Guide to Using International Standards on Auditing in - IFAC

36
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
• The appropriate exercise of professional judgment is essential in tailoring the procedures <strong>to</strong> respond
appropriately <strong>to</strong> the assessed risks; and
• Professional judgment cannot be used <strong>to</strong> avoid compliance with any ISA requirements except in
exceptional circumstances.
In addition, the ISAs contain a number of special paragraphs that address considerations specific <strong>to</strong> audits of
SMEs. This material provides useful guidance material in applying specific ISA requirements in the context of
an SME audit.
Some suggestions for successfully implementing ISAs on smaller engagements are included in the following exhibit.
Exhibit 3.6-1
1. Take time <strong>to</strong> read the clarified ISAs and <strong>to</strong> train staff.
Failure <strong>to</strong> understand the requirements can lead <strong>to</strong>:
• The entire risk assessment phase of the audit becoming an “add-on” <strong>to</strong> the other substantive audit
work performed. It should be the risk assessment that drives the selection of audit procedures <strong>to</strong> be
performed, not a standardized listing of procedures that could be applied <strong>to</strong> any entity. The purpose
of the risk assessment is <strong>to</strong> focus the audit effort on areas where there is a greater risk of material
misstatement in the financial statements, and away from less risky areas.
• Turning what should be a simple audit in<strong>to</strong> a complex and time-consuming project. This can arise if
efforts are focused on completing needless standard audit forms and checklists, rather than using
professional judgment <strong>to</strong> scale the work according <strong>to</strong> the size and complexity of the entity being
audited and the risks involved.
• Failure <strong>to</strong> comply with an ISA (“the audi<strong>to</strong>r shall”) requirement.
2. Take time <strong>to</strong> plan well, no matter how small the engagement.
It has been said an hour spent in planning can save many more in execution. Effective audit planning is often the
difference between a quality audit within budget and a poor-quality audit that goes over budget. This does not
necessarily mean holding dedicated team meetings in the office. On very small engagements, planning can be
achieved through brief discussions at the start of the engagement and as the audit progresses.
Key areas <strong>to</strong> address in planning:
• Encourage staff <strong>to</strong> identify areas where the usual audit procedures seem excessive in relation <strong>to</strong> the
risk of misstatement being addressed.
• Take time <strong>to</strong> ensure that each staff member understands the necessity and purpose of the
documentation he or she is required <strong>to</strong> complete. Countless hours can be lost by staff attempting <strong>to</strong>
complete forms they do not understand.
• Discuss the potential for fraud. Encourage staff <strong>to</strong> be skeptical and inquisitive, and empower them <strong>to</strong>
raise issues, observations, or unexplained matters.
• Discuss known related parties and the nature/size of transactions.
• Consider whether the audit documentation prepared in previous periods can simply be updated for
changes that have occurred, rather than be prepared all over again. Documentation and assessment
of risk fac<strong>to</strong>rs and relevant internal controls should be sufficient <strong>to</strong> enable audi<strong>to</strong>rs in subsequent
periods <strong>to</strong> leverage their understanding of the entity and focus attention on new industry trends, key
operational changes, new inherent risks, and revised internal controls.