Guide to Using International Standards on Auditing in - IFAC

60
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Risk
Assessment
A risk assessment process provides management with the information needed <strong>to</strong> determine what business/
fraud risks should be managed, and the actions (if any) <strong>to</strong> be taken. Management may initiate plans,
programs, or actions <strong>to</strong> address specific risks, or it may decide <strong>to</strong> accept a risk because of cost or other
considerations.
If the entity’s risk assessment process is appropriate <strong>to</strong> the circumstances, it will assist the audi<strong>to</strong>r in identifying
risks of material misstatement. A risk assessment process would normally address such matters as:
• Changes in operating environment;
• New senior personnel;
• New or revamped information systems;
• Rapid growth;
• New technology;
• New business models, products, or activities;
• Corporate restructurings (including divestitures and acquisitions);
• Expanded foreign operations; and
• New accounting pronouncements.
In smaller entities where a formal risk assessment process is unlikely <strong>to</strong> exist, the audi<strong>to</strong>r would discuss with
management how business risks are identified and how they are addressed.
Matters the audi<strong>to</strong>r should consider are how management:
• Identifies risks relevant <strong>to</strong> financial reporting;
• Estimates the significance of the risks;
• Assesses the likelihood of their occurrence; and
• Decides upon actions <strong>to</strong> manage them.
If the audi<strong>to</strong>r identifies risks of material misstatement that management failed <strong>to</strong> identify, he/she should
consider:
• Why did management’s processes fail?
• Are the processes appropriate <strong>to</strong> the circumstances?
If a significant deficiency exists in the entity’s risk assessment process (or there is no process at all), it would be
communicated <strong>to</strong> management and those charged with governance.