Understanding the entity, its environment and its laws (ISA 315 and ISA 250)

An auditor who knows only that a client sells building materials will plan a generic audit.

An auditor who also knows that the industry is in recession, that the client's prices have risen with commodity costs, that customers are slow to pay, that the finance director has just resigned and that a new law has changed import duties will plan a much sharper one: more work on receivables, on the provision for bad debts and on customs duty.

Understanding the business is how the auditor finds the risks before testing begins.

This topic covers the auditor's risk assessment under International Standard on Auditing (ISA) 315: what to understand about the entity and its environment, the procedures used, business risks, internal control, risks at financial statement and assertion level, the audit approaches, and the consideration of laws and regulations under ISA 250. The next topics cover materiality and audit risk.

Key terms in plain English

Syllabus check

This topic is in syllabus area A, process of audit and assurance (20% of marks). It covers:

• how the auditor obtains an understanding of the entity and its environment
• the assessment of the risk of material misstatement
• the consideration of laws and regulations

CAMA 2020 and understanding the entity

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

Understanding the entity and its environment

To set the overall strategy and plan the auditor must understand the entity and its environment, considering factors such as the industry, the nature and competence of management, the internal control system, current financial performance, reporting requirements and deadlines, and recent developments. ISA 315 requires it.

The auditor's objective is to identify and assess the risks of misstatement, whether due to fraud or error, through understanding the entity and its environment including its internal control. That assessment is the basis for designing responses, which take the form of audit procedures.

The auditor looks for factors that deserve special attention. A recession in the client's industry, rising commodity prices forcing price rises, and a poor record of collecting receivables together point to extra work on receivables and the allowance for doubtful debts.

Risk assessment procedures

ISA 315 requires the risk assessment procedures to include:

• Enquiries of management and others: asking questions and weighing the answers.
• Analytical procedures: studying ratios and trends to find unusual transactions, events, amounts or trends. Software can help by calculating year-on-year changes and graphing trends. If payables days have lengthened compared with earlier years, the company may be having difficulty paying its debts, and more work is planned in that area.
• Observation and inspection: for example inspecting internal control manuals, business plans and premises.

These are also methods of gathering evidence, so they are met again in later topics. At this stage they are used to identify risk areas and plan the approach.

What the auditor must understand

When using knowledge from earlier years, the auditor must allow for significant changes in circumstances or in the general environment. The same plan must not be copied routinely, because a change may mean that last year's plan is no longer suitable.

Business risks

Business risks arise from significant conditions, events, circumstances, actions or inaction that could affect the entity's ability to reach its objectives and carry out its strategies. They can also arise from setting unsuitable objectives, strategies or goals. A business risk is wider than a risk of misstatement, but many business risks can lead to one.

A company that has borrowed heavily to expand faces the business risk of failing to meet its loan covenants, which may tempt management to overstate profit.

Understanding the accounting and internal control systems

ISA 315 requires an understanding of the internal controls relevant to the audit. Most controls relate to financial reporting but not all are relevant to the audit. The auditor judges how strong or weak the controls are in order to decide how much testing is needed, taking account of previous knowledge of the client, recent changes, known problems with controls and new auditing or accounting requirements. The assessment is dealt with in the topics on internal control.

Risks at two levels

The auditor must identify and assess risks of material misstatement at two levels.

• The financial statement level: risks that are pervasive to the statements as a whole and may affect many assertions. An example is a tendency of management to override controls, which affects every area of the accounting system.
• The assertion level: risks relating to specific objectives of the statements, such as that all liabilities are recorded and that recorded assets exist.

In assessing risk the auditor asks where the risk of error appears to exist and of what kind, when an error should be treated as material and when it can be ignored, and which parts of the audit will be hardest to plan because of high risk.

The auditor considers inherent and control risks and significant audit areas, materiality, the possibility of material misstatement including fraud, and complex accounting areas, especially accounting estimates that are hard to audit. High-risk and material items are tested in detail. Low-risk and immaterial items get less attention.

Audit approaches

Compliance with laws and regulations: ISA 250

The objectives of the auditor under ISA 250 are to obtain sufficient appropriate evidence of compliance with the laws and regulations that may be expected to have a direct effect on material amounts and disclosures; to perform specified procedures to help identify non-compliance; and to respond properly to non-compliance or suspected non-compliance. Relevant laws include employee rights, health and safety, consumer protection and money laundering law.

Breach of health and safety law, for example, could lead to heavy fines or closure and may require a provision or disclosure.

The auditor must:

1. obtain a general understanding of the legal and regulatory framework and how the entity complies, as part of understanding the entity under ISA 315;
2. obtain sufficient appropriate evidence of compliance with laws that directly affect material amounts and disclosures;
3. make enquiries of management on compliance, inspect correspondence with the authorities and stay alert to non-compliance revealed by other procedures;
4. obtain written representations that all known or suspected non-compliance has been disclosed; and
5. document all identified or suspected non-compliance and the discussions with management and others.

If non-compliance is suspected, the auditor obtains an understanding of the act and the circumstances, evaluates the possible effect on the financial statements, discusses suspected non-compliance with management and takes legal advice if compliance is not shown, considers the effect on the audit report if there is not enough evidence, and considers the effect on other areas, including the overall risk assessment.

Reporting: unless all those charged with governance are also in management, the auditor communicates non-compliance to them, as soon as practicable if it is intentional and material. If the auditor suspects that those charged with governance are involved, he communicates with the next highest level, such as the audit committee, or takes legal advice if there is none.

In the report, a material effect that is not properly reflected in the financial statements leads to a qualified or adverse opinion. A scope restriction by management leads to a qualified opinion or a disclaimer. If the auditor cannot decide whether non-compliance happened because of the circumstances, he considers the effect on the report.

The auditor also decides whether there is a duty to report to the authorities, which in some cases overrides confidentiality, as with money laundering. The topic on non-compliance and whistleblowing sets out the wider framework.

Worked examples

1. Industry decline and slow collections raise the risk of overstated receivables.
2. The resignation raises a risk to the quality of the controls and of the estimates.
3. The plan gives extra work to receivables, the bad debt allowance and the controls over financial reporting.

1. The company may be struggling to pay.
2. The auditor plans more work on completeness of payables, going concern and any penalties.

1. The risk affects the whole accounting system: a financial statement level risk.
2. The response is overall: more senior staff, more unpredictability, more testing of journals.

1. The law has a direct effect on a material amount.
2. The auditor discusses it with management, evaluates the effect on provisions and disclosure, and tells those charged with governance.
3. If the fine is not provided for or disclosed, a qualified or adverse opinion may follow.

How to score full marks

• Link each fact in the question to a risk and then to an audit response.
• Name the three risk assessment procedures.
• Distinguish the financial statement level from the assertion level.
• For ISA 250 cover understanding, evidence, procedures, representations, reporting.

Common mistakes in the exam

• Copying last year's plan without considering changes.
• Listing business facts without saying what risk each creates.
• Confusing business risk with audit risk.
• Forgetting written representations on non-compliance.

Quick revision

• ISA 315: understand the entity, environment and controls to assess risk.
• Procedures: enquiry, analytical procedures, observation and inspection.
• Two levels: financial statement and assertion.
• ISA 250: law, evidence, procedures, representations, reporting.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.