Guide to Using International Standards on Auditing in - IFAC

97
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
In smaller entities, the procedures required <strong>to</strong> identify these risks may be minimal, whereas in larger and more
complex entities, the procedures could be extensive.
8.3 The Three Risk Assessment Procedures
Each of the three risk assessment procedures should be performed during the audit, but not necessarily for each
aspect of the understanding required. In many situations, the results from performing one type of procedure
may lead <strong>to</strong> performing another. For example, in an interview with the sales manager, an unusual but significant
sales contract might be identified. This could be followed up by an inspection of the actual sales contract and
an analysis of the impact on sales margins. Alternatively, findings from performing analytical procedures on
preliminary operating results may trigger some questions for management. The answers <strong>to</strong> these questions may
then lead <strong>to</strong> requests <strong>to</strong> inspect certain documents or observe some activities.
The nature and use of the three procedures are outlined below.
8.4 Inquiries of Management and Others (including inquiries relating <strong>to</strong> fraud)
Inquiries of
Management
and Others
Paragraph #
Relevant Extracts from ISAs
240.17 The audi<strong>to</strong>r shall make inquiries of management regarding:
(a) Management’s assessment of the risk that the financial statements may be materially
misstated due <strong>to</strong> fraud, including the nature, extent and frequency of such assessments;
(Ref: Para. A12-A13)
(b) Management’s process for identifying and responding <strong>to</strong> the risks of fraud in the entity,
including any specific risks of fraud that management has identified or that have been
brought <strong>to</strong> its attention, or classes of transactions, account balances, or disclosures for
which a risk of fraud is likely <strong>to</strong> exist; (Ref: Para. A14)
(c) Management’s communication, if any, <strong>to</strong> those charged with governance regarding its
processes for identifying and responding <strong>to</strong> the risks of fraud in the entity; and
(d) Management’s communication, if any, <strong>to</strong> employees regarding its views on business
practices and ethical behavior.
240.18 The audi<strong>to</strong>r shall make inquiries of management, and others within the entity as appropriate,
<strong>to</strong> determine whether they have knowledge of any actual, suspected or alleged fraud affecting
the entity. (Ref: Para. A15-A17)