7073.1 Step 1: Perform Risk Assessment Procedures

Sep-2022

CAS Guidance

The entity’s information system relating to accounting estimates

The significant classes of transactions, events and conditions within the scope of paragraph 13(h) are the same as the significant classes of transactions, events and conditions relating to accounting estimates and related disclosures that are subject to paragraph 25(a) of CAS 315. In obtaining the understanding of the entity’s information system as it relates to accounting estimates, the auditor may consider (CAS 540.A34):

• Whether the accounting estimates arise from the recording of routine and recurring transactions or whether they arise from non‑recurring or unusual transactions.
• How the information system addresses the completeness of accounting estimates and related disclosures, in particular for accounting estimates related to liabilities.

During the audit, the auditor may identify classes of transactions, events or conditions that give rise to the need for accounting estimates and related disclosures that management failed to identify. CAS 315 deals with circumstances where the auditor identifies risks of material misstatement that management failed to identify, including considering the implications for the auditor’s evaluation of the entity’s risk assessment process (CAS 540.A35).

Management’s Identification of the Relevant Methods, Assumptions and Sources of Data

If management has changed the method for making an accounting estimate, considerations may include whether the new method is, for example, more appropriate, is itself a response to changes in the environment or circumstances affecting the entity, or to changes in the requirements of the applicable financial reporting framework or regulatory environment, or whether management has another valid reason (CAS 540.A36).

If management has not changed the method for making an accounting estimate, considerations may include whether the continued use of the previous methods, assumptions and data is appropriate in view of the current environment or circumstances (CAS 540.A37).

CAS Guidance

Methods

The applicable financial reporting framework may prescribe the method to be used in making an accounting estimate. In many cases, however, the applicable financial reporting framework does not prescribe a single method, or the required measurement basis prescribes, or allows, the use of alternative methods (CAS 540.A38).

Models

Management may design and implement specific controls around models used for making accounting estimates, whether management’s own model or an external model. When the model itself has an increased level of complexity or subjectivity, such as an expected credit loss model or a fair value model using level 3 inputs, controls that address such complexity or subjectivity may be more likely to be identified controls in accordance with CAS 315. When complexity in relation to models is present, controls over data integrity are also more likely to be identified controls in accordance with CAS 315. Factors that may be appropriate for the auditor to consider in obtaining an understanding of the model and related identified controls include the following (CAS 540.A39):

• How management determines the relevance and accuracy of the model;
• The validation or back testing of the model, including whether the model is validated prior to use and revalidated at regular intervals to determine whether it remains suitable for its intended use. The entity’s validation of the model may include evaluation of:
  • The model’s theoretical soundness;
  • The model’s mathematical integrity; and
  • The accuracy and completeness of the data and the appropriateness of data and assumptions used in the model;
• How the model is appropriately changed or adjusted on a timely basis for changes in market or other conditions and whether there are appropriate change control policies over the model;
• Whether adjustments, also referred to as overlays in certain industries, are made to the output of the model and whether such adjustments are appropriate in the circumstances in accordance with the requirements of the applicable financial reporting framework. When the adjustments are not appropriate, such adjustments may be indicators of possible management bias; and
• Whether the model is adequately documented, including its intended applications, limitations, key parameters, required data and assumptions, the results of any validation performed on it and the nature of, and basis for, any adjustments made to its output.

CAS Guidance

Assumptions

Matters that the auditor may consider in obtaining an understanding of how management selected the assumptions used in making the accounting estimates include, for example (CAS 540.A40):

• The basis for management’s selection and the documentation supporting the selection of the assumption. The applicable financial reporting framework may provide criteria or guidance to be used in the selection of an assumption.
• How management assesses whether the assumptions are relevant and complete.
• When applicable, how management determines that the assumptions are consistent with each other, with those used in other accounting estimates or areas of the entity’s business activities, or with other matters that are:
  • Within the control of management (for example, assumptions about the maintenance programs that may affect the estimation of an asset’s useful life), and whether they are consistent with the entity’s business plans and the external environment; and
  • Outside the control of management (for example, assumptions about interest rates, mortality rates or potential judicial or regulatory actions).
• The requirements of the applicable financial reporting framework related to the disclosure of assumptions

With respect to fair value accounting estimates, assumptions vary in terms of the sources of the data and the basis for the judgments to support them, as follows (CAS 540.A41):

(a) Those that reflect what marketplace participants would use in pricing an asset or liability, developed based on market data obtained from sources independent of the reporting entity.

(b) Those that reflect the entity’s own judgments about what assumptions marketplace participants would use in pricing the asset or liability, developed based on the best data available in the circumstances.

In practice, however, the distinction between (a) and (b) may not always be apparent and distinguishing between them depends on understanding the sources of data and the basis for the judgments that support the assumption. Further, it may be necessary for management to select from a number of different assumptions used by different marketplace participants.

Assumptions used in making an accounting estimate are referred to as significant assumptions in this CAS if a reasonable variation in the assumption would materially affect the measurement of the accounting estimate. A sensitivity analysis may be useful in demonstrating the degree to which the measurement varies based on one or more assumptions used in making the accounting estimate (CAS 540.A42).

Inactive or illiquid markets

When markets are inactive or illiquid, the auditor’s understanding of how management selects assumptions may include understanding whether management has (CAS 540.A43):

• Implemented appropriate policies for adapting the application of the method in such circumstances. Such adaptation may include making model adjustments or developing new models that are appropriate in the circumstances;
• Resources with the necessary skills or knowledge to adapt or develop a model, if necessary on an urgent basis, including selecting the valuation technique that is appropriate in such circumstances;
• The resources to determine the range of outcomes, given the uncertainties involved, for example by performing a sensitivity analysis;
• The means to assess how, when applicable, the deterioration in market conditions has affected the entity’s operations, environment and relevant business risks and the implications for the entity’s accounting estimates, in such circumstances; and
• An appropriate understanding of how the price data, and the relevance thereof, from particular external information sources may vary in such circumstances.

CAS Guidance

Data

Matters that the auditor may consider in obtaining an understanding of how management selects the data on which the accounting estimates are based include (CAS 540.A44):

• The nature and source of the data, including information obtained from an external information source.
• How management evaluates whether the data is appropriate.
• The accuracy and completeness of the data.
• The consistency of the data used with data used in previous periods.
• The complexity of IT applications or other aspects of the entity’s IT environment used to obtain and process the data, including when this involves handling large volumes of data.
• How the data is obtained, transmitted and processed and how its integrity is maintained.

CAS Guidance

How management understands and addresses estimation uncertainty

Matters that may be appropriate for the auditor to consider relating to whether and how management understands the degree of estimation uncertainty include, for example (CAS 540.A45):

• Whether, and if so, how management identified alternative methods, significant assumptions or sources of data that are appropriate in the context of the applicable financial reporting framework.
• Whether, and if so, how management considered alternative outcomes by, for example, performing a sensitivity analysis to determine the effect of changes in the significant assumptions or the data used in making the accounting estimate.

The requirements of the applicable financial reporting framework may specify the approach to selecting management’s point estimate from the reasonably possible measurement outcomes. Financial reporting frameworks may recognize that the appropriate amount is one that is appropriately selected from the reasonably possible measurement outcomes and, in some cases, may indicate that the most relevant amount may be in the central part of that range (CAS 540.A46).

For example, with respect to fair value estimates, IFRS 13 indicates that, if multiple valuation techniques are used to measure fair value, the results (i.e., respective indications of fair value) shall be evaluated considering the reasonableness of the range of values indicated by those results. A fair value measurement is the point within that range that is most representative of fair value in the circumstances. In other cases, the applicable financial reporting framework may specify the use of a probability-weighted average of the reasonably possible measurement outcomes, or of the measurement amount that is most likely or that is more likely than not (CAS 540.A47).

The applicable financial reporting framework may prescribe disclosures or disclosure objectives related to accounting estimates, and some entities may choose to disclose additional information. These disclosures or disclosure objectives may address, for example (CAS 540.A48):

• The method of estimation used, including any applicable model and the basis for its selection.
• Information that has been obtained from models, or from other calculations used to determine estimates recognized or disclosed in the financial statements, including information relating to the underlying data and assumptions used in those models, such as:
  • Assumptions developed internally; or
  • Data, such as interest rates, that are affected by factors outside the control of the entity.
• The effect of any changes to the method of estimation from the prior period.
• The sources of estimation uncertainty.
• Fair value information.
• Information about sensitivity analyses derived from financial models that demonstrates that management has considered alternative assumptions.

In some cases, the applicable financial reporting framework may require specific disclosures regarding estimation uncertainty, for example (CAS 540.A49):

• The disclosure of information about the assumptions made about the future and other major sources of estimation uncertainty that give rise to a higher likelihood or magnitude of material adjustment to the carrying amounts of assets and liabilities after the period end. Such requirements may be described using terms such as “Key Sources of Estimation Uncertainty” or “Critical Accounting Estimates.” They may relate to accounting estimates that require management’s most difficult, subjective or complex judgments. Such judgments may be more subjective and complex, and accordingly the potential for a consequential material adjustment to the carrying amounts of assets and liabilities may increase, with the number of items of data and assumptions affecting the possible future resolution of the estimation uncertainty. Information that may be disclosed includes:
  • The nature of the assumption or other source of estimation uncertainty;
  • The sensitivity of carrying amounts to the methods and assumptions used, including the reasons for the sensitivity;
  • The expected resolution of an uncertainty and the range of reasonably possible outcomes in respect of the carrying amounts of the assets and liabilities affected; and
  • An explanation of changes made to past assumptions concerning those assets and liabilities, if the uncertainty remains unresolved.
• The disclosure of the range of possible outcomes, and the assumptions used in determining the range.
• The disclosure of specific information, such as:
  • Information regarding the significance of fair value accounting estimates to the entity’s financial position and performance; and
  • Disclosures regarding market inactivity or illiquidity.
• Qualitative disclosures such as the exposures to risk and how they arise, the entity’s objectives, policies and procedures for managing the risk and the methods used to measure the risk and any changes from the previous period of these qualitative concepts.
• Quantitative disclosures such as the extent to which the entity is exposed to risk, based on information provided internally to the entity’s key management personnel, including credit risk, liquidity risk and market risk.

CAS Guidance

The auditor’s judgment in identifying controls in the control activities component, and therefore the need to evaluate the design of those controls and determine whether they have been implemented, relates to management’s process described in paragraph 13(h)(ii). The auditor may not identify controls in relation to all aspects of paragraph 13(h)(ii) (CAS 540.A50).

As part of identifying the controls, and evaluating their design and determining whether they have been implemented, the auditor may consider (CAS 540.A51):

• How management determines the appropriateness of the data used to develop the accounting estimates, including when management uses an external information source or data from outside the general and subsidiary ledgers.
• The review and approval of accounting estimates, including the assumptions or data used in their development, by appropriate levels of management and, where appropriate, those charged with governance.
• The segregation of duties between those responsible for making the accounting estimates and those committing the entity to the related transactions, including whether the assignment of responsibilities appropriately takes account of the nature of the entity and its products or services. For example, in the case of a large financial institution, relevant segregation of duties may consist of an independent function responsible for estimation and validation of fair value pricing of the entity’s financial products staffed by individuals whose remuneration is not tied to such products.
• The effectiveness of the design of the controls. Generally, it may be more difficult for management to design controls that address subjectivity and estimation uncertainty in a manner that effectively prevents, or detects and corrects, material misstatements, than it is to design controls that address complexity. Controls that address subjectivity and estimation uncertainty may need to include more manual elements, which may be less reliable than automated controls as they can be more easily bypassed, ignored or overridden by management. The design effectiveness of controls addressing complexity may vary depending on the reason for, and the nature of, the complexity. For example, it may be easier to design more effective controls related to a method that is routinely used or over the integrity of data.

When management makes extensive use of information technology in making an accounting estimate, identified controls in the control activities component are likely to include general IT controls and information processing controls. Such controls may address risks related to (CAS 540.A52):

• Whether the IT applications or other aspects of the IT environment have the capability and are appropriately configured to process large volumes of data;
• Complex calculations in applying a method. When diverse IT applications are required to process complex transactions, regular reconciliations between the IT applications are made, in particular when the IT applications do not have automated interfaces or may be subject to manual intervention;
• Whether the design and calibration of models is periodically evaluated;
• The complete and accurate extraction of data regarding accounting estimates from the entity’s records or from external information sources;
• Data, including the complete and accurate flow of data through the entity’s information system, the appropriateness of any modification to the data used in making accounting estimates, the maintenance of the integrity and security of the data.
• When using external information sources, risks related to processing or recording the data;
• Whether management has controls around access, change and maintenance of individual models to maintain a strong audit trail of the accredited versions of models and to prevent unauthorized access or amendments to those models; and
• Whether there are appropriate controls over the transfer of information relating to accounting estimates into the general ledger, including appropriate controls over journal entries.

In some industries, such as banking or insurance, the term governance may be used to describe activities within the control environment, the entity’s process to monitor the system of internal control, and other components of the system of internal control, as described in CAS 315 (CAS 540.A53).

For entities with an internal audit function, its work may be particularly helpful to the auditor in obtaining an understanding of (CAS 540.A54):

• The nature and extent of management’s use of accounting estimates;
• The design and implementation of controls that address the risks related to the data, assumptions and models used to make the accounting estimates;
• The aspects of the entity’s information system that generate the data on which the accounting estimates are based; and
• How new risks relating to accounting estimates are identified, assessed and managed.

CAS Guidance

A review of the outcome or re‑estimation of previous accounting estimates (retrospective review) assists in identifying and assessing the risks of material misstatement when previous accounting estimates have an outcome through transfer or realization of the asset or liability in the current period, or are re‑estimated for the purpose of the current period. Through performing a retrospective review, the auditor may obtain (CAS 540.A55):

• Information regarding the effectiveness of management’s previous estimation process, from which the auditor can obtain audit evidence about the likely effectiveness of management’s current process
• Audit evidence of matters, such as the reasons for changes that may be required to be disclosed in the financial statements.
• Information regarding the complexity or estimation uncertainty pertaining to the accounting estimates.
• Information regarding the susceptibility of accounting estimates to, or that may be an indicator of, possible management bias. The auditor’s professional skepticism assists in identifying such circumstances or conditions and in determining the nature, timing and extent of further audit procedures.

A retrospective review may provide audit evidence that supports the identification and assessment of the risks of material misstatement in the current period. Such a retrospective review may be performed for accounting estimates made for the prior period’s financial statements or may be performed over several periods or a shorter period (such as half-yearly or quarterly). In some cases, a retrospective review over several periods may be appropriate when the outcome of an accounting estimate is resolved over a longer period (CAS 540.A56).

A retrospective review of management judgments and assumptions related to significant accounting estimates is required by CAS 240. As a practical matter, the auditor’s review of previous accounting estimates as a risk assessment procedure in accordance with this CAS may be carried out in conjunction with the review required by CAS 240 (CAS 540.A57).

Based on the auditor’s previous assessment of the risks of material misstatement, for example, if inherent risk is assessed as higher for one or more risks of material misstatement, the auditor may judge that a more detailed retrospective review is required. As part of the detailed retrospective review, the auditor may pay particular attention, when practicable, to the effect of data and significant assumptions used in making the previous accounting estimates. On the other hand, for example, for accounting estimates that arise from the recording of routine and recurring transactions, the auditor may judge that the application of analytical procedures as risk assessment procedures is sufficient for purposes of the review (CAS 540.A58).

The measurement objective for fair value accounting estimates and other accounting estimates, based on current conditions at the measurement date, deals with perceptions about value at a point in time, which may change significantly and rapidly as the environment in which the entity operates changes. The auditor may therefore focus the review on obtaining information that may be relevant to identifying and assessing risks of material misstatement. For example, in some cases, obtaining an understanding of changes in marketplace participant assumptions that affected the outcome of a previous period’s fair value accounting estimates may be unlikely to provide relevant audit evidence. In this case, audit evidence may be obtained by understanding the outcomes of assumptions (such as a cash flow projections) and understanding the effectiveness of management’s prior estimation process that supports the identification and assessment of the risks of material misstatement in the current period (CAS 540.A59).

A difference between the outcome of an accounting estimate and the amount recognized in the previous period’s financial statements does not necessarily represent a misstatement of the previous period’s financial statements. However, such a difference may represent a misstatement if, for example, the difference arises from information that was available to management when the previous period’s financial statements were finalized, or that could reasonably be expected to have been obtained and taken into account in the context of the applicable financial reporting framework. Such a difference may call into question management’s process for taking information into account in making the accounting estimate. As a result, the auditor may reassess any plan to test related controls and the related assessment of control risk or may determine that more persuasive audit evidence needs to be obtained about the matter. Many financial reporting frameworks contain guidance on distinguishing between changes in accounting estimates that constitute misstatements and changes that do not, and the accounting treatment required to be followed in each case (CAS 540.A60).

CAS Guidance

Assumptions

Assumptions used in making an accounting estimate are referred to as significant assumptions in this CAS if a reasonable variation in the assumption would materially affect the measurement of the accounting estimate. A sensitivity analysis may be useful in demonstrating the degree to which the measurement varies based on one or more assumptions used in making the accounting estimate (CAS 540.A42).

Inactive or illiquid markets

When markets are inactive or illiquid, the auditor’s understanding of how management selects assumptions may include understanding whether management has (CAS 540.A43):

• Implemented appropriate policies for adapting the application of the method in such circumstances. Such adaptation may include making model adjustments or developing new models that are appropriate in the circumstances;
• Resources with the necessary skills or knowledge to adapt or develop a model, if necessary on an urgent basis, including selecting the valuation technique that is appropriate in such circumstances;
• The resources to determine the range of outcomes, given the uncertainties involved, for example by performing a sensitivity analysis;
• The means to assess how, when applicable, the deterioration in market conditions has affected the entity’s operations, environment and relevant business risks and the implications for the entity’s accounting estimates, in such circumstances; and
• An appropriate understanding of how the price data, and the relevance thereof, from particular external information sources may vary in such circumstances.

How management understands and addresses estimation uncertainty

Matters that may be appropriate for the auditor to consider relating to whether and how management understands the degree of estimation uncertainty include, for example (CAS 540.A45):

• Whether, and if so, how management identified alternative methods, significant assumptions or sources of data that are appropriate in the context of the applicable financial reporting framework.
• Whether, and if so, how management considered alternative outcomes by, for example, performing a sensitivity analysis to determine the effect of changes in the significant assumptions or the data used in making the accounting estimate.

Significant assumptions

Management may evaluate alternative assumptions or outcomes of accounting estimates, which may be accomplished through a number of approaches depending on the circumstances. One possible approach is a sensitivity analysis. This might involve determining how the monetary amount of an accounting estimate varies with different assumptions. Even for accounting estimates measured at fair value, there may be variation because different market participants will use different assumptions. A sensitivity analysis may lead to the development of a number of outcome scenarios, sometimes characterized as a range of outcomes by management, and including ‘pessimistic’ and ‘optimistic’ scenarios (CAS 540.A103).

When Management Has Not Taken Appropriate Steps to Understand and Address Estimation Uncertainty

When the auditor determines that management has not taken appropriate steps to understand and address estimation uncertainty, additional procedures that the auditor may request management to perform to understand estimation uncertainty may include, for example, consideration of alternative assumptions or the performance of a sensitivity analysis (CAS 540.A115).