Document ID: chunk:federal_register_of_legislation:F2025L00107:front:0:p145
Version: federal_register_of_legislation:F2025L00107
Segment Type: other
Provision Reference: 
Character Range: 454990–458227

Information about the control environment in less complex entities may not be available in documentary form, in particular when communication between management and other personnel is informal, but the information may still be appropriately relevant and reliable in the circumstances. For example, the practitioner may observe the entity's past and current practices, and engagement with stakeholders. Such observations may contribute to the practitioner's understanding of the components of the entity's system of internal control, even if policies have not been documented formally.

The Entity's Risk Assessment Process (Ref: Para. 115L, 115R)

 1.       Understanding the results of the entity's risk assessment process may assist the practitioner in:

         1.                 Identifying and assessing risks of material misstatement in the disclosures; and

         2.                 Obtaining an understanding of the sustainability matters and other engagement circumstances.

A365R. The practitioner's evaluation of whether the entity's risk assessment process is appropriate to the entity's circumstances allows the practitioner to understand where the entity has identified risks that may occur, and how the entity has responded to those risks. The practitioner's evaluation of how the entity identifies its risks, and how it assesses and addresses those risks, assists the practitioner in understanding whether the risks faced by the entity have been identified, assessed, and addressed as appropriate to the nature and complexity of the entity.

     1.

 2.       In some cases, the criteria may require the entity to identify and provide information about sustainability-related risks and opportunities, or the process(es) by which sustainability-related risks and opportunities are identified, assessed and managed. Therefore, understanding the results of the entity's risk assessment process may also assist the practitioner in identifying and assessing risks of material misstatement related to the appropriate application of the applicable criteria by the entity. For example, if the practitioner identifies potential deficiencies in the entity's risk assessment process, the practitioner may determine that there is a heightened risk that sustainability matters required to be reported in accordance with the applicable criteria may not have been identified by the entity and therefore, the presentation or description of such matters in the sustainability information may be incomplete.

A367R. Not all risks identified by the entity give rise to risks of material misstatement. In understanding how management and those charged with governance have identified risks relevant to the preparation of the sustainability information, and decided about actions to address those risks, the practitioner may consider how management or, as appropriate, those charged with governance, have:

 1.                 Specified the entity's objectives with sufficient precision and clarity to enable the identification and assessment of the risks relating to the objectives;

 2.                 Identified the risks to achieving the entity's objectives and analysed the risks as a basis for determining how the risks should be