Entity risk assessment process

The entity’s risk assessment process identifies business risks relevant to objectives, assesses their significance and likelihood, and determines how to address them. The auditor considers whether the process is appropriate to the entity and the financial-reporting risks. For example, management may identify a new product or regulation as creating reporting risks, assess the likely effect and select a response. The auditor considers how the process operates and whether relevant risks have been identified, rather than substituting it for the auditor’s risk assessment.