ISA 315 (Revised 2019) and Conforming and Consequential ...

1 international Standard on Auditing 315 ( revised 2019 ) isa 315 ( revised 2019 ) and Conforming and Consequential Amendments to Other international Standards Arising from isa 315 ( revised 2019 ) Final Pronouncement December 2019 Page 2 of 202 About the IAASB This document was developed and approved by the international Auditing and Assurance Standards Board. The objective of the IAASB is to serve the public interest by setting high-quality auditing, assurance, and other related standards and by facilitating the convergence of international and national auditing and assurance standards, thereby enhancing the quality and consistency of practice throughout the world and strengthening public confidence in the global auditing and assurance profession. The IAASB develops auditing and assurance standards and guidance for use by all professional accountants under a shared standard-setting process involving the Public Interest Oversight Board, which oversees the activities of the IAASB, and the IAASB Consultative Advisory Group, which provides public interest input into the development of the standards and guidance.

2 The structures and processes that support the operations of the IAASB are facilitated by the international Federation of Accountants (IFAC). For copyright, trademark, and permissions information, please see page 201. Page 3 of 202 CONTENTS Page isa 315 ( revised 2019 ) Identifying and Assessing the Risks of Material 4 Conforming and Consequential Amendments to Other international 117 isa 315 ( revised 2019 ) Page 4 of 202 international STANDARD ON AUDITING 315 ( revised 2019 ) IDENTIFYING AND ASSESSING THE RISKS OF MATERIAL MISSTATEMENT (Effective for audits of financial statements for periods beginning on or after December 15, 2021) CONTENTS Paragraph Introduction Scope of this ISA .. 1 Key Concepts .. 2 Scalability .. 9 Effective Date .. 10 Objective .. 11 Definitions .. 12 Requirements .. Risk Assessment Pocedures and Related Activities .. 13 18 Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework and the Entity's System of Internal Control.

3 19 27 Identifying and Assessing the Risks of Material Misstatement .. 28 37 Documentation .. 38 Application and Other Explanatory Material Definitions .. A1 A10 Risk Assessment Procedures and Related Activities .. A11 A47 Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework and the Entity's System of Internal Control .. A48 A183 Identifying and Assessing the Risks of Material Misstatement .. A184 A236 Documentation .. A237 A241 isa 315 ( revised 2019 ) Page 5 of 202 Appendix 1: Considerations for Understanding the Entity and its Business Model Appendix 2: Understanding Inherent Risk Factors Appendix 3: Understanding the Entity s System of Internal Control Appendix 4: Considerations for Understanding an Entity s Internal Audit Function Appendix 5: Considerations for Understanding Information Technology (IT) Appendix 6: Considerations for Understanding General IT Controls international Standard on Auditing (ISA) 315 ( revised 2019 ), Identifying and Assessing the Risks of Material Misstatement, should be read in conjunction with ISA 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with international Standards on Auditing.

4 isa 315 ( revised 2019 ) has received the approval of the Public Interest Oversight Board (PIOB), which concluded that due process was followed in the development of the standard and that proper regard was paid to the public interest. isa 315 ( revised 2019 ) Page 6 of 202 Introduction Scope of this ISA 1. This international Standard on Auditing (ISA) deals with the auditor s responsibility to identify and assess the risks of material misstatement in the financial statements. Key Concepts in this ISA 2. ISA 200 deals with the overall objectives of the auditor in conducting an audit of the financial statements,1 including to obtain sufficient appropriate audit evidence to reduce audit risk to an acceptably low Audit risk is a function of the risks of material misstatement and detection ISA 200 explains that the risks of material misstatement may exist at two levels:4 the overall financial statement level; and the assertion level for classes of transactions, account balances and disclosures.

5 3. ISA 200 requires the auditor to exercise professional judgment in planning and performing an audit, and to plan and perform an audit with professional skepticism recognizing that circumstances may exist that cause the financial statements to be materially 4. Risks at the financial statement level relate pervasively to the financial statements as a whole and potentially affect many assertions. Risks of material misstatement at the assertion level consist of two components, inherent and control risk: Inherent risk is described as the susceptibility of an assertion about a class of transaction, account balance or disclosure to a misstatement that could be material, either individually or when aggregated with other misstatements, before consideration of any related controls. Control risk is described as the risk that a misstatement that could occur in an assertion about a class of transaction, account balance or disclosure and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity s system of internal control.

6 5. ISA 200 explains that risks of material misstatement are assessed at the assertion level in order to determine the nature, timing and extent of further audit procedures necessary to obtain sufficient appropriate audit For the identified risks of material misstatement at the assertion level, a separate assessment of inherent risk and control risk is required by this ISA. As explained in ISA 200, inherent risk is higher for some assertions and related classes of transactions, account balances 1 ISA 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with international Standards on Auditing 2 ISA 200, paragraph 17 3 ISA 200, paragraph 13(c) 4 ISA 200, paragraph A36 5 ISA 200, paragraphs 15 16 6 ISA 200, paragraph A43a and ISA 330, The Auditor s Responses to Assessed Risks, paragraph 6 isa 315 ( revised 2019 ) Page 7 of 202 and disclosures than for others.

7 The degree to which inherent risk varies is referred to in this ISA as the spectrum of inherent risk. 6. Risks of material misstatement identified and assessed by the auditor include both those due to error and those due to fraud. Although both are addressed by this ISA, the significance of fraud is such that further requirements and guidance are included in ISA 2407 in relation to risk assessment procedures and related activities to obtain information that is used to identify, assess and respond to the risks of material misstatement due to fraud. 7. The auditor s risk identification and assessment process is iterative and dynamic. The auditor s understanding of the entity and its environment, the applicable financial reporting framework, and the entity s system of internal control are interdependent with concepts within the requirements to identify and assess the risks of material misstatement. In obtaining the understanding required by this ISA, initial expectations of risks may be developed, which may be further refined as the auditor progresses through the risk identification and assessment process.

8 In addition, this ISA and ISA 330 require the auditor to revise the risk assessments, and modify further overall responses and further audit procedures, based on audit evidence obtained from performing further audit procedures in accordance with ISA 330, or if new information is obtained. 8. ISA 330 requires the auditor to design and implement overall responses to address the assessed risks of material misstatement at the financial statement ISA 330 further explains that the auditor s assessment of the risks of material misstatement at the financial statement level, and the auditor s overall responses, is affected by the auditor s understanding of the control environment. ISA 330 also requires the auditor to design and perform further audit procedures whose nature, timing and extent are based on and are responsive to the assessed risks of material misstatement at the assertion Scalability 9. ISA 200 states that some ISAs include scalability considerations which illustrate the application of the requirements to all entities regardless of whether their nature and circumstances are less complex or more This ISA is intended for audits of all entities, regardless of size or complexity and the application material therefore incorporates specific considerations specific to both less and more complex entities, where appropriate.

9 While the size of an entity may be an indicator of its complexity, some smaller entities may be complex and some larger entities may be less complex. Effective Date 10. This ISA is effective for audits of financial statements for periods beginning on or after December 15, 2021. 7 ISA 240, The Auditor s Responsibilities Relating to Fraud in an Audit of Financial Statements 8 ISA 330, paragraph 5 9 ISA 330, paragraph 6 10 ISA 200, paragraph A65a isa 315 ( revised 2019 ) Page 8 of 202 Objective 11. The objective of the auditor is to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement and assertion levels thereby providing a basis for designing and implementing responses to the assessed risks of material misstatement. Definitions 12. For purposes of the ISAs, the following terms have the meanings attributed below: (a) Assertions Representations, explicit or otherwise, with respect to the recognition, measurement, presentation and disclosure of information in the financial statements which are inherent in management representing that the financial statements are prepared in accordance with the applicable financial reporting framework.

10 Assertions are used by the auditor to consider the different types of potential misstatements that may occur when identifying, assessing and responding to the risks of material misstatement. (Ref: Para. A1) (b) Business risk A risk resulting from significant conditions, events, circumstances, actions or inactions that could adversely affect an entity s ability to achieve its objectives and execute its strategies, or from the setting of inappropriate objectives and strategies. (c) Controls Policies or procedures that an entity establishes to achieve the control objectives of management or those charged with governance. In this context: (Ref: Para. A2 A5) (i) Policies are statements of what should, or should not, be done within the entity to effect control. Such statements may be documented, explicitly stated in communications, or implied through actions and decisions. (ii) Procedures are actions to implement policies. (d) General information technology (IT) controls Controls over the entity s IT processes that support the continued proper operation of the IT environment, including the continued effective functioning of information processing controls and the integrity of information ( , the completeness, accuracy and validity of information) in the entity s information system.