Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p39
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 115983–119092

auditor may consider the implications of such business risks for the preparation of the entity's financial report and other aspects of its system of internal control.

Evaluating the entity's risk assessment process (Ref: Para. 22(b))

Why the auditor evaluates whether the entity's risk assessment process is appropriate

A111.      The auditor's evaluation of the entity's risk assessment process may assist the auditor in understanding where the entity has identified risks that may occur, and how the entity has responded to those risks.  The auditor's evaluation of how the entity identifies its business risks, and how it assesses and addresses those risks assists the auditor in understanding whether the risks faced by the entity have been identified, assessed and addressed as appropriate to the nature and complexity of the entity.  This evaluation may also assist the auditor with identifying and assessing financial report level and assertion level risks of material misstatement (see paragraph A86).

Evaluating whether the entity's risk assessment process is appropriate (Ref: Para. 22(b))

A112.      The auditor's evaluation of the appropriateness of the entity's risk assessment process is based on the understanding obtained in accordance with paragraph 22(a).

Scalability

A113.      Whether the entity's risk assessment process is appropriate to the entity's circumstances considering the nature and complexity of the entity is a matter of the auditor's professional judgement.
Example:

In some less complex entities, and particularly owner-managed entities, an appropriate risk assessment may be performed through the direct involvement of management or the owner-manager (e.g., the manager or owner-manager may routinely devote time to monitoring the activities of competitors and other developments in the market place to identify emerging business risks).  The evidence of this risk assessment occurring in these types of entities is often not formally documented, but it may be evident from the discussions the auditor has with management that management are in fact performing risk assessment procedures.

Obtaining an understanding of the entity's process to monitor the entity's system of internal control (Ref: Para. 24)

Scalability

A114.      In less complex entities, and in particular owner-manager entities, the auditor's understanding of the entity's process to monitor the system of internal control is often focused on how management or the owner-manager is directly involved in operations, as there may not be any other monitoring activities.
Example:

Management may receive complaints from customers about inaccuracies in their monthly statement that alerts the owner-manager to issues with the timing of when customer payments are being recognised in the accounting records.

A115.      For entities where there is no formal process for monitoring the system of internal control, understanding the process to monitor the system of internal control may include understanding periodic reviews of management accounting information that are designed to contribute to