## Risk Assessment Procedures: Inquiry and Observation & Inspection (SA 315)
### Overview
The auditor uses three risk assessment procedures to understand the entity:
1. Inquiry
2. Observation & Inspection
3. Analytical Procedures
This lesson covers the first two.
---
### 1. Inquiry
Inquiry means asking questions of relevant persons — both inside and outside the entity.
| Source of Inquiry | Information Obtained |
|---|---|
| Management & Those Charged with Governance | Overall strategy, significant decisions, internal controls |
| Internal Audit Personnel | Control weaknesses, prior audit findings |
| Employees initiating/processing complex transactions | Actual transaction flow, system gaps |
| Legal / Compliance Counsel | Litigation, regulatory exposure |
| Marketing / Sales Personnel | Marketing strategies, sale trends, customer contractual arrangements |
| IT / Information System Personnel | IT-related risks |
| Risk Management Function | Regulatory risks impacting financial reporting |
> Key Insight: Inquiry alone is not sufficient. It must be corroborated by other procedures.
---
### 2. Observation & Inspection
These procedures support and supplement inquiries made of management and others, and provide information about the entity and its environment.
What can be observed or inspected?
- Entity operations (physical flow of goods, activities)
- Documents & Records — internal control manuals, business plans & strategy
- Entity premises and business facilities
- Management-prepared reports — quarterly management reports, minutes of board/management meetings
> Mnemonic: ODRM — Operations, Documents/Records, Premises/facilities, Reports by management