Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p16
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 49120–52270

13)

A14.         Designing and performing risk assessment procedures to obtain audit evidence to support the identification and assessment of the risks of material misstatement in an unbiased manner may assist the auditor in identifying potentially contradictory information, which may assist the auditor in exercising professional scepticism in identifying and assessing the risks of material misstatement.

Sources of Audit Evidence (Ref: Para. 13)

A15.         Designing and performing risk assessment procedures to obtain audit evidence in an unbiased manner may involve obtaining evidence from multiple sources within and outside the entity.  However, the auditor is not required to perform an exhaustive search to identify all possible sources of audit evidence.  In addition to information from other sources[19], sources of information for risk assessment procedures may include:

           * Interactions with management, those charged with governance, and other key entity personnel, such as internal auditors.

           * Certain external parties such as regulators, whether obtained directly or indirectly.

           * Publicly available information about the entity, for example entity-issued press releases, materials for analysts or investor group meetings, analysts' reports or information about trading activity.

Regardless of the source of information, the auditor considers the relevance and reliability of the information to be used as audit evidence in accordance with ASA 500.[20]

Scalability (Ref: Para. 13)

A16.         The nature and extent of risk assessment procedures will vary based on the nature and circumstances of the entity (e.g., the formality of the entity's policies and procedures, and processes and systems).  The auditor uses professional judgement to determine the nature and extent of the risk assessment procedures to be performed to meet the requirements of this ASA.

A17.         Although the extent to which an entity's policies and procedures, and processes and systems are formalised may vary, the auditor is still required to obtain the understanding in accordance with paragraphs 19, 21, 22, 24, 25 and 26.

Examples:

Some entities, including less complex entities, and particularly owner-managed entities, may not have established structured processes and systems (e.g., a risk assessment process or a process to monitor the system of internal control) or may have established processes or systems with limited documentation or a lack of consistency in how they are undertaken.  When such systems and processes lack formality, the auditor may still be able to perform risk assessment procedures through observation and enquiry.

Other entities, typically more complex entities, are expected to have more formalised and documented policies and procedures.  The auditor may use such documentation in performing risk assessment procedures.

A18.         The nature and extent of risk assessment procedures to be performed the first time an engagement is undertaken may be more extensive than procedures for a recurring engagement.  In subsequent periods, the auditor may focus on changes