Document ID: chunk:federal_register_of_legislation:F2025L00107:front:0:p131
Version: federal_register_of_legislation:F2025L00107
Segment Type: other
Provision Reference: 
Character Range: 412600–415969

professional judgement to determine the nature and extent of the risk assessment procedures to be performed to meet the requirements of this ASSA as appropriate to the level of assurance to be obtained. The depth of understanding that is required by the practitioner is less than that possessed by management in managing the entity and is less for a limited assurance engagement than for a reasonable assurance engagement.

 3.       The type of risk assessment procedures performed by the practitioner may include the following:

         1.                 Enquiries of management, of appropriate individuals within the internal audit function (if the function exists), and of others within the entity who, in the practitioner's judgement, may have information that is likely to assist in identifying and assessing risks of material misstatement, whether due to fraud or error;

         2.                 Analytical procedures; and

         3.                 Observation and inspection.

 4.       Information obtained by the practitioner through enquiries may provide important evidence (e.g., to support the required understanding of the entity and its environment and the components of the entity's system of internal control); however, for a reasonable assurance engagement, enquiry alone ordinarily is not sufficient to identify and assess risks of material misstatement at the assertion level.

 5.       Designing and performing risk assessment procedures may involve obtaining evidence from multiple sources including:

         1.                 Interactions with management, those charged with governance, and other key entity personnel, which may include personnel within the entity who work in functions relevant to the sustainability information (such as Human Resources) or internal auditors.

         2.                 Certain external parties such as regulators, whether obtained directly or indirectly.

         3.                 Publicly available information about the entity and its industry, for example, entity-issued press releases, materials for analysts or investor group meetings, analysts' reports, or information about sustainability matters.

 6.       The practitioner may perform further procedures concurrently with risk assessment procedures when it is efficient to do so.
Example:

       * Evidence obtained that supports the identification and assessment of risks of material misstatement may also support the evaluation of the operating effectiveness of controls.

Considering Information from Engagement Acceptance and Continuance Procedures (Ref: Para. 104)

 1.       Paragraph 75 requires the practitioner to obtain a preliminary knowledge of the engagement circumstances to provide an appropriate basis for establishing whether the preconditions for the engagement are present. This preliminary knowledge ordinarily is not sufficient to fulfill the requirements in paragraphs 103L and 103R, but may provide important evidence to support the required understanding. The practitioner may supplement the understanding of the applicable criteria obtained in accepting the engagement when performing risk assessment procedures with information from, for example:

           * When applicable, other engagements performed by the engagement leader for the entity, such as the audit of financial report or verification of