5043.2 Assess risks at the financial statement level
Sep-2022

CAS Requirement

For identified risks of material misstatement at the financial statement level, the auditor shall assess the risks and (CAS 315.30):

  1. Determine whether such risks affect the assessment of risks at the assertion level; and
  2. Evaluate the nature and extent of their pervasive effect on the financial statements.

CAS 330 requires the auditor to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level. CAS 330 further explains that the auditor's assessment of the risks of material misstatement at the financial statement level, and the auditor's overall responses, is affected by the auditor's understanding of the control environment. CAS 330 also requires the auditor to design and perform further audit procedures whose nature, timing and extent are based on and are responsive to the assessed risks of material misstatement at the assertion level (CAS 315.8).

CAS Guidance

Risks of material misstatement due to fraud may be particularly relevant to the auditor's consideration of the risks of material misstatement at the financial statement level (CAS 315.A197).

Example:

The auditor understands from inquiries of management that the entity's financial statements are to be used in discussions with lenders in order to secure further financing to maintain working capital. The auditor may therefore determine that there is a greater susceptibility to misstatement due to fraud risk factors that affect inherent risk (i.e., the susceptibility of the financial statements to material misstatement because of the risk of fraudulent financial reporting, such as overstatement of assets and revenue and understatement of liabilities and expenses to ensure that financing will be obtained).

The auditor's understanding, including the related evaluations, of the control environment and other components of the system of internal control may raise doubts about the auditor's ability to obtain audit evidence on which to base the audit opinion or be cause for withdrawal from the engagement where withdrawal is possible under applicable law or regulation (CAS 315.A198).

Examples:

  • As a result of evaluating the entity's control environment, the auditor has concerns about the integrity of the entity's management, which may be so serious as to cause the auditor to conclude that the risk of intentional misrepresentation by management in the financial statements is such that an audit cannot be conducted.
  • As a result of evaluating the entity's information system and communication, the auditor determines that significant changes in the IT environment have been poorly managed, with little oversight from management and those charged with governance. The auditor concludes that there are significant concerns about the condition and reliability of the entity's accounting records. In such circumstances, the auditor may determine that it is unlikely that sufficient appropriate audit evidence will be available to support an unmodified opinion on the financial statements.

CAS 705 establishes requirements and provides guidance in determining whether there is a need for the auditor to express a qualified opinion or disclaim an opinion or, as may be required in some cases, to withdraw from the engagement where withdrawal is possible under applicable law or regulation (CAS 315.A199).

OAG Guidance

Refer to OAG Audit 5041 for guidance and examples related to identifying financial statement level risks of material misstatement. When we identify a financial statement level risk, we need to assess the level of the inherent risk based on our evaluation of the likelihood and magnitude of the potential misstatement (refer to OAG Audit 5043.3 for further guidance on this evaluation), determine if the identified financial statement level risks affect the risks of material misstatement at the FSLI assertion level and perform appropriate procedures that would be specifically responsive to the assessed risks of material misstatement for the relevant assertions.

Financial statement level risks relate pervasively to the financial statements as a whole and because they potentially affect many FSLIs at the assertion level would normally be considered either an elevated or a significant risk. Our assessment of whether an identified financial statement level risk is elevated or significant is based on our assessment of the likelihood of the misstatement occurring as a result of the risk and the magnitude of potential misstatements if they were to occur. Although inherent risk factors address the degree to which a financial statement assertion is susceptible to misstatement, there can be circumstances where consideration of inherent risk factors is helpful in assessing the level of a financial statement level risk. For example, if the entity has lost a significant number of customers, assessing the "change" inherent risk factor (i.e., low, moderate or high) may be relevant to our assessment of whether an identified 'going concern' risk is a significant financial statement level risk. See further guidance on assessing the inherent risks in OAG Audit 5043.3.

If we identify financial statement level risks of material misstatement, we need to consider if they affect our assessment of risks at the assertion level for FSLIs. In some cases we may determine that identified financial statement level risks affect specific FSLIs and associated assertions, and this would affect our risk assessment at the assertion level (e.g., we may determine that the risk associated with the related party transactions affects accuracy of revenue and this would be considered when assessing the inherent risk for the revenue FSLI, and when developing appropriate responses to the assessed risk).

When we identify financial statement level risks of material misstatement due to fraud, CAS 240.28 requires us to assess it as a significant risk.