CA Final · Advanced Auditing, Assurance and Professional Ethics · Materiality, Risk Assessment and Internal Control

During the audit of Himalaya Foods Ltd, the auditor finds that management did not identify a significant risk of obsolescence in a new product line, which the auditor would expect an appropriate risk assessment process to have identified. The auditor also finds that there is no control over this risk. Which conclusion is most appropriate under SA 315 and SA 265?

The auditor should treat it as an indicator of a significant deficiency. SA 265 lists both management's failure to identify a risk the auditor would expect it to identify and the absence of controls over a significant risk. The auditor should evaluate and communicate it, even if substantive tests find no misstatement.

1. AOnly the failure to identify the risk is a deficiency; the absence of controls is not an indicator
2. BThe matter is an indicator of a significant deficiency, since SA 265 lists both an ineffective entity risk assessment process and an ineffective response to an identified significant risk, so the auditor should evaluate and communicate itCorrect
3. CNo deficiency exists, because the entity's risk assessment process is solely a matter of management's judgment and cannot be questioned by the auditor
4. DThe matter can be ignored if the auditor's substantive procedures find no misstatement