Skip to content

CS Professional · Compliance Management, Audit and Due Diligence · Audit Process and Documentation

During the audit of Sahyadri Foods Ltd, the auditor identifies a risk of material misstatement on revenue cut-off that management's risk assessment process had not identified. The auditor expects that a risk of this kind would normally have been identified by such a process. What does SA 315 require next?

The auditor must understand why management's process missed the risk and then evaluate whether that process is appropriate to the entity's circumstances or reflects a significant deficiency in internal control over risk assessment. The auditor cannot simply ignore the risk or assume the process is adequate.

  1. AObtain an understanding of why the entity's process failed to identify it and evaluate whether the process is appropriate or has a significant deficiencyCorrect
  2. BRemove the risk from the assessment since management did not recognise it
  3. CConclude automatically that the process is appropriate because the auditor found the risk
  4. DReport the matter only to the tax authorities

Explanation

If management failed to identify a risk the auditor would expect its process to catch, the auditor must understand why the process failed. The auditor then evaluates whether the process is appropriate to its circumstances or whether there is a significant deficiency in internal control over the risk assessment process. Dropping the risk or assuming the process is fine ignores this requirement.

Did you get it right without looking?

One question tells you little. A timed set on Audit Process and Documentation shows your real accuracy, how long you take and where you lose marks.

More Audit Process and Documentation questions