(Ref: Para. 12) 

Assertions (Ref: Para. 12(a))

Categories of assertions are used by auditors to consider the different types of potential misstatements that may occur when identifying, assessing and responding to the risks of material misstatement. Examples of these categories of assertions are described in paragraph A190. The assertions differ from the written representations required by ASA 580,^[14] to confirm certain matters or support other audit evidence.

Controls (Ref: Para. 12(c))

Controls are embedded within the components of the entity’s system of internal control.

Policies are implemented through the actions of personnel within the entity, or through the restraint of personnel from taking actions that would conflict with such policies.

Procedures may be mandated, through formal documentation or other communication by management or those charged with governance, or may result from behaviours that are not mandated but are rather conditioned by the entity’s culture. Procedures may be enforced through the actions permitted by the IT applications used by the entity or other aspects of the entity’s IT environment.

Controls may be direct or indirect. Direct controls are controls that are precise enough to address risks of material misstatement at the assertion level. Indirect controls are controls that support direct controls.

Information Processing Controls (Ref: Para. 12(e))

Risks to the integrity of information arise from susceptibility to ineffective implementation of the entity’s information policies, which are policies that define the information flows, records and reporting processes in the entity’s information system. Information processing controls are procedures that support effective implementation of the entity’s information policies. Information processing controls may be automated (i.e., embedded in IT applications) or manual (e.g., input or output controls) and may rely on other controls, including other information processing controls or general IT controls.

Inherent Risk Factors (Ref: Para. 12(f))

Inherent risk factors may be qualitative or quantitative and affect the susceptibility of assertions to misstatement. Qualitative inherent risk factors relating to the preparation of information required by the applicable financial reporting framework include:

• Complexity;
• Subjectivity;
• Change;
• Uncertainty; or
• Susceptibility to misstatement due to management bias or other fraud risk factors insofar as they affect inherent risk.

Other inherent risk factors, that affect susceptibility to misstatement of an assertion about a class of transactions, account balance or disclosure may include:

• The quantitative or qualitative significance of the class of transactions, account balance or disclosure; or
• The volume or a lack of uniformity in the composition of the items to be processed through the class of transactions or account balance, or to be reflected in the disclosure.

Relevant Assertions (Ref: Para. 12(h))

A risk of material misstatement may relate to more than one assertion, in which case all the assertions to which such a risk relates are relevant assertions. If an assertion does not have an identified risk of material misstatement, then it is not a relevant assertion.

Significant Risk (Ref: Para. 12(l))

Significance can be described as the relative importance of a matter, and is judged by the auditor in the context in which the matter is being considered. For inherent risk, significance may be considered in the context of how, and the degree to which, inherent risk factors affect the combination of the likelihood of a misstatement occurring and the magnitude of the potential misstatement should that misstatement occur.

(Ref: Para. 13–18)

The risks of material misstatement to be identified and assessed include both those due to fraud and those due to error, and both are covered by this ASA. However, the significance of fraud is such that further requirements and guidance are included in ASA 240 in relation to risk assessment procedures and related activities to obtain information that is used to identify and assess the risks of material misstatement due to fraud.^[15] In addition, the following ASAs provide further requirements and guidance on identifying and assessing risks of material misstatement regarding specific matters or circumstances:

• ASA 540^[16] in regard to accounting estimates;
• ASA 550^[*] in regard to related party relationships and transactions;
• ASA 570^[17] in regard to going concern; and
• ASA 600^[18] in regard to group financial report.

Professional scepticism is necessary for the critical assessment of audit evidence gathered when performing the risk assessment procedures, and assists the auditor in remaining alert to audit evidence that is not biased towards corroborating the existence of risks or that may be contradictory to the existence of risks. Professional scepticism is an attitude that is applied by the auditor when making professional judgements that then provides the basis for the auditor’s actions. The auditor applies professional judgement in determining when the auditor has audit evidence that provides an appropriate basis for risk assessment.

The application of professional scepticism by the auditor may include:

• Questioning contradictory information and the reliability of documents;
• Considering responses to enquiries and other information obtained from management and those charged with governance;
• Being alert to conditions that may indicate possible misstatement due to fraud or error; and
• Considering whether audit evidence obtained supports the auditor’s identification and assessment of the risks of material misstatement in light of the entity’s nature and circumstances.

Why Obtaining Audit Evidence in an Unbiased Manner Is Important

(Ref: Para. 13)

Designing and performing risk assessment procedures to obtain audit evidence to support the identification and assessment of the risks of material misstatement in an unbiased manner may assist the auditor in identifying potentially contradictory information, which may assist the auditor in exercising professional scepticism in identifying and assessing the risks of material misstatement. 

Sources of Audit Evidence (Ref: Para. 13)

Designing and performing risk assessment procedures to obtain audit evidence in an unbiased manner may involve obtaining evidence from multiple sources within and outside the entity.  However, the auditor is not required to perform an exhaustive search to identify all possible sources of audit evidence.  In addition to information from other sources[19], sources of information for risk assessment procedures may include:

•  Interactions with management, those charged with governance, and other key entity personnel, such as internal auditors. 
• Certain external parties such as regulators, whether obtained directly or indirectly.
• Publicly available information about the entity, for example entity-issued press releases, materials for analysts or investor group meetings, analysts’ reports or information about trading activity. 

Regardless of the source of information, the auditor considers the relevance and reliability of the information to be used as audit evidence in accordance with ASA 500.[20]

Scalability (Ref: Para. 13)

The nature and extent of risk assessment procedures will vary based on the nature and circumstances of the entity (e.g., the formality of the entity’s policies and procedures, and processes and systems).  The auditor uses professional judgement to determine the nature and extent of the risk assessment procedures to be performed to meet the requirements of this ASA. 

Although the extent to which an entity’s policies and procedures, and processes and systems are formalised may vary, the auditor is still required to obtain the understanding in accordance with paragraphs 19, 21, 22, 24, 25 and 26.

The nature and extent of risk assessment procedures to be performed the first time an engagement is undertaken may be more extensive than procedures for a recurring engagement.  In subsequent periods, the auditor may focus on changes that have occurred since the preceding period.

Types of Risk Assessment Procedures (Ref: Para. 14)

ASA 500[21] explains the types of audit procedures that may be performed in obtaining audit evidence from risk assessment procedures and further audit procedures.  The nature, timing and extent of the audit procedures may be affected by the fact that some of the accounting data and other evidence may only be available in electronic form or only at certain points in time.[22] The auditor may perform substantive procedures or tests of controls, in accordance with ASA 330, concurrently with risk assessment procedures, when it is efficient to do so.  Audit evidence obtained that supports the identification and assessment of risks of material misstatement may also support the detection of misstatements at the assertion level or the evaluation of the operating effectiveness of controls.

Although the auditor is required to perform all the risk assessment procedures described in paragraph 14 in the course of obtaining the required understanding of the entity and its environment, the applicable financial reporting framework, and the entity’s system of internal control (see paragraphs 19–26), the auditor is not required to perform all of them for each aspect of that understanding.  Other procedures may be performed when the information to be obtained may be helpful in identifying risks of material misstatement.  Examples of such procedures may include making enquiries of the entity’s external legal counsel or external supervisors, or of valuation experts that the entity has used.

Automated Tools and Techniques (Ref: Para. 14)

Using automated tools and techniques, the auditor may perform risk assessment procedures on large volumes of data (from the general ledger, sub-ledgers or other operational data) including for analysis, recalculations, reperformance or reconciliations. 

Enquiries of Management and Others within the Entity (Ref: Para. 14(a))

Why Enquiries Are Made of Management and Others Within the Entity

 Information obtained by the auditor to support an appropriate basis for the identification and assessment of risks, and the design of further audit procedures, may be obtained through enquiries of management and those responsible for financial reporting.

Enquiries of management and those responsible for financial reporting and of other appropriate individuals within the entity and other employees with different levels of authority may offer the auditor varying perspectives when identifying and assessing risks of material misstatement.

Considerations Specific to Public Sector Entities

When making enquiries of those who may have information that is likely to assist in identifying risks of material misstatement, auditors of public sector entities may obtain information from additional sources such as from the auditors that are involved in performance or other audits related to the entity.

Enquiries of the Internal Audit Function

Why enquiries are made of the internal audit function (if the function exists)

If an entity has an internal audit function, enquiries of the appropriate individuals within the function may assist the auditor in understanding the entity and its environment, and the entity’s system of internal control, in the identification and assessment of risks. 

Considerations specific to public sector entities

Auditors of public sector entities often have additional responsibilities with regard to internal control and compliance with applicable laws and regulations.  Enquiries of appropriate individuals in the internal audit function may assist the auditors in identifying the risk of material non-compliance with applicable laws and regulations, and the risk of control deficiencies related to financial reporting.

Analytical Procedures (Ref: Para. 14(b))

Why Analytical Procedures Are Performed as a Risk Assessment Procedure

Analytical procedures help identify inconsistencies, unusual transactions or events, and amounts, ratios, and trends that indicate matters that may have audit implications.  Unusual or unexpected relationships that are identified may assist the auditor in identifying risks of material misstatement, especially risks of material misstatement due to fraud. 

Analytical procedures performed as risk assessment procedures may therefore assist in identifying and assessing the risks of material misstatement by identifying aspects of the entity of which the auditor was unaware or understanding how inherent risk factors, such as change, affect susceptibility of assertions to misstatement. 

Types of Analytical Procedures

Analytical procedures performed as risk assessment procedures may:

• Include both financial and non-financial information, for example, the relationship between sales and square footage of selling space or volume of goods sold (nonfinancial).
• Use data aggregated at a high level. Accordingly, the results of those analytical procedures may provide a broad initial indication about the likelihood of a material misstatement.

This ASA deals with the auditor’s use of analytical procedures as risk assessment procedures.  ASA 520[24] deals with the auditor's use of analytical procedures as substantive procedures (“substantive analytical procedures”) and the auditor’s responsibility to perform analytical procedures near the end of the audit.  Accordingly, analytical procedures performed as risk assessment procedures are not required to be performed in accordance with the requirements of ASA 520.  However, the requirements and application material in ASA 520 may provide useful guidance to the auditor when performing analytical procedures as part of the risk assessment procedures.

Automated tools and techniques

Analytical procedures can be performed using a number of tools or techniques, which may be automated. Applying automated analytical procedures to the data may be referred to as data analytics.

Observation and Inspection (Ref: Para. 14(c))

Why Observation and Inspection Are Performed as Risk Assessment Procedures

Observation and inspection may support, corroborate or contradict enquiries of management and others, and may also provide information about the entity and its environment.

Scalability

Where policies or procedures are not documented, or the entity has less formalised controls, the auditor may still be able to obtain some audit evidence to support the identification and assessment of the risks of material misstatement through observation or inspection of the performance of the control.

Observation and Inspection as Risk Assessment Procedures

Risk assessment procedures may include observation or inspection of the following:

The entity’s operations.

• Internal documents (such as business plans and strategies), records, and internal control manuals.
• Reports prepared by management (such as quarterly management reports and interim financial reports) and those charged with governance (such as minutes of board of directors’ meetings). 
• The entity’s premises and plant facilities. 
• Information obtained from external sources such as trade and economic journals; reports by analysts, banks, or rating agencies; regulatory or financial publications; or other external documents about the entity’s financial performance (such as those referred to in paragraph A79).
• The behaviours and actions of management or those charged with governance (such as the observation of an audit committee meeting).

Automated tools and techniques

Automated tools or techniques may also be used to observe or inspect, in particular assets, for example through the use of remote observation tools (e.g., a drone).

Considerations Specific to Public Sector Entities

Risk assessment procedures performed by auditors of public sector entities may also include observation and inspection of documents prepared by management for the legislature, for example documents related to mandatory performance reporting.

Information from Other Sources (Ref: Para. 15)

Why the Auditor Considers Information from Other Sources

Information obtained from other sources may be relevant to the identification and assessment of the risks of material misstatement by providing information and insights about:

• The nature of the entity and its business risks, and what may have changed from previous periods.
• The integrity and ethical values of management and those charged with governance, which may also be relevant to the auditor’s understanding of the control environment.
• The applicable financial reporting framework and its application to the nature and circumstances of the entity.

Other Relevant Sources

 Other relevant sources of information include:

• The auditor’s procedures regarding acceptance or continuance of the client relationship or the audit engagement in accordance with ASA 220, including the conclusions reached thereon.[25]
• Other engagements performed for the entity by the engagement partner.  The engagement partner may have obtained knowledge relevant to the audit, including about the entity and its environment, when performing other engagements for the entity.  Such engagements may include agreed-upon procedures engagements or other audit or assurance engagements, including engagements to address incremental reporting requirements in the jurisdiction.

Information from the Auditor’s Previous Experience with the Entity and Previous Audits (Ref: Para. 16)

Why information from previous audits is important to the current audit

The auditor’s previous experience with the entity and from audit procedures performed in previous audits may provide the auditor with information that is relevant to the auditor’s determination of the nature and extent of risk assessment procedures, and the identification and assessment of risks of material misstatement.

Nature of the Information from Previous Audits

The auditor’s previous experience with the entity and audit procedures performed in previous audits may provide the auditor with information about such matters as:

• Past misstatements and whether they were corrected on a timely basis.
• The nature of the entity and its environment, and the entity’s system of internal control (including control deficiencies). 
• Significant changes that the entity or its operations may have undergone since the prior financial period.
• Those particular types of transactions and other events or account balances (and related disclosures) where the auditor experienced difficulty in performing the necessary audit procedures, for example, due to their complexity.

The auditor is required to determine whether information obtained from the auditor’s previous experience with the entity and from audit procedures performed in previous audits remains relevant and reliable, if the auditor intends to use that information for the purposes of the current audit.  If the nature or circumstances of the entity have changed, or new information has been obtained, the information from prior periods may no longer be relevant or reliable for the current audit.  To determine whether changes have occurred that may affect the relevance or reliability of such information, the auditor may make enquiries and perform other appropriate audit procedures, such as walk-throughs of relevant systems.  If the information is not reliable, the auditor may consider performing additional procedures that are appropriate in the circumstances.

Engagement Team Discussion (Ref: Para. 17–18)

Why the Engagement Team Is Required to Discuss the Application of the Applicable Financial Reporting Framework and the Susceptibility of the Entity’s Financial report to Material Misstatement

The discussion among the engagement team about the application of the applicable financial reporting framework and the susceptibility of the entity’s financial report to material misstatement:

• Provides an opportunity for more experienced engagement team members, including the engagement partner, to share their insights based on their knowledge of the entity.  Sharing information contributes to an enhanced understanding by all engagement team members. 
• Allows the engagement team members to exchange information about the business risks to which the entity is subject, how inherent risk factors may affect the susceptibility to misstatement of classes of transactions, account balances and disclosures, and about how and where the financial report might be susceptible to material misstatement due to fraud or error. 
• Assists the engagement team members to gain a better understanding of the potential for material misstatement of the financial report in the specific areas assigned to them, and to understand how the results of the audit procedures that they perform may affect other aspects of the audit, including the decisions about the nature, timing and extent of further audit procedures.  In particular, the discussion assists engagement team members in further considering contradictory information based on each member’s own understanding of the nature and circumstances of the entity. 
• Provides a basis upon which engagement team members communicate and share new information obtained throughout the audit that may affect the assessment of risks of material misstatement or the audit procedures performed to address these risks.

ASA 240 requires the engagement team discussion to place particular emphasis on how and where the entity’s financial report may be susceptible to material misstatement due to fraud, including how fraud may occur.[26]

Professional scepticism is necessary for the critical assessment of audit evidence, and a robust and open engagement team discussion, including for recurring audits, may lead to improved identification and assessment of the risks of material misstatement.  Another outcome from the discussion may be that the auditor identifies specific areas of the audit for which exercising professional scepticism may be particularly important, and may lead to the involvement of more experienced members of the engagement team who are appropriately skilled to be involved in the performance of audit procedures related to those areas.

Scalability

When the engagement is carried out by a single individual, such as a sole practitioner (i.e., where an engagement team discussion would not be possible), consideration of the matters referred to in paragraphs A42 and A46 nonetheless may assist the auditor in identifying where there may be risks of material misstatement. 

When an engagement is carried out by a large engagement team, such as for an audit of a group financial report, it is not always necessary or practical for the discussion to include all members in a single discussion (for example, in a multi-location audit), nor is it necessary for all the members of the engagement team to be informed of all the decisions reached in the discussion.  The engagement partner may discuss matters with key members of the engagement team including, if considered appropriate, those with specific skills or knowledge, and those responsible for the audits of components, while delegating discussion with others, taking into account the extent of communication considered necessary throughout the engagement team.  A communications plan, agreed by the engagement partner, may be useful.

Discussion of Disclosures in the Applicable Financial Reporting Framework

As part of the discussion among the engagement team, consideration of the disclosure requirements of the applicable financial reporting framework assists in identifying early in the audit where there may be risks of material misstatement in relation to disclosures, even in circumstances where the applicable financial reporting framework only requires simplified disclosures.  Matters the engagement team may discuss include:

• Changes in financial reporting requirements that may result in significant new or revised disclosures;
• Changes in the entity’s environment, financial condition or activities that may result in significant new or revised disclosures, for example, a significant business combination in the period under audit;
• Disclosures for which obtaining sufficient appropriate audit evidence may have been difficult in the past; and
• Disclosures about complex matters, including those involving significant management judgement as to what information to disclose.

Considerations Specific to Public Sector Entities

As part of the discussion among the engagement team by auditors of public sector entities, consideration may also be given to any additional broader objectives, and related risks, arising from the audit mandate or obligations for public sector entities. 

Obtaining the Required Understanding (Ref: Para. 19‒27)

Obtaining an understanding of the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control is a dynamic and iterative process of gathering, updating and analysing information and continues throughout the audit.  Therefore, the auditor’s expectations may change as new information is obtained.

The auditor’s understanding of the entity and its environment and the applicable financial reporting framework may also assist the auditor in developing initial expectations about the classes of transactions, account balances and disclosures that may be significant classes of transactions, account balances and disclosures.  These expected significant classes of transactions, account balances and disclosures form the basis for the scope of the auditor’s understanding of the entity’s information system. 

Why an Understanding of the Entity and Its Environment, and the Applicable Financial Reporting Framework Is Required (Ref: Para. 19‒20)

The auditor’s understanding of the entity and its environment, and the applicable financial reporting framework, assists the auditor in understanding the events and conditions that are relevant to the entity, and in identifying how inherent risk factors affect the susceptibility of assertions to misstatement in the preparation of the financial report, in accordance with the applicable financial reporting framework, and the degree to which they do so.  Such information establishes a frame of reference within which the auditor identifies and assesses risks of material misstatement.  This frame of reference also assists the auditor in planning the audit and exercising professional judgement and professional scepticism throughout the audit, for example, when:

• Identifying and assessing risks of material misstatement of the financial report in accordance with ASA 315 or other relevant standards (e.g., relating to risks of fraud in accordance with ASA 240 or when identifying or assessing risks related to accounting estimates in accordance with ASA 540);
• Performing procedures to help identify instances of non-compliance with laws and regulations that may have a material effect on the financial report in accordance with ASA 250;[27]
• Evaluating whether the financial report provide adequate disclosures in accordance with ASA 700;[28]
• Determining materiality or performance materiality in accordance with ASA 320;[29] or
• Considering the appropriateness of the selection and application of accounting policies, and the adequacy of financial report disclosures.

The auditor’s understanding of the entity and its environment, and the applicable financial reporting framework, also informs how the auditor plans and performs further audit procedures, for example, when:

• Developing expectations for use when performing analytical procedures in accordance with ASA 520;[30]
• Designing and performing further audit procedures to obtain sufficient appropriate audit evidence in accordance with ASA 330; and
• Evaluating the sufficiency and appropriateness of audit evidence obtained (e.g., relating to assumptions or management’s oral and written representations).

Scalability

The nature and extent of the required understanding is a matter of the auditor’s professional judgement and varies from entity to entity based on the nature and circumstances of the entity, including:

• The size and complexity of the entity, including its IT environment;
• The auditor’s previous experience with the entity;
• The nature of the entity’s systems and processes, including whether they are formalised or not; and  The nature and form of the entity’s documentation.

The auditor’s risk assessment procedures to obtain the required understanding may be less extensive in audits of less complex entities and more extensive for entities that are more complex.  The depth of the understanding that is required by the auditor is expected to be less than that possessed by management in managing the entity.

Some financial reporting frameworks allow smaller entities to provide simpler and less detailed disclosures in the financial report.  However, this does not relieve the auditor of the responsibility to obtain an understanding of the entity and its environment and the applicable financial reporting framework as it applies to the entity.

The entity’s use of IT and the nature and extent of changes in the IT environment may also affect the specialised skills that are needed to assist with obtaining the required understanding. 

The Entity and Its Environment (Ref: Para. 19(a))

The Entity’s Organisational Structure, Ownership and Governance, and Business Model (Ref: Para. 19(a)(i))

The entity’s organisational structure and ownership

An understanding of the entity’s organisational structure and ownership may enable the auditor to understand such matters as:

• The complexity of the entity’s structure. 

• The ownership, and relationships between owners and other people or entities, including related parties.  This understanding may assist in determining whether related party transactions have been appropriately identified, accounted for, and adequately disclosed in the financial report.[31]
• The distinction between the owners, those charged with governance and management. 

•  The structure and complexity of the entity’s IT environment. 

Automated tools and techniques

The auditor may use automated tools and techniques to understand flows of transactions and processing as part of the auditor’s procedures to understand the information system.  An outcome of these procedures may be that the auditor obtains information about the entity’s organisational structure or those with whom the entity conducts business (e.g., vendors, customers, related parties). 

Considerations specific to public sector entities

Ownership of a public sector entity may not have the same relevance as in the private sector because decisions related to the entity may be made outside of the entity as a result of political processes.  Therefore, management may not have control over certain decisions that are made.  Matters that may be relevant include understanding the ability of the entity to make unilateral decisions, and the ability of other public sector entities to control or influence the entity’s mandate and strategic direction. 

Governance

Why the auditor obtains an understanding of governance

Understanding the entity’s governance may assist the auditor with understanding the entity’s ability to provide appropriate oversight of its system of internal control.  However, this understanding may also provide evidence of deficiencies, which may indicate an increase in the susceptibility of the entity’s financial report to risks of material misstatement. 

Understanding the entity’s governance

Matters that may be relevant for the auditor to consider in obtaining an understanding of the governance of the entity include:

• Whether any or all of those charged with governance are involved in managing the entity. 
• The existence (and separation) of a non-executive Board, if any, from executive management. 
• Whether those charged with governance hold positions that are an integral part of the entity’s legal structure, for example as directors. 
• The existence of sub-groups of those charged with governance, such as an audit committee, and the responsibilities of such a group. 
• The responsibilities of those charged with governance for oversight of financial reporting, including approval of the financial report.

The Entity’s Business Model

The Entity’s Business Model

Why the auditor obtains an understanding of the entity’s business model

Understanding the entity’s objectives, strategy and business model helps the auditor to understand the entity at a strategic level, and to understand the business risks the entity takes and faces.  An understanding of the business risks that have an effect on the financial report assists the auditor in identifying risks of material misstatement, since most business risks will eventually have financial consequences and, therefore, an effect on the financial report.

Understanding the entity’s business model

Not all aspects of the business model are relevant to the auditor’s understanding.  Business risks are broader than the risks of material misstatement of the financial report, although business risks include the latter.  The auditor does not have a responsibility to understand or identify all business risks because not all business risks give rise to risks of material misstatement. 

 Business risks increasing the susceptibility to risks of material misstatement may arise from:

• Inappropriate objectives or strategies, ineffective execution of strategies, or change or complexity.
• A failure to recognise the need for change may also give rise to business risk, for example, from:
  • The development of new products or services that may fail;
  • A market which, even if successfully developed, is inadequate to support a product or service; or
  • Flaws in a product or service that may result in legal liability and reputational risk.
• Incentives and pressures on management, which may result in intentional or unintentional management bias, and therefore affect the reasonableness of significant assumptions and the expectations of management or those charged with governance.

Examples of matters that the auditor may consider when obtaining an understanding of the entity’s business model, objectives, strategies and related business risks that may result in a risk of material misstatement of the financial report include:

• Industry developments, such as the lack of personnel or expertise to deal with the changes in the industry;
• New products and services that may lead to increased product liability;
• Expansion of the entity’s business, and demand has not been accurately estimated;
• New accounting requirements where there has been incomplete or improper implementation;
• Regulatory requirements resulting in increased legal exposure;
• Current and prospective financing requirements, such as loss of financing due to the entity’s inability to meet requirements;
• Use of IT, such as the implementation of a new IT system that will affect both operations and financial reporting; or
• The effects of implementing a strategy, particularly any effects that will lead to new accounting requirements. 

Ordinarily, management identifies business risks and develops approaches to address them.  Such a risk assessment process is part of the entity’s system of internal control and is discussed in

paragraph 22, and paragraphs A109–A113.

Considerations specific to public sector entities

Entities operating in the public sector may create and deliver value in different ways to those creating wealth for owners but will still have a ‘business model’ with a specific objective.  Matters public sector auditors may obtain an understanding of that are relevant to the business model of the entity, include:

• Knowledge of relevant government activities, including related programs.
• Program objectives and strategies, including public policy elements.

For the audits of public sector entities, “management objectives” may be influenced by requirements to demonstrate public accountability and may include objectives which have their source in law, regulation or other authority. 

Industry, Regulatory and Other External Factors (Ref: Para. 19(a)(ii))

Industry factors

Relevant industry factors include industry conditions such as the competitive environment, supplier and customer relationships, and technological developments.  Matters the auditor may consider include:

• The market and competition, including demand, capacity, and price competition.
• Cyclical or seasonal activity.
• Product technology relating to the entity’s products.
• Energy supply and cost.

The industry in which the entity operates may give rise to specific risks of material misstatement arising from the nature of the business or the degree of regulation. 

Regulatory factors

Relevant regulatory factors include the regulatory environment.  The regulatory environment encompasses, among other matters, the applicable financial reporting framework and the legal and political environment and any changes thereto.  Matters the auditor may consider include:

• Regulatory framework for a regulated industry, for example, prudential requirements, including related disclosures. 
• Legislation and regulation that significantly affect the entity’s operations, for example, labour laws and regulations.
• Taxation legislation and regulations.
• Government policies currently affecting the conduct of the entity’s business, such as monetary, including foreign exchange controls, fiscal, financial incentives (for example, government aid programs), and tariffs or trade restriction policies.
• Environmental requirements affecting the industry and the entity’s business.

ASA 250 includes some specific requirements related to the legal and regulatory framework applicable to the entity and the industry or sector in which the entity operates.[34]

Considerations specific to public sector entities

For the audits of public sector entities, there may be particular laws or regulations that affect the entity’s operations.  Such elements may be an essential consideration when obtaining an understanding of the entity and its environment. 

Other external factors

Other external factors affecting the entity that the auditor may consider include the general economic conditions, interest rates and availability of financing, and inflation or currency revaluation. 

Measures Used by Management to Assess the Entity’s Financial Performance (Ref: Para. 19(a)(iii))

Why the auditor understands measures used by management

An understanding of the entity’s measures assists the auditor in considering whether such measures, whether used externally or internally, create pressures on the entity to achieve performance targets.  These pressures may motivate management to take actions that increase the susceptibility to misstatement due to management bias or fraud (e.g., to improve the business performance or to intentionally misstate the financial report) (see ASA 240 for requirements and guidance in relation to the risks of fraud).

Measures may also indicate to the auditor the likelihood of risks of material misstatement of related financial report information.  For example, performance measures may indicate that the entity has unusually rapid growth or profitability when compared to that of other entities in the same industry.

Measures used by management

Management and others ordinarily measure and review those matters they regard as important.  Enquiries of management may reveal that it relies on certain key indicators, whether publicly available or not, for evaluating financial performance and taking action.  In such cases, the auditor may identify relevant performance measures, whether internal or external, by considering the information that the entity uses to manage its business.  If such enquiry indicates an absence of performance measurement or review, there may be an increased risk of misstatements not being detected and corrected.

Key indicators used for evaluating financial performance may include:

• Key performance indicators (financial and non-financial) and key ratios, trends and operating statistics.
• Period-on-period financial performance analyses.
• Budgets, forecasts, variance analyses, segment information and divisional, departmental or other level performance reports.
• Employee performance measures and incentive compensation policies.
• Comparisons of an entity’s performance with that of competitors.

Scalability (Ref: Para. 19(a)(iii))

The procedures undertaken to understand the entity’s measures may vary depending on the size or complexity of the entity, as well as the involvement of owners or those charged with governance in the management of the entity.

Other considerations

External parties may also review and analyse the entity’s financial performance, in particular for entities where financial information is publicly available.  The auditor may also consider publicly available information to help the auditor further understand the business or identify contradictory information such as information from:

• Analysts or credit agencies.
• News and other media, including social media.
• Taxation authorities.
• Regulators.
• Trade unions.
• Providers of finance.

Such financial information can often be obtained from the entity being audited.

Such financial information can often be obtained from the entity being audited.

The measurement and review of financial performance is not the same as the monitoring of the system of internal control (discussed as a component of the system of internal control in paragraphs A114–A122), though their purposes may overlap:

• The measurement and review of performance is directed at whether business performance is meeting the objectives set by management (or third parties).
• In contrast, monitoring of the system of internal control is concerned with monitoring the effectiveness of controls including those related to management’s measurement and review of financial performance. 

In some cases, however, performance indicators also provide information that enables management to identify control deficiencies. 

Considerations specific to public sector entities

In addition to considering relevant measures used by a public sector entity to assess the entity’s financial performance, auditors of public sector entities may also consider non-financial information such as achievement of public benefit outcomes (for example, the number of people assisted by a specific program).

The Applicable Financial Reporting Framework (Ref: Para. 19(b))

Understanding the Applicable Financial Reporting Framework and the Entity’s Accounting Policies

Matters that the auditor may consider when obtaining an understanding of the entity’s applicable financial reporting framework, and how it applies in the context of the nature and circumstances of the entity and its environment include:        

• The entity’s financial reporting practices in terms of the applicable financial reporting framework, such as:
• Accounting principles and industry-specific practices, including for industry-specific significant classes of transactions, account balances and related disclosures in the financial report (for example, loans and investments for banks, or research and development for pharmaceuticals).
• Revenue recognition.
• Accounting for financial instruments, including related credit losses.
• Foreign currency assets, liabilities and transactions.
• Accounting for unusual or complex transactions including those in controversial or emerging areas (for example, accounting for cryptocurrency).
• An understanding of the entity’s selection and application of accounting policies, including any changes thereto as well as the reasons therefore, may encompass such matters as:
• The methods the entity uses to recognise, measure, present and disclose significant and unusual transactions. 
• The effect of significant accounting policies in controversial or emerging areas for which there is a lack of authoritative guidance or consensus.
• Changes in the environment, such as changes in the applicable financial reporting framework or tax reforms that may necessitate a change in the entity’s accounting policies.
• Financial reporting standards and laws and regulations that are new to the entity and when and how the entity will adopt, or comply with, such requirements.

Obtaining an understanding of the entity and its environment may assist the auditor in considering where changes in the entity’s financial reporting (e.g., from prior periods) may be expected. 

Considerations specific to public sector entities

The applicable financial reporting framework in a public sector entity is determined by the legislative and regulatory frameworks relevant to each jurisdiction or within each geographical area.  Matters that may be considered in the entity’s application of the applicable financial reporting requirements, and how it applies in the context of the nature and circumstances of the entity and its environment, include whether the entity applies a full accrual basis of accounting or a cash basis of accounting in accordance with the International Public Sector Accounting Standards, or a hybrid.

How Inherent Risk Factors Affect Susceptibility of Assertions to Misstatement (Ref: Para. 19(c))

Why the auditor understands inherent risk factors when understanding the entity and its environment and the applicable financial reporting framework

Understanding the entity and its environment, and the applicable financial reporting framework, assists the auditor in identifying events or conditions, the characteristics of which may affect the susceptibility of assertions about classes of transactions, account balances or disclosures to misstatement.  These characteristics are inherent risk factors.  Inherent risk factors may affect susceptibility of assertions to misstatement by influencing the likelihood of occurrence of a misstatement or the magnitude of the misstatement if it were to occur.  Understanding how inherent risk factors affect the susceptibility of assertions to misstatement may assist the auditor with a preliminary understanding of the likelihood or magnitude of misstatements, which assists the auditor in identifying risks of material misstatement at the assertion level in accordance with paragraph 28(b).  Understanding the degree to which inherent risk factors affect susceptibility of assertions to misstatement also assists the auditor in assessing the likelihood and magnitude of a possible misstatement when assessing inherent risk in accordance with paragraph 31(a).  Accordingly, understanding the inherent risk factors may also assist the auditor in designing and performing further audit procedures in accordance with ASA 330.

The auditor’s identification of risks of material misstatement at the assertion level and assessment of inherent risk may also be influenced by audit evidence obtained by the auditor in performing other risk assessment procedures, further audit procedures or in fulfilling other requirements in the ASAs (see paragraphs A95, A103, A111, A121, A124 and

A151).

The effect of inherent risk factors on a class of transactions, account balance or disclosure

The extent of susceptibility to misstatement of a class of transactions, account balance or disclosure arising from complexity or subjectivity is often closely related to the extent to which it is subject to change or uncertainty. 

The greater the extent to which a class of transactions, account balance or disclosure is susceptible to misstatement because of complexity or subjectivity, the greater the need for the auditor to apply professional scepticism.  Further, when a class of transactions, account balance or disclosure is susceptible to misstatement because of complexity, subjectivity, change or uncertainty, these inherent risk factors may create opportunity for management bias, whether unintentional or intentional, and affect susceptibility to misstatement due to management bias.  The auditor’s identification of risks of material misstatement, and assessment of inherent risk at the assertion level, are also affected by the interrelationships among inherent risk factors.

Events or conditions that may affect susceptibility to misstatement due to management bias may also affect susceptibility to misstatement due to other fraud risk factors.  Accordingly, this may be relevant information for use in accordance with paragraph 24 of ASA 240, which requires the auditor to evaluate whether the information obtained from the other risk assessment procedures and related activities indicates that one or more fraud risk factors are present. 

Obtaining an Understanding of the Entity’s System of Internal Control (Ref: Para. 21‒27)

The auditor’s understanding of the entity’s system of internal control is obtained through risk assessment procedures performed to understand and evaluate each of the components of the system of internal control as set out in paragraphs 21 to 27. 

The components of the entity’s system of internal control for the purpose of this ASA may not necessarily reflect how an entity designs, implements and maintains its system of internal control, or how it may classify any particular component.  Entities may use different terminology or frameworks to describe the various aspects of the system of internal control.  For the purpose of an audit, auditors may also use different terminology or frameworks provided all the components described in this ASA are addressed.

Scalability

The way in which the entity’s system of internal control is designed, implemented and maintained varies with an entity’s size and complexity.  For example, less complex entities may use less structured or simpler controls (i.e., policies and procedures) to achieve their objectives.

Considerations Specific to Public Sector Entities

Auditors of public sector entities often have additional responsibilities with respect to internal control, for example, to report on compliance with an established code of practice or reporting on spending against budget.  Auditors of public sector entities may also have responsibilities to report on compliance with law, regulation or other authority.  As a result, their considerations about the system of internal control may be broader and more detailed.

Information Technology in the Components of the Entity’s System of Internal Control

The overall objective and scope of an audit does not differ whether an entity operates in a mainly manual environment, a completely automated environment, or an environment involving some combination of manual and automated elements (i.e., manual and automated controls and other resources used in the entity’s system of internal control). 

Understanding the Nature of the Components of the Entity’s System of Internal Control

In evaluating the effectiveness of the design of controls and whether they have been implemented (see

paragraphs A175 to A181) the auditor’s understanding of each of the components of the entity’s system of internal control provides a preliminary understanding of how the entity identifies business risks and how it responds to them.  It may also influence the auditor’s identification and assessment of the risks of material misstatement in different ways (see paragraph A86).  This assists the auditor in designing and performing further audit procedures, including any plans to test the operating effectiveness of controls.  For example:

• The auditor’s understanding of the entity’s control environment, the entity’s risk assessment process, and the entity’s process to monitor controls components are more likely to affect the identification and assessment of risks of material misstatement at the financial report level. 
• The auditor’s understanding of the entity’s information system and communication, and the entity’s control activities component, are more likely to affect the identification and assessment of risks of material misstatement at the assertion level.

Control Environment, The Entity’s Risk Assessment Process and the Entity’s Process to Monitor the System of Internal Control (Ref: Para. 21–24)

The controls in the control environment, the entity’s risk assessment process and the entity’s process to monitor the system of internal control are primarily indirect controls (i.e., controls that are not sufficiently precise to prevent, detect or correct misstatements at the assertion level but which support other controls and may therefore have an indirect effect on the likelihood that a misstatement will be detected or prevented on a timely basis).  However, some controls within these components may also be direct controls.

Why the auditor is required to understand the control environment, the entity’s risk assessment process and the entity’s process to monitor the system of internal control

The control environment provides an overall foundation for the operation of the other components of the system of internal control.  The control environment does not directly prevent, or detect and correct, misstatements.  It may, however, influence the effectiveness of controls in the other components of the system of internal control.  Similarly, the entity’s risk assessment process and its process for monitoring the system of internal control are designed to operate in a manner that also supports the entire system of internal control. 

Because these components are foundational to the entity’s system of internal control, any deficiencies in their operation could have pervasive effects on the preparation of the financial report.  Therefore, the auditor’s understanding and evaluations of these components affect the auditor’s identification and assessment of risks of material misstatement at the financial report level, and may also affect the identification and assessment of risks of material misstatement at the assertion level.  Risks of material misstatement at the financial report level affect the auditor’s design of overall responses, including, as explained in ASA 330, an influence on the nature, timing and extent of the auditor’s further procedures.[35]

Obtaining an understanding of the control environment (Ref: Para. 21)

Scalability

The nature of the control environment in a less complex entity is likely to be different from the control environment in a more complex entity.  For example, those charged with governance in less complex entities may not include an independent or outside member, and the role of governance may be undertaken directly by the owner-manager where there are no other owners.  Accordingly, some considerations about the entity’s control environment may be less relevant or may not be applicable. 

In addition, audit evidence about elements of the control environment in less complex entities may not be available in documentary form, in particular where communication between management and other personnel is informal, but the evidence may still be appropriately relevant and reliable in the circumstances. 

Understanding the control environment (Ref: Para. 21(a))

Audit evidence for the auditor’s understanding of the control environment may be obtained through a combination of enquiries and other risk assessment procedures (i.e., corroborating enquiries through observation or inspection of documents). 

In considering the extent to which management demonstrates a commitment to integrity and ethical values, the auditor may obtain an understanding through enquiries of management and employees, and through considering information from external sources, about:

• How management communicates to employees its views on business practices and ethical behaviour; and
• Inspecting management’s written code of conduct and observing whether management acts in a manner that supports that code.

Evaluating the control environment (Ref: Para. 21(b))

Why the auditor evaluates the control environment

The auditor’s evaluation of how the entity demonstrates behaviour consistent with the entity’s commitment to integrity and ethical values; whether the control environment provides an appropriate foundation for the other components of the entity’s system of internal control; and whether any identified control deficiencies undermine the other components of the system of internal control, assists the auditor in identifying potential issues in the other components of the system of internal control.  This is because the control environment is foundational to the other components of the entity’s system of internal control.  This evaluation may also assist the auditor in understanding risks faced by the entity and therefore in identifying and assessing the risks of material misstatement at the financial report and assertion levels (see paragraph A86).

The auditor’s evaluation of the control environment

The auditor’s evaluation of the control environment is based on the understanding obtained in accordance with paragraph 21(a).