Guide to Using International Standards on Auditing in - IFAC

35
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
ISAs do not distinguish the audit approach required for a one-person entity from that required for a national
entity employing thousands of people. An audit is an audit. Consequently, the basic approach <strong>to</strong> an audit
does not change just because the entity is small.
The word “audit” is intended <strong>to</strong> convey a clear message <strong>to</strong> users of financial statements. That message is
that the audi<strong>to</strong>r has obtained reasonable assurance that the financial statements are free from material
misstatements, regardless of the size or type of the entity that has been audited.
This issue of proportionality was addressed by IAASB staff in a Staff Questions and Answers document,
entitled Applying ISAs Proportionately with the Size and Complexity of an Entity, 1 issued in August 2009. Its
purpose is <strong>to</strong> assist audi<strong>to</strong>rs in applying the clarified ISAs in a cost-effective manner. The response <strong>to</strong> the
question “How do ISAs address the different characteristics of a small entity from a larger, more complex
entity” was as follows:
“The audi<strong>to</strong>r’s objectives are the same for audits of entities of different sizes and complexities. This,
however, does not mean that every audit will be planned and performed in exactly the same way.
The ISAs recognize that the specific audit procedures <strong>to</strong> be undertaken <strong>to</strong> achieve the audi<strong>to</strong>r’s
objectives and <strong>to</strong> comply with the requirements of the ISAs may vary considerably depending on
whether the entity being audited is large or small and whether it is complex or relatively simple. The
requirements of the ISAs, therefore, focus on matters that the audi<strong>to</strong>r needs <strong>to</strong> address in an audit
and do not ordinarily detail the specific procedures that the audi<strong>to</strong>r should perform.
The ISAs also explain that the appropriate audit approach for designing and performing further
audit procedures depends on the audi<strong>to</strong>r’s risk assessment. For example, based on the required
understanding of the entity and its environment, including its internal control and the assessed risks
of material misstatement, the audi<strong>to</strong>r may determine that a combined approach using both tests
of controls and substantive procedures is an effective approach in the circumstances in responding
<strong>to</strong> the assessed risks. In other cases, for example, in the context of an SME audit where there are not
many control activities in the SME that can be identified by the audi<strong>to</strong>r, the audi<strong>to</strong>r may decide that
it is efficient <strong>to</strong> perform further audit procedures that are primarily substantive procedures.
It is also important <strong>to</strong> note that the ISAs acknowledge that the appropriate exercise of professional
judgment is essential <strong>to</strong> the proper conduct of an audit. Professional judgment is necessary, in
particular, regarding decisions about the nature, timing, and extent of audit procedures used <strong>to</strong>
meet the requirements of the ISAs and gather audit evidence. However, while the audi<strong>to</strong>r of an
SME needs <strong>to</strong> exercise professional judgment, this does not mean that the audi<strong>to</strong>r can decide not
<strong>to</strong> apply a requirement of an ISA except in exceptional circumstances and provided that the audi<strong>to</strong>r
performs alternative audit procedures <strong>to</strong> achieve the aim of the requirement.”
The key points in the excerpt above can be summarized as follows:
• Audit objectives are the same for any size of audit;
• The specific audit procedures required may vary considerably depending on the size of entity and
the assessed risks;
• The ISAs focus on matters the audi<strong>to</strong>r needs <strong>to</strong> address—not on the details of specific procedures;
• The design of further audit procedures depends on the audi<strong>to</strong>r’s risk assessment;
1 Applying ISAs Proportionately with the Size and Complexity of an Entity is at:
http://web.ifac.org/publications/international-auditing-and-assurance-standards-board/practice-alerts-and-q-as#applying-isas-proportionate