Para. A393–A398)Evaluating whether the control is designed effectively to address the risk of material misstatement for the disclosure, or effectively designed to support the operation of other controls; andDetermining whether the control has been implemented by performing procedures in addition to enquiry of the entity’s personnel.
120R. The practitioner shall obtain an understanding of each control identified in accordance with paragraph 119R(a), (c), and (d) by: (Ref: Para. A393–A398)Evaluating whether the control is designed effectively to address the risk of material misstatement at the assertion level, or effectively designed to support the operation of other controls; andDetermining whether the control has been implemented by performing procedures in addition to enquiry of the entity’s personnel.
Identifying Control Deficiencies
Based on the practitioner’s understanding of the components of the entity’s system of internal control, the practitioner shall consider whether one or more control deficiencies have been identified. (Ref: Para. A400–A403)
Identifying and Assessing the Risks of Material Misstatement
Limited Assurance
Reasonable Assurance
122L. The practitioner shall identify and assess the risks of material misstatement at the disclosure level as a basis for designing and performing procedures whose nature, timing and extent: (Ref: Para. A404–A414, A416L, A417)Are responsive to the assessed risks of material misstatement; andAllow the practitioner to obtain limited assurance about whether the sustainability information is prepared, in all material respects, in accordance with the applicable criteria.
122R. The practitioner shall identify and assess the risks of material misstatement at the assertion level for the disclosures as a basis for designing and performing procedures whose nature, timing and extent: (Ref: Para. A404–A405, A407–A408, A410–A415R, A417–A418R)Are responsive to the assessed risks of material misstatement; andAllow the practitioner to obtain reasonable assurance about whether the sustainability information is prepared, in all material respects, in accordance with the applicable criteria.
123R. Due to the unpredictable way in which management is able to override controls, the practitioner shall treat risks of management override of controls as risks of material misstatement due to fraud and thus risks of material misstatement at the upper end of the spectrum of risk. (Ref: Para. A418R)
Evaluating the Evidence Obtained from the Risk Assessment Procedures
The practitioner shall determine whether the evidence obtained from the risk assessment procedures provides an appropriate basis for the identification and assessment of the risks of material misstatement. If not, the practitioner shall perform additional risk assessment procedures until evidence has been obtained to provide such a basis. (Ref: Para. A419)
Documentation
The practitioner shall include in the engagement documentation:
The engagement team discussion in accordance with paragraph 105, and the significant decisions reached;
Key elements of the practitioner’s understanding, enquiries and discussion in accordance with paragraphs 106–119R;
The evaluation of the design of identified controls, and determination of whether such controls have been implemented, in accordance with paragraph 120L, if applicable, and paragraph 120R; and
The identified and assessed risks of material misstatement, in accordance with paragraphs 122L and 122R.