HKSA 330 - Responses to Assessed Risks (Condensed)

Introduction & Key Definitions

Scope & Objective

HKSA 330 deals with the auditor's responsibility to design and implement responses to risks of material misstatement identified per HKSA 315 (Revised 2019). The objective is to obtain sufficient appropriate audit evidence regarding assessed risks.

Key Definitions

Overall Responses

Requirement

The auditor shall design and implement overall responses to address assessed risks of material misstatement at the financial statement level.

Examples of Overall Responses

• Emphasizing professional skepticism to the engagement team.
• Assigning more experienced staff or using experts.
• Changing direction, supervision, and review of work.
• Incorporating unpredictability in further audit procedures.
• Adjusting overall audit strategy (e.g., performance materiality, reliance on controls, nature/timing/extent of substantive procedures).

Further Audit Procedures

General Requirement

The auditor shall design and perform further audit procedures whose nature, timing, and extent are based on and responsive to assessed risks at the assertion level.

Design Considerations

• Consider reasons for risk assessment: inherent risk (likelihood and magnitude) and control risk (whether controls are relied upon).
• Obtain more persuasive audit evidence for higher assessed risks.

Three Dimensions

Tests of Controls

When Required

The auditor shall perform tests of controls if: (a) the risk assessment includes an expectation that controls are operating effectively, or (b) substantive procedures alone cannot provide sufficient appropriate audit evidence.

Design & Performance

• Obtain more persuasive evidence the greater the reliance on the control.
• Perform other audit procedures in combination with inquiry (inquiry alone is insufficient).
• Determine whether controls depend on other (indirect) controls and test those if necessary.

Extent Considerations

• Frequency of control performance.
• Length of reliance period.
• Expected deviation rate.
• Relevance and reliability of evidence.
• Evidence from other related controls.

Timing of Tests of Controls

General Rule

Test controls for the particular time or throughout the period for which the auditor intends to rely on them.

Interim Period Evidence

If evidence obtained during an interim period, obtain evidence about significant changes after the interim period and determine additional evidence needed for the remaining period.

Using Previous Audit Evidence

• Consider effectiveness of internal control components, control characteristics (manual vs. automated), general IT controls, past deviations, personnel changes, and changing circumstances.
• If no changes, test controls at least once every third audit, and test some controls each audit.
• If changes affect continuing relevance, test in the current audit.

Evaluating Operating Effectiveness

Key Requirements

• Evaluate whether misstatements detected by substantive procedures indicate controls are not operating effectively.
• Absence of misstatements does not provide evidence that controls are effective.
• If deviations are detected, make inquiries to understand them and determine whether: (a) tests provide an appropriate basis for reliance, (b) additional tests are needed, or (c) risks need to be addressed using substantive procedures.

Substantive Procedures

General Requirement

Irrespective of assessed risks, the auditor shall design and perform substantive procedures for each material class of transactions, account balance, and disclosure.

External Confirmations

Consider whether external confirmation procedures are to be performed. They are often relevant for bank balances, accounts receivable, inventories held by third parties, property titles, investments, and amounts due to lenders.

Significant Risks

If a risk is significant, perform substantive procedures specifically responsive to that risk. If the approach consists only of substantive procedures, those procedures shall include tests of details.

Timing of Substantive Procedures

• If performed at an interim date, cover the remaining period with substantive procedures combined with tests of controls, or further substantive procedures only.
• If unexpected misstatements are detected at an interim date, evaluate whether the risk assessment and planned procedures need modification.

Evaluation & Documentation

Adequacy of Presentation

Perform procedures to evaluate whether the overall presentation of the financial statements is in accordance with the applicable financial reporting framework, including classification, description, structure, and content.

Evaluating Sufficiency of Evidence

• Before conclusion, evaluate whether risk assessments remain appropriate.
• Conclude whether sufficient appropriate audit evidence has been obtained, considering all relevant evidence.
• If insufficient, attempt to obtain further evidence; if unable, express a qualified opinion or disclaim an opinion.

Documentation Requirements

• Document overall responses, nature/timing/extent of further audit procedures, linkage to assessed risks, and results.
• If using previous audit evidence for controls, document conclusions about reliance.
• Demonstrate that financial statement information agrees or reconciles with underlying accounting records.