Assessment of significant risk
When exercising this judgement, the auditor should also consider the requirements of ISA 315 (Revised) Understanding the entity and its environment. ISA 315 (Revised) explains that, as part of the identification and assessment of risks at the financial statement and assertion level, the auditor should consider at least the following:
- whether the risk is a risk of fraud;
- whether the risk relates to a significant economic, accounting or other development that, as a result, requires specific attention;
- the level of complexity;
- the involvement of significant transactions with related parties;
- the level of subjectivity, including the level of estimation uncertainty; and
- whether the risk involves significant transactions that are outside the normal course of business.
There is a clear link between some of the above items and the inherent risk factors identified in ISA 540 (Revised). The assessment of inherent risk at the assertion level in ISA 540 (Revised) is intended to help the auditor in determining whether the risks of material misstatement identified in relation to accounting estimates give rise to a significant risk.
| Example: For many estimates there are standard valuation models available on the market, reducing the level of complexity within the estimate to the lower end of the spectrum. However, the estimate here is forward looking and requires some judgement over the inputs, creating increased estimation uncertainty. The auditor is also aware that management has limited experience in making these judgements, as the accounting estimate is an item that is only considered once a year that is also outside the normal course of business. The estimation uncertainty and the fact that this is outside the normal course of business are likely to move the assessment of inherent risk up the spectrum of inherent risk. As such, the auditor may consider that management’s lack of experience in considering this accounting estimate, lack of knowledge regarding where to obtain appropriate information to support the assumptions and the judgement is a risk that therefore requires special audit consideration. |
In determining whether an identified risk is a significant risk it is also important to consider whether the accounting estimate may also cast significant doubt on the entity’s ability to continue as a going concern. Examples of when this may be relevant include:
- the impairment of a significant asset (which could, for example, result in a loan covenant being breached); or
- litigation (where, for example, the estimated cost of settling the litigation is significant compared to the entity’s potential available cash resources).
Impact of identifying significant risk for accounting estimates
When an accounting estimate has been assessed as a significant risk, it is important for the auditor to remember that ISA 315 (Revised) and ISA 540 (Revised) require an understanding of the entity’s controls, including the control activities, to be obtained. This also includes whether and how management responds to the risks. For judgemental areas, such as accounting estimates, these responses may include:
- control activities in place over the accounting estimate, such as the review of assumptions by an expert or senior management;
- documented processes in place for estimates; and
- approval by those charged with governance of the estimate, including an understanding of the approach applied and the resulting balance.
Finally, in response to a significant risk, the auditor should be mindful of the further audit procedures that are required under ISA 540 (Revised) and the need for them to be responsive to the risks identified and assessed. Based on the procedures performed the auditor needs to consider whether sufficient appropriate audit evidence has been obtained in accordance with ISA 500 Audit evidence. In making this determination, the auditor considers both corroborative and contradictory audit evidence. It is also important to remember that where the auditor determines that substantive procedures alone provide sufficient and appropriate audit evidence these procedures must include a test of detail. Examples of tests of detail for significant risks related to accounting estimates may include:
- examining contracts to corroborate terms or assumptions;
- verifying the mathematical accuracy of a model by recalculation; or
- agreeing assumptions to supporting documentation such as published information from third parties.
If substantive audit procedures alone do not provide sufficient and appropriate audit evidence a test of controls must be performed.
