Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p17
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 51998–55071

assessment procedures.

A18.         The nature and extent of risk assessment procedures to be performed the first time an engagement is undertaken may be more extensive than procedures for a recurring engagement.  In subsequent periods, the auditor may focus on changes that have occurred since the preceding period.

Types of Risk Assessment Procedures (Ref: Para. 14)

A19.         ASA 500[21] explains the types of audit procedures that may be performed in obtaining audit evidence from risk assessment procedures and further audit procedures.  The nature, timing and extent of the audit procedures may be affected by the fact that some of the accounting data and other evidence may only be available in electronic form or only at certain points in time.[22] The auditor may perform substantive procedures or tests of controls, in accordance with ASA 330, concurrently with risk assessment procedures, when it is efficient to do so.  Audit evidence obtained that supports the identification and assessment of risks of material misstatement may also support the detection of misstatements at the assertion level or the evaluation of the operating effectiveness of controls.

A20.         Although the auditor is required to perform all the risk assessment procedures described in paragraph 14 in the course of obtaining the required understanding of the entity and its environment, the applicable financial reporting framework, and the entity's system of internal control (see paragraphs 19–26), the auditor is not required to perform all of them for each aspect of that understanding.  Other procedures may be performed when the information to be obtained may be helpful in identifying risks of material misstatement.  Examples of such procedures may include making enquiries of the entity's external legal counsel or external supervisors, or of valuation experts that the entity has used.

Automated Tools and Techniques (Ref: Para. 14)

A21.         Using automated tools and techniques, the auditor may perform risk assessment procedures on large volumes of data (from the general ledger, sub-ledgers or other operational data) including for analysis, recalculations, reperformance or reconciliations.

Enquiries of Management and Others within the Entity (Ref: Para. 14(a))

Why Enquiries Are Made of Management and Others Within the Entity

A22.         Information obtained by the auditor to support an appropriate basis for the identification and assessment of risks, and the design of further audit procedures, may be obtained through enquiries of management and those responsible for financial reporting.

A23.         Enquiries of management and those responsible for financial reporting and of other appropriate individuals within the entity and other employees with different levels of authority may offer the auditor varying perspectives when identifying and assessing risks of material misstatement.
Examples:

      * Enquiries directed towards those charged with governance may help the auditor understand the extent of oversight by those charged with