Understanding the entity and assessing risk
How an audit team documents its understanding of the entity and identifies risks of material misstatement under ISA 315 (Revised 2019) on a small audit.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
On a recurring small audit, the risk assessment is often the most recycled part of the file. Last year's understanding of the entity is rolled forward with the date changed, the same risks are listed, and the planning meeting is spent on the timetable. Then the audit finds that the client changed its pricing model, lost its financial manager and moved to a new accounting package during the year, and none of that was in the risk assessment because nobody asked.
ISA 315 (Revised 2019) was revised precisely to make risk assessment more robust and more specific. It applies to every audit, scaled to the entity, and it is the foundation for everything that follows: the responses under ISA 330, the sample sizes, the review. Getting it right on a small audit is mostly a matter of asking fresh questions each year and writing down what the answers mean.
Risk assessment procedures
ISA 315 (Revised 2019) requires risk assessment procedures that include:
- inquiries of management and other appropriate people, such as the bookkeeper, sales staff, and those charged with governance;
- analytical procedures, comparing this year's draft or interim figures with last year and with expectations;
- observation and inspection, such as walking through the premises, reading minutes, contracts and business plans.
The engagement team also discusses how the statements could be materially misstated, including through fraud. On a small team, that discussion may be a short meeting between the partner and the senior; it still needs to happen and to be recorded.
The entity, its environment and its framework
The understanding the standard asks for covers:
- The entity's organisational structure, ownership and governance.
- Its business model, including how it uses IT.
- Industry, regulatory and other external factors.
- The measures used, internally and externally, to assess its performance.
- The applicable financial reporting framework and the entity's accounting policies, including the reasons for any changes.
The question that makes this useful is "what has changed?" New customers or products, new lenders, new staff in key roles, new systems, new regulation. Each change is a possible source of risk, and the inherent risk factors below help decide how much.
The system of internal control, including IT
ISA 315 (Revised 2019) organises the understanding of internal control into five components: the control environment, the entity's risk assessment process, its process to monitor the system of internal control, the information system and communication, and control activities.
For a small client, the first four can often be documented briefly, though the control environment deserves real thought where one person dominates. For control activities, the auditor identifies the controls that address risks at the assertion level, including controls over significant risks, controls over journal entries, and controls the auditor plans to test, and evaluates their design and whether they have been implemented.
IT is part of this understanding, not an annex to it. The team identifies the IT applications and other aspects of the IT environment that are subject to risks arising from the use of IT, and the general IT controls that address them. The small-audit version of that work is covered in IT in a small client's audit.
Achekam's Controls & Walkthrough Studio and Engagement Control Tower save their work on the server for the chosen engagement. The ISA numbers on their badges are labels, not evidence of compliance; the evidence is what the team records in them.
Inherent risk factors and significant risks
Inherent risk is assessed on a spectrum, using inherent risk factors: complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or other fraud risk factors. Control risk is assessed separately; if the team does not plan to test controls, control risk is assessed at the maximum.
Significant risks are those assessed close to the upper end of the spectrum. They attract specific requirements under ISA 330, including substantive procedures specifically responsive to the risk.
Finally, the standard requires a stand-back: for material classes of transactions, balances or disclosures not identified as significant, the auditor evaluates whether that conclusion remains appropriate.
Data can help point at risk. In Achekam's Audit Intelligence, a loaded population is risk-scored and a sample proposed, with a reviewer who did not prepare the plan approving it before the draw. Risk scores on transactions are useful evidence for the assessment, but they do not replace the team's judgement about inherent risk factors at the assertion level.
Recording facts the system cannot read
When staff generate an engagement's working papers in Achekam, Achekam reads the engagement's facts, a person confirms what it cannot read, another person approves the profile, and a dry run shows which papers will be created before any are. AI suggestions for facts are accepted one by one, and a sole practitioner may approve their own profile with a written attestation.
That confirmation step is where ISA 315 work and the file meet. The facts a system cannot read, such as a new owner's influence, a dispute with a major customer or the departure of the only person who understood the costing system, are exactly the facts that change the risk assessment. Record them deliberately, and make sure they flow into the risk paper, not only into the profile.
On the risk assessment work item, each procedure is marked done only with a written response and its documents, or set aside with a reason; steps are never deleted. Staff can ask AI to draft a conclusion or a procedure's response, and the draft goes into the file only when a person saves it.
Grouping the file by risk
ISA 315 (Revised 2019) requires the file to document the team's discussion, the key elements of the understanding and their sources, the evaluation of controls' design and implementation, and the identified and assessed risks with the rationale for significant judgements.
The Working Paper Control Centre shows the engagement's file as an index with progress by status, and can group the same papers by preparer, reviewer, risk or statement line. Grouped by risk, it shows each assessed risk with the papers that respond to it, which is the bridge to linking assessed risks to audit procedures. The risks also shape the strategy, covered in the overall audit strategy and audit plan.
The IAASB's page on ISA 315 (Revised 2019) describes the standard on identifying and assessing the risks of material misstatement.
One question to start with
Begin next year's planning meeting with the client by asking "What is different about the business this year?" and write down every answer before opening last year's file.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
