Under ISA 315 (Revised 2019), the objective of the auditor is to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement and assertion levels, thereby providing a basis for designing and implementing responses to those assessed risks.
What Is the Difference Between Inherent Risk and Control Risk?
Risks of material misstatement at the assertion level consist of two separate components:
- Inherent risk is described as the susceptibility of an assertion about a class of transaction, account balance or disclosure to a misstatement that could be material, either individually or when aggregated with other misstatements, before consideration of any related controls.
- Control risk is described as the risk that a misstatement that could occur in an assertion about a class of transaction, account balance or disclosure and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity's controls.
The standard requires a separate assessment of inherent risk and control risk for the identified risks of material misstatement at the assertion level.
Do These Risks Cover Both Fraud and Error?
The standard states explicitly that risks of material misstatement identified and assessed by the auditor include both those due to error and those due to fraud, noting that the significance of fraud is such that further requirements and guidance are included in ISA 240.
What Are "Risk Assessment Procedures"?
The standard defines risk assessment procedures as the audit procedures designed and performed to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement and assertion levels.
What Are the "Assertions" the Auditor Relies On?
Assertions are representations, explicit or otherwise, with respect to the recognition, measurement, presentation and disclosure of information in the financial statements which are inherent in management representing that the financial statements are prepared in accordance with the applicable financial reporting framework. The auditor uses assertions to consider the different types of potential misstatements when identifying, assessing and responding to risks of material misstatement.
Does This Standard Apply to All Entities Regardless of Size?
Yes. The standard states that it is intended for audits of all entities, regardless of size or complexity, and that its application material therefore incorporates specific considerations for both less and more complex entities, where appropriate. Size alone is not necessarily an indicator of complexity.
Legal References
- ISA 315 (Revised 2019) — Identifying and Assessing the Risks of Material Misstatement, Paragraphs 4, 6, 9, 11 and 12.
For questions about your specific situation, you can ask the Private Sector Accounting Helper on Helpers, or consult a licensed chartered accountant.