UNDERSTANDING THE ENTITY AND ITS ENVIRONMENT: Complex Entities

UNDERSTANDING THE ENTITY AND ITS ENVIRONMENT: Complex Entities

PURPOSE

This form has been designed to assist the auditor in:

• Gathering audit evidence about the entity and its environment including its component entities and segments, if applicable;
• Identifying and documenting pertinent facts about the entity to be used in further risk assessment procedures; and
• Documenting any potential risks of material misstatement that arise as a result of obtaining an understanding.

 

This form is designed for use in audit engagements of complex entities. For audit engagements of noncomplex entities, either this form or KBA-302N Understanding the Entity and Its Environment: Noncomplex Entities may be completed.

 

INSTRUCTIONS

The information in this form is not gathered in isolation; rather, it represents audit evidence that is integral to performing the audit because it provides vital information used in other areas.

 

The auditor should gather as much information on the entity’s business and industry as is needed to assist in (1) determining the nature, timing and extent of further risk assessment procedures, (2) assessing the risk of material misstatement in the financial statements, and (3) developing an overall audit strategy.

 

The auditor should use professional judgment to determine the extent of the understanding required of the entity and its environment, including its internal control. The auditor’s primary consideration is whether the understanding that has been obtained is sufficient to assess the risks of material misstatement of the financial statements and to design and perform further audit procedures.

 

Obtaining an understanding of the entity, its components, and its environment is a continuous, dynamic process of gathering, updating, and analyzing information throughout the audit. Identifying significant changes in the entity and its environment from previous periods is particularly important in gaining a sufficient understanding of the entity to identify and assess risks of material misstatement. To highlight significant changes in the current year, including changes in internal control over financial reporting, the auditor should designate the degree of change from the previous year using the drop-down menu. A significant change from the previous year may be an indication of a necessary change to the assessment of risk and design of further audit procedures related to that item. While performing each audit, the auditor should continually update this form to reflect the knowledge gained in previous years.

 

AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, requires the auditor to obtain an understanding of the entity’s internal control over financial reporting for an audit of financial statements in order to identify the types of potential misstatements, assess the factors that affect the risks of material misstatement, and design further audit procedures. In an audit of financial statements, the nature, timing and extent of procedures necessary to obtain an understanding of the entity’s internal control will depend on the size and complexity of the entity; the auditor’s existing knowledge of the entity’s internal control over financial reporting, including the use of IT; the nature and extent of changes in systems and operations; and the nature of the entity’s documentation of its internal control over financial reporting. Additionally, in the audit of financial statements only, the auditor is required to obtain an understanding of the design of internal controls and whether those internal controls have been implemented. If the auditor intends to rely on internal controls to reduce the nature, timing and extent of his or her substantive audit procedures or has identified a risk for which substantive procedures alone will not provide sufficient appropriate audit evidence, then the auditor should obtain sufficient appropriate audit evidence that the key controls identified to mitigate the risk of material misstatement are operating effectively.

 

When intending to use information about the entity and its environment obtained in previous periods, the auditor should determine whether changes have occurred that may affect the relevance of such information in the current audit. The auditor should make inquiries and perform other appropriate audit procedures, such as walkthroughs of systems, to determine whether changes have occurred that may affect the relevance of such information.

 

The auditor should obtain sufficient appropriate evidence regarding the presentation and disclosure of segment information in accordance with the applicable financial reporting framework by obtaining an understanding of the methods used by management in determining segment information and evaluating whether such methods are likely to result in disclosure. Also, the auditor should test the application of such methods and perform analytical procedures or other audit procedures appropriate for the circumstances.

 

Audit procedures to obtain the understanding are referred to as risk assessment procedures. AU-C Section 315 provides that risk assessment procedures performed to obtain an understanding of the entity and its environment should include the following:

 

• Inquiries of management and others within the entity;
• Analytical procedures; or
• Observation and inspection.

 

The workpaper reference column should be used when the procedures performed to gain an understanding are documented elsewhere.

 

The tables in sections II through VII contain examples of matters that the auditor may consider in obtaining an understanding of the entity and its environment, including components or segments, if applicable. The factors included cover a broad range of matters applicable to many engagements; however, not all matters are relevant to every engagement and the list of factors is not necessarily all-inclusive. While each of the factors included in sections II through VII may not be applicable to an engagement, the auditor is nevertheless required to gather sufficient information to obtain an understanding of each of the aspects of the entity and its environment (i.e., sections II through VII).

 

In determining others within the entity to whom inquiries may be directed, or the extent of those inquiries, the auditor should consider what information may be obtained that might help in identifying the risks of material misstatement. For example:

 

• Inquiries of management may help in identifying actual, suspected or alleged fraud, including understanding how management becomes aware of (including tips or complaints) and responses to fraudulent activities when they occur.
• Inquiries directed toward those charged with governance may help in understanding the environment in which the financial statements are prepared and whether those charged with governance are aware of fraudulent activities through tips or complaints, including those received through internal whistleblower programs.

Inquiries directed toward internal audit personnel may relate to their activities concerning the design and effectiveness of the entity’s internal control, procedures performed to identify or detect fraud, and whether management has satisfactorily responded to any findings from these activities