Identifying and Assessing the Risks of Material Misstatement Through Understanding the Entity and Its Environment

CAS 315

Identifying and Assessing the Risks of Material Misstatement Through Understanding the Entity and Its Environment

CAS 315

General

The objective of the auditor is to identify and assess the risks of material misstatement, whether due to fraud or error, at the F/S and assertion levels, through understanding the entity and its environment, including the entity’s internal control

Risk Assessment Procedures and Related Activities
  • The auditor needs to perform risk assessment procedures to identify and assess risks of material misstatement at the F/S and assertion levels (risk assessment do not provide sufficient appropriate evidence on their own to base an audit opinion)
  • Risk assessment procedures include the following
    • Inquiries of management and others within the entity
    • Analytical procedures
    • Observation and inspection
    • Assessing information obtained from the auditor’s client acceptance or continuance process
    • Assessing information obtained is relevant to identifying risks of material misstatement.
  • Engagement partner and key engagement team members should discuss the susceptibility of the F/S to material misstatement
The Required Understanding of the Entity and Its Environment, Including the Entity's Internal Control
The Entity and Its Environment
  • The auditor should get an understanding of the following:
    • Relevant industry, regulatory, financial reporting framework, and other external factors
    • The nature of the entity, including: its operations, its ownership and governance structures, investments that the entity is making/ plans to make, and the way the entity is structured and how it is financed to enable the auditor to understand the classes of transactions, account balances, and disclosures to be expected in the F/S
    • The entity’s selection and application of accounting policies, including the reasons for changes; The auditor is to evaluate if the entity’s accounting policies are appropriate
    • The entity’s objectives and strategies, and business risks that may result in risks of material misstatement
    • The measurement and review of the entity’s financial performance (may indicate potential biases)
The Entity's Internal Control
  • The auditor should obtain an understanding of internal control relevant to the audit
  • The auditor should evaluate the design of those controls and determine whether they have been implemented, by performing procedures (such as Inquiring of entity personnel, observing the application of specific controls, Inspecting documents, tracing transactions through the information system relevant to financial reporting
  • Obtain an understanding of the control environment and evaluate whether:
    1. Management has created and maintained a culture of honesty and ethical behavior; and
    2. The strengths in the control environment elements collectively provide an appropriate foundation for the other components of internal control, and whether those other components are not undermined by deficiencies in the control environment.
  • The auditor should obtain an understanding of the entity’s risk assessment process by assessing whether the entity has a process for:
    1. Identifying business risks relevant to financial reporting
    2. Estimating the significance of the risks
    3. Assessing the likelihood of their occurrence; and
    4. Deciding about actions to address those risks
  • The auditor should obtain an understanding of the information system, including the related business processes, relevant to financial reporting, including the following areas:
    1. The classes of transactions that are significant to the F/S
    2. The procedures (both IT and manual) that those transactions are initiated, recorded, processed, corrected and transferred to the GL and reported in the F/S
    3. The related accounting records, supporting information and accounts in the F/S that are used to initiate, record, process and report transactions
    4. How the information system captures events and conditions, other than transactions, that are significant to the F/S
    5. The financial reporting process used to prepare the entity’s F/S, including significant accounting estimates and disclosures
    6. Controls surrounding journal entries, including non-standard journal entries used to record non-recurring, unusual transactions or adjustments
  • Obtain an understanding of how the entity communicates financial reporting roles and responsibilities and significant matters relating to financial reporting
  • The auditor shall obtain an understanding of control activities relevant to the audit in order to assess the risks of material misstatement at the assertion level and design further audit procedures
    • Examples of control activities = authorization, performance reviews, information processing, physical controls, segregation of duties
    • Also obtain an understanding of how the entity has responded to risks arising from IT
  • Obtain an understanding of how the entity monitors internal control over financial reporting, including those related to control activities relevant to the audit, and how the entity corrects to deficiencies in its controls
  • If the entity has an internal audit function, obtain an understanding of the following to determine if the internal audit function is relevant to the audit:
    • The internal audit function’s responsibilities and how the internal audit function fits in the entity’s organizational structure; and
    • The activities performed by the internal audit function
Identifying and Assessing the Risks of Material Misstatement
  • Identify and assess the risks of material misstatement at the F/S and the assertion level to provide a basis for designing and performing further audit procedures
    • Identify risks throughout the process of obtaining an understanding of the entity and its environment, including relevant controls that relate to the risks
    • Assess the identified risks, and evaluate whether they relate more pervasively to the F/S as a whole and potentially affect many assertions
    • Relate the identified risks to what can go wrong at the assertion level, taking account of relevant controls that the auditor intends to test
    • Consider the likelihood of misstatement, including the possibility of multiple misstatements, and whether the potential misstatement could result in a material misstatement
Risks That Require Special Audit Consideration
  • Determine whether any of the risks identified are, in the auditor’s judgment, a significant risk
    • Significant risk = an identified and assessed risk of material misstatement that, in the auditor’s judgment, requires special audit consideration
  • The following may be indicative of significant risk:
    • Whether the risk is a risk of fraud
    • Whether the risk is related to recent significant economic, accounting or other developments
    • The complexity of transactions
    • Whether the risk involves significant transactions with related parties
    • The degree of subjectivity in the measurement of financial information
    • Whether the risk involves significant transactions that are outside the normal course of business for the entity, or that otherwise appear to be unusual
  • If the auditor has determined that a significant risk exists, obtain an understanding of the entity’s controls, including control activities, relevant to that risk
Risks for Which Substantive Procedures Alone Do Not Provide Sufficient Appropriate Audit Evidence
  • For some risks, the auditor may judge that it is not possible to obtain sufficient appropriate audit evidence only from substantive procedures
    • One example is the risk of inaccurate or incomplete recording of transactions by highly automated processing with little or no manual intervention
    • The entity’s controls over such risks are relevant to the audit and the auditor should obtain an understanding of these controls
Revision of Risk Assessment
  • The auditor’s assessment of the risks of material misstatement at the assertion level may change during the course of the audit as additional audit evidence is obtained
Documentation
  • Document the following:
    • Discussion among the engagement team (as mentioned above)
    • Understanding obtained regarding the entity, the environment and internal control
    • The identified and assessed risks of material misstatement at the F/S and assertion level
    • Risks that require special audit consideration and for which substantive procedures alone do not provide sufficient appropriate audit evidence along with the related controls which the auditor has obtained an understanding of

Spread the Word!

Scroll to Top
Scroll to Top