Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p5
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 5/47)
Character Range: 20138–23457

are not undermined by control environment weaknesses.  (Ref: Para. A77‑A87)

The entity's risk assessment process

15.               The auditor shall obtain an understanding of whether the entity has a process for:

(a)                Identifying business risks relevant to financial reporting objectives;

(b)                Estimating the significance of the risks;

(c)                Assessing the likelihood of their occurrence; and

(d)                Deciding about actions to address those risks.  (Ref: Para. A88)

16.               If the entity has established such a process (referred to hereafter as the "entity's risk assessment process"), the auditor shall obtain an understanding of it, and the results thereof.  If the auditor identifies risks of material misstatement that management failed to identify, the auditor shall evaluate whether there was an underlying risk of a kind that the auditor expects would have been identified by the entity's risk assessment process.  If there is such a risk, the auditor shall obtain an understanding of why that process failed to identify it, and evaluate whether the process is appropriate to its circumstances or determine if there is a significant deficiency in internal control with regard to the entity's risk assessment process.

17.               If the entity has not established such a process or has an ad hoc undocumented process, the auditor shall discuss with management whether business risks relevant to financial reporting objectives have been identified and how they have been addressed.  The auditor shall evaluate whether the absence of a documented risk assessment process is appropriate in the circumstances, or determine whether it represents a significant deficiency in internal control.  (Ref: Para. A89)

The information system, including the related business processes, relevant to financial reporting, and communication

18.               The auditor shall obtain an understanding of the information system, including the related business processes, relevant to financial reporting, including the following areas:
(Ref: Para. A90–A92)

(a)                The classes of transactions in the entity's operations that are significant to the financial report;

(b)                The procedures, within both information technology (IT) and manual systems, by which those transactions are initiated, recorded, processed, corrected as necessary, transferred to the general ledger and reported in the financial report;

(c)                The related accounting records, supporting information and specific accounts in the financial report that are used to initiate, record, process and report transactions; this includes the correction of incorrect information and how information is transferred to the general ledger.  The records may be in either manual or electronic form;

(d)                How the information system captures events and conditions, other than transactions, that are significant to the financial report;

(e)                The financial reporting process used to prepare the entity's financial report, including significant accounting estimates and disclosures; and

(f)                 Controls surrounding journal entries, including non‑standard journal entries used to record non‑recurring, unusual transactions or