Audit and Assurance · Understanding the entity and its environment and the applicable financial reporting framework

Obtaining an Understanding of the Entity and Its Environment

Updated 11 October 2026 · Fact-checked

Under ISA 315 (Revised 2019), the auditor must understand the entity's industry, regulatory and other external factors, its nature, objectives, strategies and related business risks, and how its performance is measured. This understanding lets you spot where financial statements could be materially misstated and plan the audit.

Understand Obtaining an Understanding of the Entity and Its Environment

Every audit starts with knowing the client. If you do not understand how a business earns money, who regulates it and what could go wrong, you cannot tell where the financial statements might be wrong. ISA 315 (Revised 2019) requires this understanding as part of risk assessment procedures.

The ISA groups the understanding into a few areas. Industry, regulatory and other external factors include market conditions, competition, technology, the legal and regulatory setting, and the applicable financial reporting framework. The nature of the entity covers its operations, ownership and governance, the investments it makes, how it is structured and how it is financed. Objectives, strategies and related business risks cover what management is trying to achieve and what could stop it. Measurement of financial performance covers the measures that management, owners and outsiders use to judge the entity.

A business risk is a risk that arises from significant conditions, events, circumstances or actions that could stop the entity achieving its objectives or executing its strategies. Many business risks lead to risks of material misstatement in the financial statements. For example, a new competitor may force price cuts, which puts inventory valuation at risk. Not every business risk affects the financial statements, so you judge which ones do.

You gather this understanding through risk assessment procedures: enquiries of management and others, analytical procedures, and observation and inspection. Typical sources include prior-year files, the entity's website, board minutes, management accounts, budgets, industry publications, regulator websites, news and visits to premises. You also discuss it within the engagement team.

Performance measures matter because they create pressure. If bonuses depend on profit or if lenders set covenants, management may be tempted to manipulate figures. This links the topic directly to fraud risk and to going concern.

Key rules to remember

Areas of understanding (ISA 315 Revised 2019): External factors + Nature of entity + Objectives, strategies and business risks + Performance measurement; Use these four headings to structure any answer. Also remember the applicable financial reporting framework and accounting policies.
Risk assessment procedures: Enquiries + Analytical procedures + Observation and inspection; These procedures alone do not provide sufficient evidence for an opinion. They support risk assessment.
Business risk to audit risk link: Business risk → possible risk of material misstatement → audit response; Always finish by saying what the risk means for the financial statements.

How to solve Obtaining an Understanding of the Entity and Its Environment questions

Use this method for any question asking what you should understand about a client, where you get the information, or what a scenario means for the audit.

1Read the requirement and note whether it asks for areas of understanding, sources of information, business risks or audit implications.
2Sort the scenario facts under the four headings: external factors, nature of the entity, objectives, strategies and business risks, and performance measurement.
3For each fact, state the business risk it creates, such as falling demand, new regulation, high debt or reliance on one customer.
4Link each business risk to the financial statements: which balance, transaction or disclosure could be misstated, and why.
5Where asked for sources, name the specific source and what it tells you, for example board minutes show major decisions.
6Add the audit response or planning point briefly, such as more senior staff, extra testing or a specialist.
7Check that each point is tied to the scenario and not a general list.

Quickest way: Four-heading scan with a risk link

When to use it: Use this in Section C or a short OT case when time is tight and you need a structured answer fast.

Write four short headings: External, Nature, Objectives and risks, Performance.
Put each scenario fact under one heading in a few words.
Beside each fact write the financial statement area at risk.
Write one sentence on the audit impact for the biggest two or three items.
For OT questions, match the fact to the heading and pick the option that links to a misstatement risk.

Common mistakes in Obtaining an Understanding of the Entity and Its Environment

Listing general facts about the industry with no link to the audit.
Students think the requirement is to describe the business.
Fix: After each fact, add one line saying which financial statement area is affected and why.
Saying every business risk is a risk of material misstatement.
The two terms sound alike.
Fix: Business risks may or may not affect the financial statements. Say that many lead to misstatement risk and name the ones that do.
Treating understanding the entity as only a first-year task.
Students forget that recurring audits also need an update.
Fix: State that you update your understanding every year, using prior-year files and changes in the business.
Naming vague sources such as 'the client'.
Students rush and do not think of specific documents.
Fix: Name the source and what it shows: board minutes for decisions, management accounts for performance, regulator websites for compliance.
Ignoring performance measures and the pressure they create.
Students focus on operations and law.
Fix: Mention targets, bonuses and loan covenants and link them to fraud risk and to window dressing.
Treating risk assessment procedures as enough evidence for the opinion.
Students confuse risk assessment with further audit procedures.
Fix: Say that these procedures identify and assess risks, and that further procedures are then designed in response.

Worked examples

Example 1

You are auditing Zeta Ltd, a retailer of mobile phones. Sales have fallen because a competitor opened an online shop with lower prices. Zeta has a bank loan with a covenant requiring a minimum profit level, and managers receive a bonus based on profit. Explain what these facts mean for your understanding of the entity and the audit. (6 marks)

Show the solution

External factor: the online competitor and falling prices. This is a business risk because margins and sales may fall.
Financial statement link: inventory of phones may become obsolete or need write-down to net realisable value, so inventory could be overstated.
Performance measurement: profit drives the bank covenant and the bonus. This creates pressure on management to overstate profit.
Financial statement link: risk of revenue recognition manipulation, understated provisions and overstated inventory.
Going concern: if the covenant is breached, the loan may become repayable, which raises going concern doubts and disclosure issues.
Audit impact: assign experienced staff, apply scepticism, plan extra inventory valuation testing, cut-off testing and a going concern review.

Answer: Falling sales and price competition are business risks that create misstatement risk for inventory valuation. The covenant and the profit-based bonus create pressure for management to overstate profit, so revenue, provisions and inventory are higher risk. There is also a going concern risk if the covenant is breached. The audit should use experienced staff, extra testing of inventory valuation and cut-off, and a careful going concern review.

Example 2

You are planning the audit of Brightwater Co, a new client in the water supply industry. List four sources of information you would use to obtain an understanding of the entity and say what each would tell you. (4 marks)

Show the solution

Choose four distinct sources, not four versions of the same one.
Source 1: minutes of board meetings. They show key decisions, strategy and concerns.
Source 2: management accounts and budgets. They show performance measures, trends and targets.
Source 3: the regulator's website and published industry reports. They show regulatory requirements, price controls and sector conditions.
Source 4: a visit to the main premises and enquiries of management. They show how operations work and what management sees as risks.
Optionally, mention prior-year files if available from the predecessor auditor, with appropriate communication.

Answer: Four sources: board minutes for strategy and major decisions; management accounts and budgets for performance and targets; the regulator's website and industry reports for regulatory and sector conditions; and a site visit with management enquiries for operations and perceived risks.

Exam tips

In scenario questions, quote the facts given. Examiners reward points that are tied to the scenario.
Always finish a business risk with its effect on the financial statements. Do not stop at the business point.
Use the four headings to organise any answer so it reads clearly and you do not miss an area.
In OT questions on sources, look for the option that gives specific information matched to the area, for example board minutes for strategy.
Remember performance measures and pressure. They link this topic to fraud risk and going concern.

Obtaining an Understanding of the Entity and Its Environment in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Obtaining an Understanding of the Entity and Its Environment: frequently asked questions

What does ISA 315 require the auditor to understand about the entity?

ISA 315 (Revised 2019) requires you to understand the entity's industry, regulatory and other external factors, its nature, its objectives and strategies and related business risks, and how its financial performance is measured. You also understand the applicable financial reporting framework and accounting policies.

What is a business risk in audit?

A business risk arises from significant conditions, events, circumstances or actions that could stop the entity achieving its objectives or carrying out its strategies. Some business risks lead to risks of material misstatement. You decide which ones do.

What are the main sources of information about a client?

Common sources are prior-year files, board minutes, management accounts and budgets, the entity's website, industry and regulator publications, news reports, and enquiries and visits. Pick the source that fits the area you need to understand.

Do I need to update my understanding each year?

Yes. For a continuing client you update your understanding for changes in the business, its environment and its reporting framework. Prior-year files help, but you cannot rely on them alone.