Acca aaa s21 Notes

How does management identify business risks? 
It is important for management to identify 
business risks. Management has a real expertise of the business sector and if they can’t identify 
business risks it can be relatively difficult for the auditor to ensure that all business risks have 
been covered.
๏
Financial performance.
Performance measures create pressures on management. Obtaining an 
understanding of the entity’s performance measures assists the auditor in considering whether 
such pressures may result in management actions that could increase the risks of material 
misstatements. A review of key performance indicators, ratios and trends may indicate that risks 
of misstatement exist (eg unusually rapid growth or profitability compared to other entities in 
the same industry).
3.2. Risk assessment procedures
Risk assessment procedures must include:
๏
Enquiries of management and others (e.g. internal audit) who may have information that is 
likely to assist in identifying risks of material misstatements.
๏
Analytical procedures which may help identify unusual transactions/events and ratios or trends 
that have audit implications.
๏
Observation and inspection to support the enquiries and provide information (e.g. business 
plans, internal control manuals and premises).
Prior year information obtained can be used as long as it remains relevant and reliable as audit 
evidence for the current audit. Information obtained during client acceptance procedures may also 
be relevant.
3.3. System of internal control
ISA 315 requires the auditor not only to understand the controls relevant to the audit but also:
๏
To evaluate the design of controls – Should they prevent or detect and correct material 
misstatement?
๏
To determine whether they have been implemented – Are the controls operating effectively?
Enquiry alone is NOT sufficient to answer these questions.
See 
Chapter 12 of our AA notes
if you need to revise the five inter-related