Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p7
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 18292–21515

processes are the entity's processes to manage access to the IT environment, manage program changes or changes to the IT environment and manage IT operations.

(h)                Relevant assertions – An assertion about a class of transactions, account balance or disclosure is relevant when it has an identified risk of material misstatement.  The determination of whether an assertion is a relevant assertion is made before consideration of any related controls (i.e., the inherent risk).  (Ref: Para. A9)

(i)                 Risks arising from the use of IT – Susceptibility of information processing controls to ineffective design or operation, or risks to the integrity of information (i.e., the completeness, accuracy and validity of transactions and other information) in the entity's information system, due to ineffective design or operation of controls in the entity's IT processes (see IT environment).

(j)                 Risk assessment procedures – The audit procedures designed and performed to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial report and assertion levels.

(k)                Significant class of transactions, account balance or disclosure – A class of transactions, account balance or disclosure for which there is one or more relevant assertions.

(l)                 Significant risk – An identified risk of material misstatement: (Ref: Para. A10)

(i)                 For which the assessment of inherent risk is close to the upper end of the spectrum of inherent risk due to the degree to which inherent risk factors affect the combination of the likelihood of a misstatement occurring and the magnitude of the potential misstatement should that misstatement occur; or

(ii)               That is to be treated as a significant risk in accordance with the requirements of other ASAs.[12]

(m)             System of internal control – The system designed, implemented and maintained by those charged with governance, management and other personnel, to provide reasonable assurance about the achievement of an entity's objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations.  For the purposes of the ASAs, the system of internal control consists of five inter-related components:

(i)                 Control environment;

(ii)               The entity's risk assessment process;

(iii)             The entity's process to monitor the system of internal control;

(iv)             The information system and communication; and

(v)                Control activities.

Requirements

Risk Assessment Procedures and Related Activities

13.               The auditor shall design and perform risk assessment procedures to obtain audit evidence that provides an appropriate basis for: (Ref: Para. A11–A18)

(a)                The identification and assessment of risks of material misstatement, whether due to fraud or error, at the financial report and assertion levels; and

(b)                The design of further audit procedures in accordance with ASA 330.

The auditor shall design and perform risk assessment procedures in a