Understanding the entity, its environment and the reporting framework

In this lesson you will

List the elements of the understanding required by AU-C 315.19.
Plan risk assessment procedures that meet AU-C 315.13-.14.
Explain how the understanding connects to inherent risk factors.

Why the understanding matters

You cannot identify where the statements could be misstated without knowing how the business makes and spends money, who runs it and how it reports. AU-C 315.07 describes risk assessment as iterative and dynamic: understanding, assessment and responses feed each other throughout the audit.

Risk assessment procedures

AU-C 315.13 requires you to design and perform risk assessment procedures that provide an appropriate basis for identifying and assessing risks and for designing further procedures. The same paragraph adds that you design them in a manner that is not biased toward obtaining corroborative evidence or excluding contradictory evidence.

AU-C 315.14 requires the procedures to include:

inquiries of management and other appropriate individuals, including internal audit if it exists;
analytical procedures; and
observation and inspection.

AU-C 315.15 requires you to consider information from client acceptance or continuance procedures and, when applicable, other engagements the engagement partner performed for the entity. AU-C 315.16 requires you to evaluate whether prior-year information remains relevant and reliable before using it.

Inquiry beyond the CFO is where many files fall short. Production managers, sales staff, the person who records journal entries, and in-house counsel often know about changes the CFO considers routine.

What you must understand

AU-C 315.19 requires an understanding of:

(a) The entity and its environment

(i) Organizational structure, ownership and governance, and business model, including the extent to which the business model integrates the use of IT.
(ii) Industry, regulatory and other external factors.
(iii) Measures used, internally and externally, to assess financial performance. These are pressure points: bonus metrics, covenant ratios and investor KPIs create incentives to manage results.

(b) The applicable financial reporting framework, the entity's accounting policies, and the reasons for any changes.

(c) How inherent risk factors affect the susceptibility of assertions to misstatement, and the degree to which they do, based on (a) and (b).

Item (c) is the bridge. The understanding is not an end in itself; it is the source of your inherent risk analysis. A new revenue contract type brings change and complexity. A covenant close to breach brings susceptibility to management bias.

AU-C 315.20 requires you to evaluate whether accounting policies are appropriate and consistent with the framework.

Using analytics well

Preliminary analytics are a required risk assessment procedure, not a formality. Compare current to prior results, budget and industry data, and look at ratios and nonfinancial relationships such as revenue per employee or tons shipped. Write down why each significant fluctuation could point to a risk. The preliminary analytical procedures workpaper has a format.

Scaling for a smaller entity

For a less complex entity, the understanding can be shorter, but it still covers every element of AU-C 315.19. The AICPA Audit Guide Risk Assessment in a Financial Statement Audit includes scalability examples. A one-page narrative that explains the business model, key performance measures, framework and three or four inherent risk observations can be enough.

Common findings

Understanding copied from the prior year with no evidence of current-year inquiry.
No link from the understanding to identified risks.
Analytics run but fluctuations not explained or not used.
Inquiry limited to one person.

Worked example

From understanding to risks at a distributor

Pinecrest Food Distributors, Inc. has revenue of $64 million. Risk assessment procedures produce four observations:

Business model: in March the company began selling to grocery chains under contracts with volume rebates paid annually. Rebates accrued at year end are $1.1 million, up from zero.
External factors: diesel and food costs rose; gross margin fell from 18.2% to 16.9%.
Performance measures: the revolving credit agreement requires EBITDA of at least $3.5 million. Draft EBITDA is $3.62 million, a cushion of $120,000.
Accounting policies: rebates are recorded as a reduction of revenue under ASC 606, a new policy this year.

The team links each to inherent risk factors. The rebate accrual involves change, complexity and subjectivity, affecting accuracy and valuation of the liability and revenue. The thin covenant cushion, $120,000 against performance materiality of $150,000, increases susceptibility to management bias in every estimate that affects EBITDA. These become identified risks for the next steps.

Self-check

Answer each question before you open the answer.

Which three types of procedures must risk assessment include under AU-C 315.14?
Show answer
Inquiries of management and others within the entity, analytical procedures, and observation and inspection.
Why does AU-C 315.19 require understanding the measures used to assess financial performance?
Show answer
Performance measures such as bonus targets and covenant ratios create pressure that can increase susceptibility to management bias, an inherent risk factor.
What does AU-C 315.13 say about bias in risk assessment procedures?
Show answer
Procedures should be designed and performed in a manner not biased toward obtaining corroborative evidence or excluding contradictory evidence.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error