SAS No. 109, Understanding the Entity, Its Environment and Assessing the Risks of Material Misstatement, states:
- The purpose of obtaining an understanding of the entity and its environment, including its internal control, is to identify and assess risks of material misstatement and to design and perform procedures that respond to such risks.
- Risk assessment procedures include inquiries of management and client personnel, observation and inspection procedures and various analytical procedures.
- The auditor is required to obtain a sufficient understanding of the five elements of internal control to evaluate their design and operation.
- Substantive procedures must be performed for significant risks.
- Tests of controls are required only when substantive procedures alone are not sufficient to test financial statement assertions, such as the completeness assertion for revenues.
As it has been for decades, the auditor's understanding of an entity and its environment is the basis for risk assessment and designing auditing procedures that respond to identified risks. SAS No.109 hasn't changed that purpose.
The standard did, however, identify risk assessment procedures such as inquiries, observations, inspections and analytical procedures that are considered substantive evidence that supports the auditor's conclusions on financial statements. This evidence can serve to reduce evidence previously required from more costly tests of balances, even on small audits.
Further, inquiries, observations and inspections may be performed to obtain a sufficient understanding of the five elements of internal control. For small audits, applying these procedures to obtain a sufficient understanding of informal key controls applied by owners or managers may even provide evidence that could reduce control risk to a level less than high!
Are you taking credit for the audit evidence you obtain while gaining an understanding of an entity and its environment? If you are, post a comment and tell us how you use the evidence to reduce other more costly evidence.