Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Materiality, Risk Assessment and Internal Control

During the audit of Sagar Logistics Ltd, CA Imran finds that management's risk assessment process did not identify the risk of obsolescence of its fleet tracking software, which the auditor would expect the process to have identified. The company has a documented risk process otherwise. What is the correct conclusion?

Management's failure to identify a risk the auditor would expect the process to identify is evidence of an ineffective entity risk assessment process and indicates a significant deficiency under SA 265. A documented process alone does not prevent this conclusion, and withdrawal is not required.

  1. AThere is no deficiency because a risk assessment process exists on paper
  2. BThe failure is evidence of an ineffective entity risk assessment process, which is an indicator of a significant deficiencyCorrect
  3. CThe auditor should disregard it, as only fraud-related omissions matter under SA 265
  4. DThe auditor must withdraw from the engagement

Explanation

SA 265 treats management's failure to identify a risk of material misstatement that the auditor would expect the process to identify as evidence of an ineffective risk assessment process, an indicator of a significant deficiency. Having a process on paper does not cure this. Withdrawal is not required by the text.

Did you get it right without looking?

One question tells you little. A timed set on Materiality, Risk Assessment and Internal Control shows your real accuracy, how long you take and where you lose marks.

Practise Materiality, Risk Assessment and Internal ControlFree diagnostic mock

More Materiality, Risk Assessment and Internal Control questions