In this topic 7 sections
Make the response traceable to the risk
Risk assessment leads to action at two levels. Pervasive financial statement risks affect the overall conduct of the audit: staff experience, specialist involvement, supervision, scepticism, unpredictability and the timing or breadth of work. Assertion-level risks require procedures aimed at the specific way an amount or disclosure could be wrong.
For suspected earnings manipulation, examine the accounting choices and complex arrangements creating the opportunity. More of the same internal evidence may be less persuasive than independent corroboration when management can alter the records. Analytics can help target unusual patterns, but a flagged item requires investigation and an unflagged population does not automatically provide sufficient evidence.
Nature, timing and extent are connected
| Decision | Meaning | Application |
|---|---|---|
| Nature | The purpose and type of procedure. | Choose control testing or substantive work, then inspection, confirmation, recalculation, reperformance or analysis suited to the assertion. |
| Timing | When work is performed and the period it supports. | Decide whether interim evidence can be extended to year-end or whether work is needed at year-end. |
| Extent | How much work is performed. | Select the number of items, observations, locations or periods needed for the assurance sought. |
Concept sources: ASA 330, December 2021 compilation, paragraphs 5–7 and A4–A8 — original decision table.
Higher risk calls for more persuasive evidence, not simply larger samples. A larger test of an irrelevant attribute cannot resolve the risk. Define the account or disclosure, assertion, possible misstatement and evidence needed before deciding sample size.
Choose an approach for each risk
A combined approach uses evidence that controls operated effectively together with substantive procedures. Successful control testing can support less extensive substantive work or different timing for the relevant assertions. A predominantly substantive approach places little or no reliance on controls in designing further work. Different cycles and assertions can justify different combinations; the decision is not necessarily made once for the entire entity.
- Define the assertion risk
- Evaluate relevant controls
- Decide whether control reliance is planned or necessary
- Test controls where required
- Perform responsive substantive procedures
- Reassess risks and evidence
Concept sources: ASA 330, paragraphs 8, 18 and 25–27 — original response sequence.
Tests of controls are required when reliance is planned or when substantive work alone cannot supply sufficient appropriate evidence. The latter may arise where transactions exist only within automated processing. Calling control risk “high” does not remove that evidence problem.
The revised risk model assesses inherent risk separately. Without planned control testing, the assessed risk of material misstatement equals the inherent-risk assessment; it is not reduced merely because controls look good. ASA 315, paragraph 34.
Obtain evidence that supports reliance
Control tests examine how a control operated, who or what performed it and its consistency over the relevant period. Include dependent controls where necessary. Enquiry requires supporting procedures. A clean substantive result does not prove related controls worked.
Interim testing needs evidence about significant subsequent changes and the remaining period. Earlier audits' evidence can sometimes be used after checking continuing relevance and reliability. Changed controls affecting that evidence need current testing. For unchanged controls eligible for rotation, test at least once every third audit and test some controls each audit. This is conditional permission, not a standard three-year exemption. Controls relied on for significant risks must be tested in the current period.
If deviations appear, investigate their cause and consequences. Decide whether existing tests still support reliance, whether further control testing is useful or whether substantive work must change. Reassess the risks rather than preserving the original strategy for convenience.
Substantive procedures remain essential
Substantive procedures seek misstatements in transactions, balances and disclosures. Tests of details examine specific supporting evidence or calculations. Substantive analytical procedures evaluate sufficiently predictable relationships using reliable data and an appropriately precise expectation. Planning analytics identify risks; their purpose alone does not make them substantive evidence.
Inspecting whether a purchase was approved is a control test. Inspecting the invoice and receipt evidence to establish the amount and period of the purchase is substantive. One item can support a dual-purpose test, but design and evaluate the two purposes separately.
Substantive work is required for every material class of transactions, balance and disclosure irrespective of assessed risk. For a significant risk, it must be specifically responsive; when the response consists only of substantive procedures, include tests of details. This does not mean every significant-risk response must exclude analytical procedures. ASA 330, paragraphs 18 and 21.
Interim substantive work must be extended to the remaining period with further substantive procedures, or a combination of substantive procedures and control tests. Weak controls or high risk may favour work closer to year-end. Unexpected misstatements can require changing planned procedures and reconsidering the assessment.
Closing work also connects the financial statements and disclosures to underlying records and examines material journals and other preparation adjustments. Document the link from each assessed risk to the work performed, its results and the conclusions reached. This makes later changes to the strategy understandable and reviewable.
Adapt the approach to a smaller entity
A small population and limited controls may favour direct examination of important items, stratification or suitable substantive analytics. Investigating all unusually large items can be efficient, but leaves the remainder needing appropriate coverage. Standard accounting packages can make useful data accessible; reliable data and auditor competence still matter.
Do not assume automated controls in every SME are unusable, or that sophisticated tools are always efficient. Assess actual controls, systems and transaction volumes. Closely examine liquidity where a loss, asset write-down or limited equity may threaten the entity's ability to meet obligations.
Finally, assess whether the evidence obtained is sufficient and appropriate, considering both corroborating and contradictory findings. Seek further evidence where needed. If a material evidence limitation remains, the consequences may include a qualified opinion or disclaimer, depending on its significance and pervasiveness; the reporting decision is developed in Module 4.