Guide to Using International Standards on Auditing in - IFAC

98
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Paragraph #
Relevant Extracts from ISAs
240.20 Unless all of those charged with governance are involved in managing the entity, the audi<strong>to</strong>r
shall obtain an understanding of how those charged with governance exercise oversight of
management’s processes for identifying and responding <strong>to</strong> the risks of fraud in the entity
and the internal control that management has established <strong>to</strong> mitigate these risks. (Ref: Para.
A19-A21)
240.21 Unless all of those charged with governance are involved in managing the entity, the audi<strong>to</strong>r
shall make inquiries of those charged with governance <strong>to</strong> determine whether they have
knowledge of any actual, suspected or alleged fraud affecting the entity. These inquiries are
made in part <strong>to</strong> corroborate the responses <strong>to</strong> the inquiries of management.
Inquiry is used by the audi<strong>to</strong>r in conjunction with other risk assessment procedures <strong>to</strong> assist in identifying
risks of material misstatement. The focus of the questions is <strong>to</strong> obtain an understanding of each of the
required aspects as set out in paragraphs 11 and 12 of ISA 315 (reproduced above).
Typically, most information from inquiries is obtained from management and those responsible for financial
reporting. However, inquiries of others within the entity and employees with different levels of authority can
provide a different perspective, and additional information that can be useful in identifying risks of material
misstatement that may otherwise be missed. For example, a discussion with the sales manager might reveal
that certain sales transactions (late in the period) were rushed through and not recorded in accordance with
the entity’s revenue recognition policies.