Understanding the Entity and Its Environment

This section requires the auditor to understand specified aspects of the entity and its
environment, and components of its internal control, in order to identify and assess the risks of material
misstatement. It encompasses the following:

 The purpose of obtaining an understanding of the entity and its environment, including its
internal control, is to identify and assess risks of material misstatement and to design and
perform procedures that respond to such risks.
 Risk assessment procedures include inquiries of management and client personnel, observation
and inspection procedures and various analytical procedures.
 The auditor is required to obtain a sufficient understanding of the five elements of internal
control to evaluate their design and operation.
 Substantive procedures must be performed for significant risks.
 Tests of controls are required only when substantive procedures alone are not sufficient to test
financial statement assertions, such as the completeness assertion for revenues.

As it has been for decades, the auditor's understanding of an entity and its environment is the
basis for risk assessment and designing auditing procedures that respond to identified risks. However,
identify risk assessment procedures such as inquiries, observations, inspections and analytical
procedures that are considered substantive evidence that supports the auditor's conclusions on financial
statements. This evidence can serve to reduce evidence previously required from more costly tests of
balances, even on small audits.

Further, inquiries, observations and inspections may be performed to obtain a sufficient

understanding of the five elements of internal control such as the control environment, risk assessment,
control activities, information and communication, and monitoring . For small audits, applying these
procedures to obtain a sufficient understanding of informal key controls applied by owners or managers
may even provide evidence that could reduce control risk to a level less than high.