Guide to Using International Standards on Auditing in - IFAC

95
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Paragraph #
Relevant Extracts from ISAs
315.11 The audi<strong>to</strong>r shall obtain an understanding of the following:
(a) Relevant industry, regula<strong>to</strong>ry, and other external fac<strong>to</strong>rs including the applicable financial
reporting framework. (Ref: Para. A17-A22)
(b) The nature of the entity, including:
(i) its operations;
(ii) its ownership and governance structures;
(iii) the types of investments that the entity is making and plans <strong>to</strong> make, including
investments in special-purpose entities; and
(iv) the way that the entity is structured and how it is financed <strong>to</strong> enable the audi<strong>to</strong>r
<strong>to</strong> understand the classes of transactions, account balances, and disclosures <strong>to</strong> be
expected in the financial statements. (Ref: Para. A23-A27)
(c) The entity’s selection and application of accounting policies, including the reasons for
changes there<strong>to</strong>. The audi<strong>to</strong>r shall evaluate whether the entity’s accounting policies
are appropriate for its business and consistent with the applicable financial reporting
framework and accounting policies used in the relevant industry. (Ref: Para. A28)
(d) The entity’s objectives and strategies, and those related business risks that may result in
risks of material misstatement. (Ref: Para. A29-A35)
(e) The measurement and review of the entity’s financial performance. (Ref: Para. A36-A41)
315.12 The audi<strong>to</strong>r shall obtain an understanding of internal control relevant <strong>to</strong> the audit. Although
most controls relevant <strong>to</strong> the audit are likely <strong>to</strong> relate <strong>to</strong> financial reporting, not all controls that
relate <strong>to</strong> financial reporting are relevant <strong>to</strong> the audit. It is a matter of the audi<strong>to</strong>r’s professional
judgment whether a control, individually or in combination with others, is relevant <strong>to</strong> the
audit. (Ref: Para. A42-A65)
8.1 Overview
The purpose of risk assessment procedures is <strong>to</strong> identify and assess risks of material misstatement. This is
achieved through understanding the entity and its environment, including internal control. Information may
be obtained from external sources, such as the Internet and trade publications, and from internal sources
such as discussions with key personnel. This understanding of the entity becomes a continuous, dynamic
process of gathering, updating and analyzing information throughout the audit.
8.2 Audit Evidence
Risk assessment procedures provide audit evidence <strong>to</strong> support the assessment of risks at the financial
statement and assertion levels. However, this evidence does not stand alone. Evidence obtained from risk
assessment procedures is supplemented by further audit procedures (that respond <strong>to</strong> the risks identified)
such as tests of controls and/or substantive procedures.
Required Procedures
The audi<strong>to</strong>r uses professional judgment <strong>to</strong> determine the risk assessment procedures <strong>to</strong> be performed, and the
scope or depth of understanding of the entity that is required. In the first year that the audi<strong>to</strong>r conducts the
audit for an entity, the work required <strong>to</strong> obtain and document this information will often require a significant
amount of time. However, if the information obtained is well documented in the first year, the time required <strong>to</strong>
update the information in subsequent years should be considerably less than that required in the first year.