ISA 315, Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment, para. 5 to 10 prescribes the audit risk assessment procedures and related activities.
The auditor shall perform risk assessment procedures to provide a basis for the identification and assessment of risks of material misstatement at the financial statement and assertion levels. Risk assessment procedures by themselves, however, do not provide sufficient appropriate audit evidence on which to base the audit opinion.
The risk assessment procedures shall include the following :
(a) Inquiries of management, and of others within the entity who in the auditor's judgment may have information that is likely to assist in identifying risks of material misstatement due to fraud or error. Much of the information obtained by the auditor's inquiries is obtained from management and those responsible for financial reporting. However, the auditor may also obtain information, or a different perspective in identifying risks of material misstatement, through inquiries of others within the entity and other employees with different levels of authority.
(b) Analytical procedures; the analytical procedures performed as risk assessment procedures may identify aspects of the entity of which the auditor was unaware and may assist in assessing the risk of material misstatement in order to provide a basis for designing and implementing responses to the assessed risks. Analytical procedures performed as risk assessment procedures may include both financial and non-financial information, for example, the relationship between sales and square footage of selling space or volume of goods sold.
(c) Observation and inspection; the observation and inspection procedures may support inquiries of management and others, and may also provide information about the entity and its environment. Examples of such audit procedures include observation or inspection of the following : (i) the entity's operations, (ii) documents (such as business plans and strategies), records, and internal control manuals, (iii) reports prepared by management (such as quarterly management reports and interim financial statements) and those charged with governance (such as minutes of board of directors' meetings), (iv) the entity's premises and plant facilities.
The auditor shall consider whether information obtained from the auditor's client acceptance or continuance process is relevant to identifying risks of material misstatement.
If the engagement partner has performed other engagements for the entity, the engagement partner shall consider whether information obtained is relevant to identifying risks of material misstatement.
Where the auditor intends to use information obtained from the auditor's previous experience with the entity and from audit procedures performed in previous audits, the auditor shall determine whether changes have occurred since the previous audit that may affect its relevance to the current audit. This is because changes in the control environment, for example, may affect the relevance of information obtained in the prior year. To determine whether changes have occurred that may affect the relevance of such information, the auditor may make inquiries and perform other appropriate audit procedures, such as walk-through of relevant systems.
The auditor's previous experience with the entity and audit procedures performed in previous audits may provide the auditor with information about such matters as : (i) past misstatements and whether they were corrected on a timely basis, (ii) the nature of the entity and its environment, and the entity's internal control (including deficiencies in internal control), (iii) significant changes that the entity or its operations may have undergone since the prior financial period, which may assist the auditor in gaining a sufficient understanding of the entity to identify and assess risks of material misstatement.
Further, the standard states that the engagement partner and other key engagement team members shall discuss the susceptibility of the entity's financial statements to material misstatement, and the application of the applicable financial reporting framework to the entity's facts and circumstances. The engagement partner shall determine which matters are to be communicated to engagement team members not involved in the discussion (Hrd) ***