Annual Audit Manual

COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.

5029 Scalability
Sep-2022

In This Section

Scalability

Scalability

CAS Guidance

The nature and extent of the required understanding is a matter of the auditor’s professional judgment and varies from entity to entity based on the nature and circumstances of the entity, including (CAS 315.A52):

  • The size and complexity of the entity, including its IT environment;
  • The auditor’s previous experience with the entity;
  • The nature of the entity’s systems and processes, including whether they are formalized or not; and
  • The nature and form of the entity’s documentation

The auditor’s risk assessment procedures to obtain the required understanding may be less extensive in audits of less complex entities and more extensive for entities that are more complex. The depth of the understanding that is required by the auditor is expected to be less than that possessed by management in managing the entity (CAS 315.A53).

Some financial reporting frameworks allow smaller entities to provide simpler and less detailed disclosures in the financial statements. However, this does not relieve the auditor of the responsibility to obtain an understanding of the entity and its environment and the applicable financial reporting framework as it applies to the entity (CAS 315.A54).

The entity’s use of IT and the nature and extent of changes in the IT environment may also affect the specialized skills that are needed to assist with obtaining the required understanding (CAS 315.A55).

The procedures undertaken to understand the entity’s measures may vary depending on the size or complexity of the entity, as well as the involvement of owners or those charged with governance in the management of the entity (CAS 315.A78).

Example:

  • For some less complex entities, the terms of the entity’s bank borrowings (i.e., bank covenants) may be linked to specific performance measures related to the entity’s performance or financial position (e.g., a maximum working capital amount). The auditor’s understanding of the performance measures used by the bank may help identify areas where there is increased susceptibility to the risk of material misstatement.

  • For some entities whose nature and circumstances are more complex, such as those operating in the insurance or banking industries, performance or financial position may be measured against regulatory requirements (e.g., regulatory ratio requirements such as capital adequacy and liquidity ratios performance hurdles). The auditor’s understanding of these performance measures may help identify areas where there is increased susceptibility to the risk of material misstatement.

OAG Guidance

When auditing less complex entities, we may be able to obtain some of our understanding of the business through our close and regular contact with management. In less complex entities, owners of the entity may be involved in managing the entity, therefore there may be little or no distinction between the owners, those charged with governance and management. This relationship often provides information regarding matters such as the following:

  • The activities of the less complex entity, its main products and services, and the industry in which it operates.

  • The style, aims, and attitudes of management and/or the owner.

  • Any plans for changes to the nature, management or ownership of the entity.

  • Business risks identified by the entity’s management and/or owners and planned strategy for addressing them.

  • Likely direct or indirect impacts of climate change on the entity.

  • Cybersecurity risks.

  • Trends in profitability or liquidity and the adequacy of working capital.

  • Legal or regulatory issues facing the entity, including its relationship with the taxation authorities.

  • Changes to the entity’s accounting policies.

  • The accounting records.

  • The control environment.

Less complex entities may not set their objectives and strategies, or manage the related business risks, through formal plans or processes. In these cases there may be no documentation of such matters, and our understanding may need to be obtained through inquiries of management.

Less complex entities may not have formal processes to measure and review the entity’s financial performance. Management nevertheless often relies on certain key indicators which knowledge and experience of the business suggest are reliable bases for evaluating financial performance and taking appropriate action.