Guide to Using International Standards on Auditing in - IFAC

24
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Audit Risk Components
The major components of audit risk are described in the exhibit below.
Exhibit 3.2-2
Nature Description Commentary
Inherent Risk The susceptibility of an assertion about a
class of transaction, account balance, or
disclosure <strong>to</strong> a misstatement that could
be material, either individually or when
aggregated with other misstatements,
before consideration of any related
controls.
This includes events or conditions
(internal or external) that could result
in a misstatement (error or fraud) in the
financial statements. The sources of risk
(often categorized as business or fraud
risks) can arise from the entity’s objectives,
the nature of its operations/industry,
the regula<strong>to</strong>ry environment in which it
operates, and its size and complexity.
Control Risk
The risk that a misstatement that could
occur in an assertion about a class
of transaction, account balance, or
disclosure and that could be material,
either individually or when aggregated
with other misstatements, will not be
prevented, or detected and corrected,
on a timely basis by the entity’s internal
control.
Management designs controls <strong>to</strong>
mitigate a specified inherent (business
or fraud risk) fac<strong>to</strong>r. An entity assesses its
risks (risk assessment) and then designs
and implements appropriate controls
<strong>to</strong> reduce its risk exposure <strong>to</strong> a <strong>to</strong>lerable
(acceptable) level.
Controls may be:
• Pervasive in nature, such as
management’s attitude <strong>to</strong>ward
control, commitment <strong>to</strong> hiring
competent people, and prevention
of fraud. These are generally called
entity-level controls; and
• Specific <strong>to</strong> the initiation, processing,
or recording of a particular
transaction. These are often called
business process, activity-level, or
transaction controls.