5504 Risk Assessment and Related Activities

Sep-2022

CAS Guidance

Maintaining professional skepticism requires an ongoing questioning of whether the information and audit evidence obtained suggests that a material misstatement due to fraud may exist. It includes considering the reliability of the information to be used as audit evidence and identified controls in the control activities component, if any, over its preparation and maintenance. Due to the characteristics of fraud, the auditor’s professional skepticism is particularly important when considering the risks of material misstatement due to fraud (CAS 240.A8).

Although the auditor cannot be expected to disregard past experience of the honesty and integrity of the entity’s management and those charged with governance, the auditor’s professional skepticism is particularly important in considering the risks of material misstatement due to fraud because there may have been changes in circumstances (CAS 240.A9).

An audit performed in accordance with CASs rarely involves the authentication of documents, nor is the auditor trained as or expected to be an expert in such authentication. However, when the auditor identifies conditions that cause the auditor to believe that a document may not be authentic or that terms in a document have been modified but not disclosed to the auditor, possible procedures to investigate further may include (CAS 240.A10):

• Confirming directly with the third party.
• Using the work of an expert to assess the document’s authenticity.

CAS Guidance

Management’s Assessment of the Risk of Material Misstatement Due to Fraud

Management accepts responsibility for the entity’s internal control and for the preparation of the entity’s financial statements. Accordingly, it is appropriate for the auditor to make inquiries of management regarding management’s own assessment of the risk of fraud and the controls in place to prevent and detect it. The nature, extent and frequency of management’s assessment of such risk and controls may vary from entity to entity. In some entities, management may make detailed assessments on an annual basis or as part of continuous monitoring. In other entities, management’s assessment may be less structured and less frequent. The nature, extent and frequency of management’s assessment are relevant to the auditor’s understanding of the entity’s control environment. For example, the fact that management has not made an assessment of the risk of fraud may in some circumstances be indicative of the lack of importance that management places on internal control (CAS 240.A13).

Management’s Process for Identifying and Responding to the Risks of Fraud

In the case of entities with multiple locations management’s processes may include different levels of monitoring of operating locations, or business segments. Management may also have identified particular operating locations or business segments for which a risk of fraud may be more likely to exist (CAS 240.A15).

Inquiry of Management and Others within the Entity

The auditor’s inquiries of management may provide useful information concerning the risks of material misstatements in the financial statements resulting from employee fraud. However, such inquiries are unlikely to provide useful information regarding the risks of material misstatement in the financial statements resulting from management fraud. Making inquiries of others within the entity may provide individuals with an opportunity to convey information to the auditor that may not otherwise be communicated (CAS 240.A16).

Examples of others within the entity to whom the auditor may direct inquiries about the existence or suspicion of fraud include (CAS 240.A17):

• Operating personnel not directly involved in the financial reporting process.

• Employees with different levels of authority.

• Employees involved in initiating, processing or recording complex or unusual transactions and those who supervise or monitor such employees.

• In-house legal counsel.

• Chief ethics officer or equivalent person.

• The person or persons charged with dealing with allegations of fraud.

Management is often in the best position to perpetrate fraud. Accordingly, when evaluating management’s responses to inquiries with an attitude of professional skepticism, the auditor may judge it necessary to corroborate responses to inquiries with other information (CAS 240.A18).

In some entities, particularly smaller entities, the focus of management’s assessment may be on the risks of employee fraud or misappropriation of assets. (CAS 240.A14)

CAS Guidance

CAS 315 and CAS 610 establish requirements and provide guidance relevant to audits of those entities that have an internal audit function. In carrying out the requirements of those CASs in the context of fraud, the auditor may inquire about specific activities of the function including, for example (CAS 240.A19):

• The procedures performed, if any, by the internal audit function during the year to detect fraud.
• Whether management has satisfactorily responded to any findings resulting from those procedures.

CAS Guidance

Obtaining an Understanding of Oversight Exercised by Those Charged With Governance

Those charged with governance of an entity oversee the entity’s systems for monitoring risk, financial control and compliance with the law. In many countries, corporate governance practices are well developed and those charged with governance play an active role in oversight of the entity’s assessment of the risks of fraud and the controls that address such risks. Since the responsibilities of those charged with governance and management may vary by entity and by country, it is important that the auditor understands their respective responsibilities to enable the auditor to obtain an understanding of the oversight exercised by the appropriate individuals (CAS 240.A20).

CAS 260 discusses with whom the auditor communicates when the entity’s governance structure is not well defined.

An understanding of the oversight exercised by those charged with governance may provide insights regarding the susceptibility of the entity to management fraud, the adequacy of controls that address risks of fraud, and the competency and integrity of management. The auditor may obtain this understanding in a number of ways, such as by attending meetings where such discussions take place, reading the minutes from such meetings or making inquiries of those charged with governance (CAS 240.A21).

CAS Guidance

In addition to information obtained from applying analytical procedures, other information obtained about the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control may be helpful in identifying the risks of material misstatement due to fraud. The discussion among team members may provide information that is helpful in identifying such risks. In addition, information obtained from the auditor’s client acceptance and retention processes, and experience gained on other engagements performed for the entity, for example engagements to review interim financial information, may be relevant in the identification of the risks of material misstatement due to fraud (CAS 240.A23).

CAS Guidance

The fact that fraud is usually concealed can make it very difficult to detect. Nevertheless, the auditor may identify events or conditions that indicate an incentive or pressure to commit fraud or provide an opportunity to commit fraud (fraud risk factors). For example (CAS 240.A24):

• The need to meet expectations of third parties to obtain additional equity financing may create pressure to commit fraud;

• The granting of significant bonuses if unrealistic profit targets are met may create an incentive to commit fraud; and

• A control environment that is not effective may create an opportunity to commit fraud.

Fraud risk factors cannot easily be ranked in order of importance. The significance of fraud risk factors varies widely. Some of these factors will be present in entities where the specific conditions do not present risks of material misstatement. Accordingly, the determination of whether a fraud risk factor is present and whether it is to be considered in assessing the risks of material misstatement of the financial statements due to fraud requires the exercise of professional judgment (CAS 240.A25).

Examples of fraud risk factors related to fraudulent financial reporting and misappropriation of assets are presented in Appendix 1 [This appendix is included as section 5502]. These illustrative risk factors are classified based on the three conditions that are generally present when fraud exists (CAS 240.A26):

• An incentive or pressure to commit fraud;
• A perceived opportunity to commit fraud; and
• An ability to rationalize the fraudulent action.

Fraud risk factors may relate to incentives, pressures or opportunities that arise from conditions that create susceptibility to misstatement, before consideration of controls. Fraud risk factors, which include intentional management bias, are, insofar as they affect inherent risk, inherent risk factors. Fraud risk factors may also relate to conditions within the entity’s system of internal control that provide opportunity to commit fraud or that may affect management’s attitude or ability to rationalize fraudulent actions. Fraud risk factors reflective of an attitude that permits rationalization of the fraudulent action may not be susceptible to observation by the auditor. Nevertheless, the auditor may become aware of the existence of such information through, for example, the required understanding of the entity’s control environment. Although the fraud risk factors described in Appendix 1 [This appendix is included as section 5502] cover a broad range of situations that may be faced by auditors, they are only examples and other risk factors may exist.

The size, complexity, and ownership characteristics of the entity have a significant influence on the consideration of relevant fraud risk factors. For example, in the case of a large entity, there may be factors that generally constrain improper conduct by management, such as (CAS 240.A27):

• Effective oversight by those charged with governance.
• An effective internal audit function.
• The existence and enforcement of a written code of conduct.

Furthermore, fraud risk factors considered at a business segment operating level may provide different insights when compared with those obtained when considered at an entity‑wide level.

CAS Guidance

In some cases, all of those charged with governance are involved in managing the entity. This may be the case in a small entity where a single owner manages the entity and no one else has a governance role. In these cases, there is ordinarily no action on the part of the auditor because there is no oversight separate from management (CAS 240.A22).

In the case of a small entity, some or all of these considerations may be inapplicable or less relevant. For example, a smaller entity may not have a written code of conduct but, instead, may have developed a culture that emphasizes the importance of integrity and ethical behavior through oral communication and by management example. Domination of management by a single individual in a small entity does not generally, in and of itself, indicate a failure by management to display and communicate an appropriate attitude regarding internal control and the financial reporting process. In some entities, the need for management authorization can compensate for otherwise deficient controls and reduce the risk of employee fraud. However, domination of management by a single individual can be a potential deficiency in internal control since there is an opportunity for management override of controls (CAS 240.A28).