Guide to Using International Standards on Auditing in - IFAC

59
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Control Element The Key Question Possible Controls
Human Resources
Policies and
Practices
What standards are
in place <strong>to</strong> ensure:
Recruitment of the
most competent
and trustworthy
people?
Training is provided
<strong>to</strong> ensure people
can perform their
jobs?
Promotions
are driven by
performance
appraisals?
• Management establishes/enforces standards for hiring
the most qualified individuals.
• Recruiting practices include employment interviews,
background checks, and communication of values,
expected behaviors, and management’s operating style.
• Job performance is periodically evaluated, the results
reviewed with each employee, and appropriate action
taken.
• Training policies address prospective roles and
responsibilities, expected levels of performance, and
evolving needs.
5.4 Risk Assessment
Paragraph #
Relevant Extracts from ISAs
315.15 The audi<strong>to</strong>r shall obtain an understanding of whether the entity has a process for:
(a) Identifying business risks relevant <strong>to</strong> financial reporting objectives;
(b) Estimating the significance of the risks;
(c) Assessing the likelihood of their occurrence; and
(d) Deciding about actions <strong>to</strong> address those risks. (Ref: Para. A79)
315.16 If the entity has established such a process (referred <strong>to</strong> hereafter as the “entity’s risk
assessment process”), the audi<strong>to</strong>r shall obtain an understanding of it, and the results thereof.
If the audi<strong>to</strong>r identifies risks of material misstatement that management failed <strong>to</strong> identify, the
audi<strong>to</strong>r shall evaluate whether there was an underlying risk of a kind that the audi<strong>to</strong>r expects
would have been identified by the entity’s risk assessment process. If there is such a risk, the
audi<strong>to</strong>r shall obtain an understanding of why that process failed <strong>to</strong> identify it, and evaluate
whether the process is appropriate <strong>to</strong> its circumstances or determine if there is a significant
deficiency in internal control with regard <strong>to</strong> the entity’s risk assessment process.
315.17 If the entity has not established such a process or has an ad hoc process, the audi<strong>to</strong>r shall
discuss with management whether business risks relevant <strong>to</strong> financial reporting objectives
have been identified and how they have been addressed. The audi<strong>to</strong>r shall evaluate whether
the absence of a documented risk assessment process is appropriate in the circumstances, or
determine whether it represents a significant deficiency in internal control. (Ref: Para. A80)