5012.3 Develop initial expectations about risks of material misstatement and the classes of transactions, account balances and disclosures that may be significant

Sep-2022

OAG Guidance

We use the understanding obtained from initial risk assessment procedures performed to develop initial expectations about an entity’s significant FSLIs (see OAG Audit 5042) for a definition of significant FSLIs) that assists us in directing the focus of other risk assessment procedures to be performed for the purposes of planning and performing the audit. Examples of initial risk assessment procedures that provide a basis for developing the initial expectations regarding significant FSLIs include:

• Understanding the entity and its environment, including the applicable financial reporting framework and the entity’s accounting policies (OAG Audit 5020).
• Information from our previous experience with the entity and information from other sources, such as acceptance or continuance procedures, or other engagements performed by the engagement leader for the entity (OAG Audit 5011).
• Performing understanding procedures required by auditing standards other than CAS 315, including understanding of related parties, accounting estimates and the risk of fraud (See table in OAG Audit 2101).
• The results of performing risk assessment analytics based on interim financial information, budgets and/or management accounts (OAG Audit 5012.2).

Utilizing the understanding obtained from these procedures we start to consider the different types of potential misstatements that may occur in the entity’s financial statements, identifying areas where a risk of material misstatement may exist. As described in OAG Audit 5042, an FSLI is determined to be 'significant' where we identify a reasonably possible risk of material misstatement at the assertion level for an FSLI. Our preliminary assessment of significant FSLIs includes an initial evaluation of areas of risk of material misstatement that considers each of the following:

• Nature of the risk and likelihood of potential misstatement occurring - Take into account qualitative considerations such as those described in OAG Audit 5042, to the extent possible based on the understanding procedures performed thus far. For example, although at this stage we may have an initial understanding of the nature and composition of a particular class of transactions or account balance (e.g., operating expenses or accounts payable), we may not yet have a detailed understanding of areas such as the existence of related party transactions or accounting estimates made by management to be able to assess whether related parties or estimates give rise to risks of material misstatements at the assertion level.
• Our preliminary understanding may also allow us to begin to take into account the degree to which inherent risk factors affect the susceptibility of relevant assertions to misstatement (refer to OAG Audit 5043.3 for guidance on understanding and assessing inherent risk factors); and
• Magnitude of potential misstatement – Take into account our determined materiality threshold (i.e., performance materiality), potential risks of understatement and our understanding of the entity’s interim, full period and/or budgeted financial information obtained through performing risk assessment procedures, such as risk assessment analytics.

Applying this approach, we are able to develop our initial expectations about which of the entity’s FSLIs are expected to be significant and those that are not. We may also identify FSLIs which we do not expect to be significant (i.e., we do not expect the FSLIs to give rise to risks of material misstatement) but are expected to be material to the financial statements (i.e., FSLIs exceeding planning materiality, or considered qualitatively material). However, at this initial expectation stage of our risk assessment we exercise caution in reaching a conclusion that a material FSLI does not give rise to risks of material misstatement. This is because as we continue through the remainder of the required phases of the risk assessment process, we are expected to refine our understanding of the FSLI which will likely provide us with more detailed risk assessment information and could result in relevant assertions being identified for the FSLI (i.e., a reasonably possible risk of material misstatement at the assertion level). Refer to OAG Audit 5044 for guidance on FSLIs we conclude are not significant (i.e., not relevant assertions) but for which the FSLI is material to the financial statements as a whole.

We make use of our initial expectations about significant FSLIs to help direct the further risk assessment procedures to be performed, including determining the scope of the procedures to be performed to understand and evaluate the entity’s information system(s) relevant to the preparation of financial statements, including obtaining an understanding of the flow of information through these systems as required by CAS 315.25. As noted in OAG Audit 5034, we consider a business process to be significant if it relates to significant FSLIs and therefore developing an initial expectation of which FSLIs are significant allows us to identify the business processes for which we will perform procedures to understand the entity’s information systems.

When a business process relates to a material FSLI, even if we believe we may not identify any risks of material misstatement for that FSLI at the assertion level, we would perform procedures to understand and evaluate the entity’s information system(s) relevant to this business process, including determining whether the business process is of a transactional or periodic nature in line with the guidance in OAG Audit 5034. This is because we generally need an understanding of the business process underlying the material FSLI in order to consider whether there are any risks of material misstatement related to the FSLI at the assertion level. Therefore, the extent of this understanding needs to be sufficient to provide a basis for concluding whether there are any identified risks of material misstatement within the business process, but, in some cases, the level of the understanding may not need to be as extensive as for significant business processes. For example, our understanding of the information systems related to these FSLIs may be obtained predominantly from inquiries of relevant personnel about the procedures used to initiate, record, process and report transactions, supported by corroborating procedures such as inspection or observation, which would not necessarily require a walkthrough of transactions through the entire business process. Furthermore, it would be unlikely that we would identify controls within such a business process as representing controls in the controls activities component given our conclusion that no risks of material misstatement have been identified. Understanding the business process also facilitates us in identifying selected assertions and designing substantive procedures for material FSLIs that we do not assess to be significant (see OAG Audit 5042  for guidance on required substantive testing for FSLIs considered not significant but that are material).

The key elements of the process to develop initial expectations about the FSLIs that may be significant within an entity’s financial statements are illustrated below.

Because our initial expectations of significant FSLIs play a key role in identifying where we will direct additional risk assessment procedures, it is important that senior members of the engagement team are involved in obtaining the initial understanding of the entity and its environment and share their insights during the process of developing these initial expectations.

Notes

1. We exercise caution in reaching this conclusion for an FSLI as an initial expectation, as the further risk assessment procedures yet to be performed may refine our understanding of the FSLI which will likely provide us with more detailed risk assessment information and could result in relevant assertions being identified for this FSLI. Where relevant assertions are subsequently identified we would revisit the assessment as to whether the FSLI is significant (i.e., revise it to consider it a significant FSLI).
2. Where we identify a business process that relates to FSLIs that we do not expect to be significant but are material, we proceed to obtain an understanding of the information system(s) for the related business process to be able to refine our initial expectations regarding the significance of the FSLIs and reach a conclusion on significance.
3. Assuming no other significant FSLIs have been identified within the business process which would already require an understanding of the information systems to be obtained.

Documentation of auditor’s initial expectations of significant FSLIs

It is typically not necessary for our audit workpapers to separately include documentation of the initial expectations developed of identified risks and significant FSLIs. This is because our initial expectations are used only to assist in targeting our risk assessment procedures in areas where we may identify risks of material misstatement and our expectations often evolve throughout the planning stage of the engagement, to a point that they reflect our final assessments for the purpose of planning and performing the audit. It is only necessary for our final determination of identified risks and significant FSLIs to be retained in our audit workpapers.