Guide to Using International Standards on Auditing in - IFAC

27
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
3.3 How <strong>to</strong> Perform a Risk-Based Audit
Paragraph #
Relevant Extracts from ISAs
200.15 The audi<strong>to</strong>r shall plan and perform an audit with professional skepticism recognizing that
circumstances may exist that cause the financial statements <strong>to</strong> be materially misstated. (Ref:
Para. A18-A22)
200.16 The audi<strong>to</strong>r shall exercise professional judgment in planning and performing an audit of
financial statements. (Ref: Para. A23-A27)
200.17 To obtain reasonable assurance, the audi<strong>to</strong>r shall obtain sufficient appropriate audit evidence
<strong>to</strong> reduce audit risk <strong>to</strong> an acceptably low level and thereby enable the audi<strong>to</strong>r <strong>to</strong> draw
reasonable conclusions on which <strong>to</strong> base the audi<strong>to</strong>r’s opinion. (Ref: Para. A28-A52)
200.21 To achieve the overall objectives of the audi<strong>to</strong>r, the audi<strong>to</strong>r shall use the objectives stated in
relevant ISAs in planning and performing the audit, having regard <strong>to</strong> the interrelationships
among the ISAs, <strong>to</strong>: (Ref: Para. A67-A69)
(a) Determine whether any audit procedures in addition <strong>to</strong> those required by the ISAs are
necessary in pursuance of the objectives stated in the ISAs; and (Ref: Para. A70)
(b) Evaluate whether sufficient appropriate audit evidence has been obtained. (Ref: Para. A71)
A risk-based audit has three key steps, as illustrated below.
Exhibit 3.3-1
Steps (Phases)
Risk Assessment
Risk Response
Reporting
Description
Performing risk assessment procedures <strong>to</strong> identify and assess the risks of material
misstatement in the financial statements.
Designing and performing further audit procedures that respond <strong>to</strong> identified and
assessed risks of material misstatement, at both the financial statement and assertion
levels.
This involves:
• Forming an opinion based on the audit evidence obtained; and
• Preparing and issuing a report that is appropriate <strong>to</strong> the conclusions reached.
A simple way of describing the three elements is illustrated below.
Exhibit 3.3-2
Risk Assessment
What events*
could occur that would
cause a material
misstatement in the
financial statements?
Risk Response
Did the events*
identified occur and
result in a material
misstatement in the
financial statements?
Reporting
What audit opinion,
based on the evidence
obtained, is appropriate
on the financial statements?
* An “event” is simply a business or fraud risk fac<strong>to</strong>r (see descriptions in Exhibit 3.2-2) that, if it actually occurred, would adversely affect the entity’s ability
<strong>to</strong> achieve its objective of preparing financial statements that do not contain material misstatements resulting from error and fraud. This would also
include risks resulting from the absence of internal control <strong>to</strong> mitigate the potential for material misstatements in the financial statements.