SA-315 Identifying and Assessing the Risk of Material Misstatements through Understanding the Entity and its Environment

SA-315 Identifying and Assessing the Risk of Material Misstatements through Understanding the Entity and its Environment

An entity’s environment, both internal and external, poses many threats that lead to entity’s financial information being misstated materially.
SA 315 enables the auditor to identify and assess the risk of material misstatement, whether due to fraud or error in an entity’s financial statements and design and implement appropriate responses  & procedures which will reduce such risk to an acceptably low level.                                      

Overview

1.      Understanding of the entity and its environment:

     The auditor shall obtain an understanding of:

•       The relevant industry, regulatory and other external factors including applicable FRF.
•       The nature of the entity including its operations, ownership and governance, investments         made and planned by the entity and structure and finance of the entity.
•       Accounting policies applied by the entity and evaluation of their appropriateness and              consistency with the FRF thereon.
•       Objectives, strategies and business risks.
•         Financial performance of the entity.

2.      Understanding the entity’s Internal Control:

The auditor shall obtain an understanding of internal control relevant to the audit.

•        The auditor shall evaluate the design of the relevant controls first and then determine their implementation through inquiry of personnel, observing the application, inspection of documents, tracing transactions through information system.
•  The auditor shall obtain an understanding of control environment by evaluating whether the     management has maintained a culture of honesty and ethical behavior; the strengths of the   control environment collectively provide an appropriate foundation for other components of     internal control.
•  The auditor shall obtain an understanding of entity’s risk assessment process for:

•  Identifying business risks
•  Estimating the significance of risks
•  Assessing the likelihood of their occurrence.
•  Deciding about actions to address those risks.

The auditor shall evaluate whether the entity’s risk assessment process is appropriate to its circumstances and whether any significant deficiency exists in the process.

The auditor shall also evaluate the significance of the risks posed to internal controls in case of entities not having risk assessment procedures.

The auditor shall obtain an understanding of the information system including the following areas:

•      The significant classes of transactions
•      The procedures (both IT and Manual), relating to the above classes of  transactions
•      The related accounting records
•      Significant Accounting estimates and disclosures
•      Controls regarding non-recurring, unusual transactions or adjustments.

The auditor shall also obtain an understanding of communications between management and TCWG and external communications regarding financial reporting roles and responsibilities and significant matters.

The auditor shall obtain an understanding of control activities related to the audit and design further audit procedures responsive to assessed risks.

The auditor shall obtain an understanding of the major activities used by the entity to monitor internal control and how the entity initiates actions to deficiencies in controls.

The auditor has to determine whether internal audit function is relevant to the audit by understanding the internal audit’s responsibilities and the activities performed by it.

3.      Identifying and assessing the risk of material misstatement:

The auditor shall identify and asses the risk of material misstatement at financial statement and assertion level to provide a basis for designing and performing further audit procedures.

4.      Risks requiring special audit consideration:

The auditor shall determine whether any of the risks identified as above are significant risks in the auditor’s judgement by considering whether the risk is that of fraud, related to recent developments, complexity of transactions, related party, degree of subjectivity, unusual transactions.

After identifying significant risk, auditor shall also obtain an understanding of the controls relevant to that risk.

Scope of this SA

This Standard on Auditing (SA) deals with the auditor’s responsibility to identify and assess the risks of material misstatement in the financial statements, through understanding the entity and its environment, including the entity’s internal control.

Key terms and definitions

1.      Assertions: Representations by the management, explicit or otherwise, that are embodied in the financial statements, as used by the auditor to consider the different types of potential misstatements that may occur.

2.      Internal control: The process designed, implemented and maintained by those charged with governance, management and other personnel to provide reasonable assurance about the achievement of an entity’s
objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, safeguarding of assets, and compliance with applicable laws and regulations. The term “controls” refers to any aspects of one or more of the components of internal control.

3.      Risk assessment procedures: The audit procedures performed to obtain an understanding of the entity and its environment, including the entity’s internal control, to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement and assertion levels.

Responsibilities of an Auditor

The auditor shall perform risk assessment procedures to provide a basis for the identification and assessment of risk of material misstatement through the following:

•          Inquiries of management
•          Analytical procedures
•          Observation and inspection      

The auditor shall consider the following :

•       Relevance of information obtained from the auditor’s client acceptance or continuance process to identifying the risk of material misstatement.

•       Relevance of the information obtained from other engagements performed by the auditor for the  entity.

• Relevance of information obtained from previous audit, after consideration of changes occurred since the previous period.
• Discuss the susceptibility of the entity’s financial statements to material misstatement along with the other engagement team members.

Several issues that Auditor must be aware of are and action required to solve the issues are:

S. No.	Issues	Action required
1.     1.	Difficulty in evaluating the whether the internal control system of the entity is capable of preventing misstatements.	Evaluating the design of internal control after considering the nature and size of the entity. Recording instances where the entity’s risk assessment procedures failed to identify an underlying risk.
2.       2.	Difficulty in checking the implementation of internal control.	Procedures like inquiring of personnel, inspecting the documents of specific controls etc may be used.
3.      3.	Assessment of risk in fully automated business transactions.	The effectiveness of controls over accuracy and completeness of electronic information has to be evaluated.

       

             Required Documents

The auditor shall document:

•          The discussions amongst the engagement team and significant decisions reached thereon.
•       Key elements of the understanding obtained regarding the entity and its environment including internal control components, the sources of information and the risk assessment procedures performed.
•          The identified risk of material misstatement.