# SA 315 — Identifying & Assessing the Risks of Material Misstatement (ROMM)
## Objective of the Auditor
To identify and assess ROMM — whether due to fraud or error — at both:
- The Financial Statement (FS) level, and
- The Assertion level
This is done through understanding the entity, its environment and its Internal Control (IC) — these are called Risk Assessment Procedures (RAP). The result provides a basis for designing responses to assessed ROMM (as required by SA 330).
For this purpose, the auditor shall:
- Identify risks throughout the process of obtaining understanding of the entity
- Assess identified risks and evaluate whether they relate pervasively to FS as a whole
- Relate identified risks to what can go wrong at assertion level
- Consider the likelihood of misstatement, including possibility of multiple misstatements
## What Is Included in RAP?
### 1. Inquiries of Management and Others
Much information comes from management, but the auditor should also inquire from others within the entity:
| Source | Information sought |
|---|---|
| Marketing/sales personnel | Changes in marketing strategies, sales trends |
| Information System (IS) personnel | System changes, control failures, risks |
| Employees in complex/unusual transactions | Appropriateness of a/cing policy selection & application |
| Risk management function | Operational and regulatory risks affecting FR |
| In-house legal counsel | Litigation, compliance with L&R, knowledge/suspicion of fraud |
| Internal Audit (IA) personnel | IA procedures, design & effectiveness of IC, mgt's response |
### 2. Analytical Procedures (AP) as RAP
- May identify aspects of the entity of which the auditor was unaware
- Cover both financial and non-financial info
- Unusual relationships identified assist in detecting ROMM, especially due to fraud
### 3. Observation and Inspection
Examples — observing/inspecting:
- Entity's premises and plant facilities
- Entity's operations
- Documents and Records
- Reports prepared by Management and TCWG
## Understanding the Entity & Its Environment
The auditor shall obtain understanding of:
### (a) Nature of the Entity
- Ownership and governance structures
- Operations
- How the entity is structured and financed
- Types of investments — current and planned
Examples of matters:
- Business operations: nature of revenue sources, products/services, key customers and suppliers
- Financing activities: subsidiaries, debt structure
- Investing activities: capital investment, planned acquisitions
- FR: a/cing principles, revenue recognition practices
### (b) Entity's Objectives, Strategies & Related Business Risks
Business risk is broader than ROMM — it includes ROMM. Examples:
- Industry developments
- New products/services
- Expansion of business
### (c) Relevant Industry, Regulatory & Other External Factors (including AFRF)
- Industry factors: competitive environment, supplier/customer relationships, technological developments
- Regulatory factors: AFRF, legal and political environment
- Other external factors: general economic conditions, interest rates, availability of financing, inflation
### (d) Selection & Application of Accounting Policies
Including reasons for changes in a/cing policies.
### (e) Measurement & Review of Financial Performance
- Key Performance Indicators (KPIs) and key ratios
- Period-on-period performance analyses
- Budgets, forecasts, variance analyses
- Credit rating agency reports
## Understanding the Entity — A Continuous Process
This is continuous and dynamic — identifying, updating and analysing info throughout the audit. It establishes a frame of reference for professional judgment, for example when:
- Assessing ROMM
- Determining Materiality
- Identifying areas requiring special audit consideration
- Evaluating sufficiency and appropriateness of evidence
- Developing expectations for AP
- Considering appropriateness of selection/application of a/cing policies
## Identifying Significant Risks (Risks Requiring Special Audit Consideration)
In judging which risks are significant, the auditor shall consider:
- Whether risk is a risk of fraud
- Complexity of transactions
- Degree of subjectivity in measurement
- Whether risk involves significant transactions with Related Parties (RP)
- Whether risk involves non-routine or unusual transactions
- Whether risk relates to recent significant economic, a/cing or other developments
### Always Significant Risks
- ROMM due to fraud
- Significant transactions with RP outside normal course of business
### Non-Routine Transactions
Defined as transactions that are unusual due to size or nature, occurring infrequently.
## Why ROMM is Greater for Significant Non-Routine Transactions
- Greater management intervention to specify a/cing treatment
- Greater manual intervention in data collection/processing
- Nature of the transaction itself
- Complex calculations or a/cing policies
## Why ROMM is Greater for Significant Judgmental Matters
- A/cing policies for estimates may have different interpretations
- Required judgments may be subjective or concern future events
## Documentation Requirements
Auditor shall document:
- Understanding obtained regarding the entity, its environment, and RAP performed
- Risks identified and related controls about which understanding was obtained
- Identified and assessed ROMM at FS and assertion levels
- Discussion among engagement team and decisions taken