The three-step process is continuous
SSA 315 and SSA 330 provide the framework for identifying, assessing and responding to material-misstatement risks. ACRA’s risk-based inspections from 2014 found weak initial identification leading to inadequate procedures. The bulletin sets out three steps: understand the entity and environment, including controls; identify and assess risks; and design responses. Risks are distinguished as significant or normal, but the assessment continues throughout the audit and plans change when evidence changes. The 2016 standard references and FRS 18 example are historical. This guidance supplements standards and does not replace them.
Understand actual operations rather than assume continuity
Understand the business, industry, competition, customers, suppliers and regulatory environment through enquiries, observation, inspection and financial and non-financial analysis. A predecessor’s clean opinion does not establish an absence of significant risks for a new audit. General industry knowledge and prior-year files do not establish that current circumstances are unchanged. Partners should discuss business events and changes with management and governance early, investigate analytical fluctuations and corroborate representations with professional scepticism. Waiting until the audit is nearly complete to understand the changes weakens planning and supervision.
Connect risks to financial-statement and assertion levels
Financial-statement-level risks are pervasive and may affect many assertions, such as management-override concerns arising from the control environment. Assertion-level risks concern transactions, balances and disclosures and directly shape procedures. Connect the business facts to recognition, measurement, presentation and disclosure, including completeness, existence, accuracy and cut-off, valuation, occurrence, rights and obligations, and presentation. A risk initially considered at assertion level may prove more pervasive. Identifying account names alone is not the same as explaining what could go wrong.
Six considerations for significant risks
The source requires consideration of fraud; recent significant economic, accounting or other developments; transaction complexity; significant related-party transactions; measurement subjectivity; and significant unusual or non-routine transactions. For example, an impaired subsidiary investment may require fair values or discounted forecasts involving subjective assumptions. A material balance is not automatically a significant risk: straightforward PPE accuracy may not be complex. Conversely, immaterial accruals may have a significant completeness risk where payable-department turnover is high. Professional judgement requires a reasonable basis; ACRA described testing whether reasonably experienced accountants could reach the same judgement on that basis.
Responses must be tailored to the identified risk
Significant risks need specifically responsive substantive procedures and enough appropriate evidence to support the opinion. Customisation requires partner involvement from the start, not merely signing off standard programmes at the end. The source found this particularly weak in some non-PIE work, where insufficient supervision led teams to perform procedures that did not address actual circumstances. The relevant questions are what evidence is needed and whether the selected procedure answers the identified assertion risk.
Natural-gas example: understand the changed business
Company A trades gas, turbine engines and steel pipelines, has no Singapore office and keeps records in Country R, described as low on the corruption index. FY2014 revenue came solely from turbines; new gas trading supplied 85% of FY2015 revenue, with one supplier and one customer in R. Purchases followed customer orders, goods shipped directly to customers, and cash used accounts in eastern European N and P rather than R. Gas margins ranged from 8.9% to 12.2%. In US$000, FY2015 versus FY2014 revenue was 495,200/3,500; cost of sales 447,661/3,395; gross profit 47,539/105; margin 9.6%/3%; and net profit 12,044/23. These are illustrative facts, not benchmarks. The auditor carried forward a 2011 pipe-trading description and 2014 controls without understanding the new stream. Proper work would explain the revenue jump, commercial rationale, related parties, source records, recognition policy, transport and pricing controls.
Natural-gas example: reject generic testing and investigate substance
Back-to-back trading alone was not a sound basis to rebut the revenue-fraud presumption. Occurrence and cut-off were significant risks given offshore cash, direct shipment and foreign records. The team tested thirty sales and thirty purchases using generic ledgers and transport documents, including railway or airway bills and receipt into store, despite no company-held stock. Its five pre-year-end and five post-year-end cut-off samples included no gas sales. Appropriate responses included reviewing supplier and customer contracts under the historical FRS 18 risks-and-rewards framework to assess gross or net reporting; checking related parties; matching sold quantities to supplier invoices; following cash flows and counterparty names; and including gas in cut-off work. The sample numbers describe deficient work, not recommended sample sizes.
Mining example: new evidence can change the assertion risk
Risk assessments must be revisited when new evidence conflicts with their original basis. A mining entity normally slowed or closed during July, August and December because of weather, with low fourth-quarter output expected. Revenue occurrence was initially a significant fraud risk. December 2015 sales then exceeded average quarterly sales, yet the auditor left cut-off as normal without investigation. The appropriate response was to explain the anomaly, reconsider low prior production and elevate cut-off to significant risk where potential revenue fraud arose. An initial significant occurrence risk does not automatically cover a separate cut-off problem.
Manufacturing example: overall profits do not remove asset-specific risks
The manufacturing company appeared profitable in November 2015, so the initial significant risks were revenue and receivable recovery. During the audit, a major customer announced Product Z would cease from January 2016. The auditor nevertheless omitted equipment impairment work because the company was profitable and reviewed obsolete stock only when aged at least nine months. Instead, customised equipment and specialised Product Z materials needed reassessment, with subjective valuation supporting significant-risk treatment. Responses should examine management’s recoverable-amount assumptions and estimates for equipment, and possible material write-off or reduction to net realisable value. Company-wide profit and a standard age threshold do not resolve specific discontinued-product exposure.
Group example: assess the consolidated position
Company C provides Singapore subcontracting services, using cost-to-cost percentage completion with one project open at FY2015 end. Its wholly-owned Malaysian machine-parts trader X, audited by H, sold 76% to Malaysia and 24% to Singapore, faced an economic slowdown and lost major Malaysian customers. C held 9% and X91% of group stock. The consolidated table, labelled US$000, showed FY2015/FY2014 revenue 194,800/218,400; net profit 655/2,300; stock 6,500/4,600; and turnover 195/79 days. A parent-only assessment missed stock risk because C’s own balance was immaterial. Longer turnover, declining conditions and customer losses could make group inventory valuation significant. The group auditor should communicate that risk to H, issue risk-specific reporting instructions and assess proposed procedures, understanding components, consolidation and group-wide controls. The source’s market percentages and currency label are retained as printed.
Document the chain from understanding to evidence
SSA 230 documentation should allow an experienced auditor unconnected with the engagement to understand the basis for risk identification and assessment. Information can appear in different file sections; ACRA did not prescribe a format but encouraged an overall summary containing key understanding, what could go wrong and why significant, specific responses, and results. A record is needed to establish work performed. The partner remains involved from planning to completion and updates procedures after reassessment. The bulletin also links good risk work to KAM reporting introduced for listed periods ending on or after 15 December 2016; significant risks inform that reporting, without making every significant risk automatically a KAM.
Official source
This article independently explains the substantive contents of the official PDF, including the relevant conditions, procedures and annexes. The linked document remains the authoritative source for its original wording, and later changes should be checked separately.
Read the official PDF ↗