604

“the auditor must adequately plan the work and must properly supervise any assistants

“developing an overall audit strategy for the expected conduct, organization, and staffing of the audit.”

• operational approach to achieving the objectives of the audit. It is a
• high-level description of the audit scope. It includes matters such as
• identifying material account balances, identifying audit areas with a
• higher risk of material misstatement, the overall responses to those
• higher risks, and the planned audit approach by area (for example,
• substantive procedures or a combined approach of substantive procedures
• and tests of controls

• knowledge from past experience with
• the client and the results of preliminary engagement activities. As
• auditors gather additional information through the performance of risk
• assessment procedures, they complete the overall audit strategy,
• including overall responses at the financial statement level.

• could result in material misstatement of the financial statements. According to SAS No. 108 (AU 311),
• obtaining an understanding of the CIRA and its environment, including
• its internal control, is an essential part of planning the audit.
• Auditors must plan the audit so that it is responsive to the assessment
• of the risk of material misstatement based on the auditors'
• understanding of the CIRA and its environment, including its internal
• control.

• audit strategy and documents the
• nature, timing, and extent of procedures to be performed to obtain
• sufficient appropriate audit evidence. The nature, timing and extent of
• audit planning varies with the size and complexity of the CIRA, and with
• the auditor's understanding of the CIRA and its environment, including
• internal control. However, audit planning always includes a risk
• assessment process.

extension of the CIRA client.

• will allow the application of audit
• procedures sufficient to express an opinion. The CIRA's use of a
• managing agent will have a significant effect on the auditors' approach
• to understanding the CIRA and its environment, including the CIRA's
• internal control, as explained beginning in sections 605 and 606.

• list of documents and records
• needed for the audit. Using a standardized list of documents and records
• ordinarily needed for a CIRA engagement can save time and ensure that
• important documents are not overlooked. The authors have prepared a
• standardized list that is reproduced at HOA-CX-17.5.

CIRA and its environment, and making decisions and judgments about assessed risks and other matters based on that understanding.

• inquiry, analytical procedures,
• inspection, and observation as well as related planning activities and
• procedures, such as preliminary engagement activities related to client
• acceptance and continuance, and holding a discussion among the
• engagement team.

• to perform all of these procedures
• when planning the audit. Further, the auditor's consideration of fraud
• required by SAS No. 99 (AU 316), Consideration of Fraud in a Financial Statement Audit,
• is not separate from the consideration of audit risk but is integrated
• into the overall risk assessment process. That is, the assessment of
• risks due to error occurs simultaneously with the assessment of risks
• due to fraud. The key requirements of SAS No. 99 are addressed at
• relevant points throughout this chapter.

entity and its environment, including its internal control.

a. Industry, regulatory, and other external factors.b. Nature of the entity, including—td dl { margin-top: 0px; margin-bottom: 0px; }

• (1) Organizational structure and personnel.
• (2) Operating characteristics
• (3) Governing documents and similar documents.
• (4) Related-party transactions.

• c. Objectives and strategies
• and the related business risks that may result in a material
• misstatement of the financial statements.

d. Measurement and review of the CIRA's financial performance.

e. Internal control, which includes the selection and application of accounting policies.

f. Fraud risk factors.

• The information obtained by
• applying risk assessment procedures is used to make the important
• decisions and judgments that are part of audit planning. These decisions
• and judgments include determining materiality levels and assessing
• risks of material misstatement at the financial statement and relevant
• assertion levels.

• the audit even though many of the
• planning steps and procedures necessarily are performed at the beginning
• of the audit process. Audit planning begins with engagement acceptance
• and continues throughout the remainder of the audit. Also, many of the
• audit planning steps and procedures can be performed simultaneously and
• tend to blend together. Nevertheless, having a logical sequence of steps
• and procedures provides a useful framework. The authors' approach is
• presented in Exhibit 6-2.

• 1. Perform procedures regarding acceptance or continuance of the client relationship and the specific audit engagement.
• 2. Evaluate compliance with ethical requirements, including independence.
• 3. Establish an understanding with the client and communicate in an engagement letter.

4. Establish preliminary audit strategy.

5. Determine the nature, timing, and extent of risk assessment procedures and perform the procedures.

• 6.
• Determine the materiality level for the financial statements taken as a
• whole (preliminary planning materiality) and materiality for particular
• items of lesser amounts.

7. Perform preliminary analytical procedures (a risk assessment procedure).

8. Hold a discussion among the engagement team.

• 9.
• Identify fraud risk factors, areas where special audit consideration
• may be necessary, and other areas where there may be higher risks for
• material misstatement.

10. Assess audit risk at the overall financial statement level.

11. Complete the overall audit strategy, including overall responses at the financial statement level.

12. Determine tolerable misstatement.

13. Assess audit risk in relation to relevant assertions for transaction classes, account balances, and disclosures.

14. Develop a detailed audit plan for the nature, timing, and extent of further audit procedures.

• be performed at differing stages or
• sequences from one engagement to the next. For example, the sixth step,
• determine the materiality level for the financial statements taken as a
• whole, and the twelfth step, determine tolerable misstatement, are
• often performed concurrently. For the eighth step, the discussion among
• the engagement team, the precise timing of this meeting can vary with
• the circumstances, but should occur relatively early in planning, and it
• is not required to occur in any particular sequence.

risks that should be assessed as to whether they could result in material misstatement of the financial statements.

• The auditor must perform risk assessment procedures to provide a
• satisfactory basis for the assessment of risks at the financial
• statement and relevant assertion levels.

of the consideration of risk.

• some of the information obtained by
• performing those procedures may be used by the auditor to support the
• assessments of the risks of material misstatement. Auditors normally
• consider the effectiveness of various types of risk assessment
• procedures in identifying risks during the planning process. Standards
• encourage this by requiring the use of a variety of risk assessment
• procedures when obtaining an understanding of the entity and its
• environment. For example, an auditor cannot limit his or her risk
• assessment procedures to only inquiry.

• related to account balances,
• transaction classes, or disclosures, or about the operating
• effectiveness of controls. Therefore, risk assessment procedures may
• also serve as tests of controls or substantive procedures, or may be
• performed concurrently with those procedures.

• a. Preliminary engagement activities, including establishing an understanding with the client. (See section 601.)
• b. Inquiries of management and others.
• c. Preliminary analytical procedures.
• d.
• Observation and inspection, such as visits to the HOA development and
• tracing transactions through the information system (that is,
• walkthroughs).e. Discussion among the engagement team.

• of information that should be considered when identifying risks of material misstatement due to fraud. SAS No. 109 (AU 314)
• requires that all of the risk assessment procedures be performed when
• obtaining an understanding of the entity and its environment. There is
• no requirement that each of those procedures be performed for every
• component of the required understanding. Nevertheless, the standards are
• explicit in indicating that inquiry alone is not sufficient to evaluate
• the design and implementation of internal control. Therefore,
• observation and inspection will most likely be coupled with inquiry
• procedures when obtaining the understanding of internal control.

• For example, in all audits the
• auditor will make inquiries of management responsible for financial
• reporting about accounting policies and other aspects of the financial
• reporting process. However, determining others within the CIRA to whom
• related questions may be directed will depend on the circumstances and
• the specific information gathered about the CIRA. For example, if
• initial inquiries reveal that the CIRA has investments in debt
• securities, the auditor will likely make further inquiries of personnel
• involved in the valuation of those investments. Thus, performing risk
• assessment procedures often can begin without extended consideration of
• their nature, timing, and extent, but other aspects of the risk
• assessment procedures can only be determined after some information is
• gathered about the entity and its environment.

• • Inquire of management
• (including the managing agent, if applicable) and others in the CIRA
• about the risks of fraud and how they are addressed
• .• Consider the results of preliminary analytical procedures.
• • Consider the existence of fraud risk factors
• .• Consider certain other information

• of risk assessment procedures to
• obtain an understanding of the CIRA and provide a basis for the
• assessment of risks, can the auditor use information gathered from
• procedures performed in a prior period and limit the extent of current
• year procedures? The answer is a qualified “yes.”

• a significant amount of knowledge
• is gained during the audit. The auditor's previous experience with the
• entity also contributes to the understanding of the entity and its
• environment.

• • The CIRA's organizational structure, operations, and controls.
• • Past misstatements and whether they were corrected on a timely basis.

• the auditor should determine
• whether changes have occurred that may affect its relevance in the
• current audit. The auditor is interested in identifying changes in
• personnel; procedures; processes; contracts; services; contingencies;
• facilities; nature of the operations; management; financial condition;
• pressures to meet budgets; conditions and events or operating results
• that are relevant to the going concern assumption; loan covenants;
• litigation status; control environment or activities; fraud risks;
• management attitude toward, or pressures on, the auditors; scope of the
• engagement; and any other internal or external conditions that might be
• of audit significance.

• the auditor should perform some
• risk assessment procedures in the current audit to determine whether
• changes have occurred that impact the relevance of information gathered
• in previous audits. For example, auditors might perform inquiries of key
• client personnel, supplemented by observation and inspection (for
• example, review of budgets and walkthroughs) to determine if changes
• have occurred.

• continuing engagements than in
• initial engagements, consisting primarily of sufficient procedures to
• identify and evaluate changes that have occurred that may affect the
• relevance of such information in the current year

• • The information relates directly to a past misstatement or risk of material misstatement identified in the prior year.
• • Other information obtained through risk assessment procedures indicates a possible significant change in the current year.
• • There is a greater likelihood that significant changes will occur given the nature of the information.
• The following paragraphs address the risk assessment procedures listed in paragraph 604.17 and their role in identifying and assessing risk.

• —posing a question or requesting
• information on a matter, evaluating the response, and following up to
• obtain additional information as needed. As such, inquiry can be an
• extremely effective procedure in identifying risks. For example, an
• auditor might ask management about delinquent assessments. The auditor
• would then evaluate the response obtained and determine if a potential
• risk exists. In this case, the auditor is concerned about potential
• inappropriate valuation of assessments receivable. If the auditor deems
• that there is an indication of this risk, additional inquiries might be
• posed to further identify the risk and determine whether other risk
• assessment procedures are necessary.

• used alone when identifying and
• assessing risks. Auditors are required to use inquiry, analytical
• procedures, and observation and inspection during the risk assessment
• process. Furthermore, auditors are prohibited from only using inquiry
• when evaluating the design and implementation of internal control.

a. The aspects of the entity and its environment as enumerated in SAS No. 109 (AU 314.21) and explained in sections 605 and 606.

• b.
• The information about fraud, suspected fraud, fraud-related programs
• and controls, and risks of fraud as enumerated in SAS No. 99 (AU 316.20-.21).

• a. Those Charged with Governance. Their involvement in the financial reporting process and how financial statements are used. [SAS No. 99 (AU 316.22)
• requires the auditor to inquire directly of those charged with
• governance (or the audit committee or at least its chair) about the
• risks of fraud and their knowledge of fraud or suspected fraud.]

• b. Internal Audit.
• Activities concerning the design and effectiveness of internal
• control and management's responses to any findings by the internal audit
• function, if the CIRA has an internal audit function. [SAS No. 99 (AU 316.23)
• requires inquiry of internal audit personnel about risks of fraud,
• knowledge of fraud or suspected fraud, and activities concerning fraud
• detection.]

• c. Other Employees. Their role in
• the financial reporting process and additional or corroborating
• information to support management's responses. [SAS No. 99 (AU 316.24)
• requires inquiry of others within the CIRA, determined through the
• auditor's judgment, about the existence or suspicion of fraud.] Auditors
• may consider obtaining the perspective of employees from different
• functional areas and at varying levels of authority when identifying
• risks of material misstatement.

• d. Parties Outside the CIRA.
• Inquiries of parties outside the CIRA are not required but are
• procedures that might be helpful. For example, the auditor might find it
• useful to make inquiries of external legal counsel or of valuation
• experts that management has engaged. The auditor might also find it
• useful to make inquiries of developers/sponsors, members, suppliers, or
• regulators to better understand the nature of the CIRA and its
• operations.

• Their knowledge of any actual fraud or suspicions of fraud affecting the CIRA.

• Their awareness of any allegations of fraud or suspected fraud affecting the CIRA.

• •
• Their understanding of the risks of fraud within the CIRA, including
• any specific fraud risks the CIRA has identified or account balances or
• transaction classes that may be susceptible to fraud.

• How they communicate to employees the importance of ethical behavior and appropriate business practices.

• •
• Programs and controls the CIRA has implemented to address identified
• fraud risks or otherwise help prevent, deter, and detect fraud and how
• those programs and controls are monitored.

• • If
• applicable, the nature and extent of monitoring multiple locations or
• operating segments (for example, developer operations) and whether any
• of them have a higher level of fraud risk.

• • If
• applicable, whether they have reported to those charged with governance
• about how the CIRA's internal control serves to prevent, deter, and
• detect material misstatements due to fraud.

• perspectives on financial statement areas and organizational areas and
• locations with a risk of fraud and identifying whether anyone has
• suspicions or actual knowledge of fraud.

• The CIRA's president.

• The treasurer or other equivalent governing individual

.• Members of the board of directors.

• The managing agent, if any.• The CIRA's bookkeeper.

obtaining an understanding of the entity and its environment.

• an example for documenting inquiries of specific personnel indicating
• that auditors may document the date of the inquiry, name and job
• description of the individual queried, and the nature of the inquiry.
• The authors recommend documenting these identifying characteristics when
• performing risk assessment inquiry procedures.

planning the nature, timing, and extent of other auditing procedures.

• a. Enhancing the auditor's understanding of the client's business
• and the transactions and events that have occurred since the last audit
• date.

b. Identifying areas that may represent specific risks relevant to the audit.

• what relationships would be expected to exist, what relationships would
• be considered unusual or unlikely, and what plausible explanations might
• exist for observed relationships.

• the CIRA and its environment before performing preliminary analytical
• procedures. The auditor's knowledge and understanding of the CIRA can
• also be improved by applying preliminary analytical procedures in audit
• planning.

• In the audit of a small CIRA, simple comparisons and ratios, combined
• with inquiries of financial and operating management, are ordinarily
• effective, and the auditor normally need not make use of complex
• mathematical or statistical models. Depending on the facts and
• circumstances, analytical procedures may be limited to comparing the
• major account balances shown in the unadjusted general ledger with the
• financial statements for the prior year. A comparison of significant
• account balances with prior period amounts can improve the auditor's
• understanding of the entity and its operations. For example, are there
• significant fluctuations in assessment revenue and receivables? Do
• changes in laundry revenue make sense in relation to changes in water
• and gas usage?

• revenue to identify unusual or unexpected relationships that may
• indicate fraudulent financial reporting. Ordinarily, comparison of
• current and prior-period account balances for revenue accounts will not
• be sufficient to achieve that objective, and other types of analytical
• procedures should be used.

• • Analysis of Relationships Between Financial and Nonfinancial Amounts.
• When comparing financial and nonfinancial amounts, it may be most
• effective to use a base that (a) would be expected to have a reasonable
• relationship to revenue, and (b) could not easily be manipulated by
• management. For example, auditors may compare assessments revenue, as
• determined from recorded revenue amounts, with units in the CIRA
• development. Assessment revenue in excess of projected estimates may
• indicate the recording of fictitious revenue

• .• Trend Analysis.
• Auditors may analyze trends in the components of revenue or
• transaction types. It may be helpful to look at several trends or
• relationships to identify inconsistencies or unusual patterns. For
• example, the auditor might perform a trend analysis of assessment
• revenue by month.

• • Ratio Analysis. Ratio
• analysis is the analysis of relationships between financial statement
• items by computing the ratio of one financial statement item to another.
• The ratio may be compared to the same ratio for a prior period (or
• several prior periods) to identify unusual or significant variations.
• For example, receivables turnover, the allowance for uncollectible
• accounts as a percentage of receivables, and bad debt expense as a
• percentage of revenues are activity ratios related to assessments
• receivable that may be useful. However, many other common ratios, such
• as the current ratio or debt to equity ratio, are less meaningful
• because of a CIRA's simple financial structure. Ratios that use
• information that management generally is unable to manipulate, such as
• clash flows, may be most effective in revealing indications of
• fraudulent financial reporting.

• • Budgetary Comparison.
• Comparison of actual amounts with budgets may also indicate unusual
• variations. For example, revenue might significantly exceed budget
• because of improper revenue recognition.

• the auditor should consider those results in identifying risks of
• material misstatement of the financial statements due to fraud.

• of the entity and its environment,
• including its internal control. There are a number of ways to use
• observation and inspection when assessing risk. When obtaining an
• understanding of the CIRA and its environment, observation or inspection
• might be the key procedure that enables the auditor to fully obtain
• pertinent information and identify related risks. For example, to gain
• an understanding of the CIRA's financing arrangements and underlying
• covenants, the auditor might decide to review the CIRA's loan agreements
• and other related documents. That procedure, coupled with a review of
• the CIRA's financial statements, might be the key procedure that helps
• the auditor identify risks related to potential noncompliance with loan
• covenants.

• when evaluating the design and
• implementation of the CIRA's system of internal control, members of
• management might tell the auditor that they communicate the importance
• of ethical values to employees through a written code of conduct and by
• example. The auditor might wish to corroborate this response by
• examining the written code. In addition, the auditor may determine that a
• risk exists based on observation of management's current and past
• interactions with employees that contradict the behavior standards in
• the written code.

• To understand the design of internal controls related to the audit.

• To verify that controls have been implemented, for example, as part of a walkthrough.

• When responses to inquiries indicate a potential risk for a significant account.

• When responses to inquiries are inconclusive, conflicting, or prove to be incorrect.

• In combination with inquiry to fully understand a matter.

• When required information can only or best be obtained through observation or inspection

• .• When the evidence gathered through observation and inspection can also be used for a substantive procedure.
• •
• In recurring engagements, to determine whether changes have occurred
• that affect the continued relevance of the information gathered in a
• prior period. (See the discussion beginning at paragraph 604.22.)

• • For an inspection of documents, identify the item inspected, for
• example, by indicating the title and date of the report or the document
• name and number. (To facilitate inquiring about or requesting copies of
• the report or document at a later time, the author's recommend referring
• to the report or document by the same name that the client uses to
• refer to it.)

• • For an observation procedure, document
• the process or subject matter observed, individuals involved and their
• titles, and where and when the observation was carried out.