AUD, Auditing and Attestation

Sources for Understanding the Entity and Its Environment

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Understanding the Entity and Its Environment. The topic rests on AU-C 315.

About this topic

An auditor cannot decide what to test until the business itself makes sense. So the work starts by learning what the entity does, who it deals with, and where its numbers could go wrong.

Stated technically, the auditor builds an understanding of the entity and its environment in order to identify and assess the risks of material misstatement. Everything downstream flows from that assessment: the nature, the timing, and the extent of further procedures.

Key points

• Understanding the entity includes its industry, regulatory environment, operations, ownership, governance, and accounting policies.
• Risk assessment procedures include inquiry, analytical procedures, and observation/inspection.
• The auditor uses the understanding of the entity to identify areas where material misstatements are more likely.
• Related party transactions require specific identification and assessment because they may not occur at arm's length.

What the lessons cover

1. What the auditor seeks to understand
2. Risk assessment procedures
3. Inherent risk factors
4. Relevant assertions and significant classes, balances, and disclosures
5. The entity's system of internal control in risk assessment
6. Fraud in risk assessment: what the PCAOB adds
7. Where the frameworks part: AU-C 315 against PCAOB AS 2110

Authoritative references

Where these requirements sit in the literature.

• AU-C 315.12, the definitions paragraph, carries the five inherent risk factors, characteristics of events or conditions affecting an assertion's susceptibility to misstatement before consideration of controls:
  • complexity.
  • subjectivity.
  • change.
  • uncertainty.
  • susceptibility to misstatement due to management bias or other fraud risk factors.
• AU-C 315.12 also defines a relevant assertion as one carrying an identified risk of material misstatement determined on inherent risk without regard to controls, and with it a significant class of transactions, account balance, or disclosure as one having one or more relevant assertions. Both assertion sets are tabulated in the relevant assertions lesson.
• AU-C 315.14 defines risk assessment procedures as a closed set of three:
  • inquiries of management and of others within the entity.
  • analytical procedures.
  • observation and inspection.
  • They are performed in combination, so inquiry alone is insufficient, and they are distinct from the further audit procedures used to respond to assessed risks.
• AU-C 315.19 requires the understanding of the entity and its environment, including two matters:
  • relevant industry, regulatory, and other external factors.
  • the applicable financial reporting framework.
• AU-C 315.12 lists the five components of the entity's system of internal control:
  • the control environment.
  • the entity's risk assessment process.
  • the entity's process to monitor the system of internal control.
  • the information system and communication.
  • control activities.
• AU-C 315.34 provides that when the auditor does not plan to test operating effectiveness for an assertion, control risk is assessed at the maximum. Three requirements remain, and none supports an assessment below it:
  • the understanding of controls relevant to the audit.
  • the design evaluation.
  • the implementation determination.
• AU-C 315.12 defines a significant risk as an identified risk of material misstatement for which the assessment of inherent risk is close to the upper end of the spectrum of inherent risk, weighing likelihood and magnitude, before the effect of controls.
• AU-C 315 and AU-C 330 at section level carry what this lesson cites without a paragraph number, because no verified source here pins them:
  • the engagement team discussion including consideration of fraud.
  • the understanding of the nature of the entity, its objectives, strategies, and related business risks, and its measurement and review of financial performance.
  • the requirement to evaluate the design of controls relevant to the audit and determine implementation using procedures beyond inquiry.
  • the SAS No. 145 stand-back.
  • the requirement to understand the entity's controls relevant to a significant risk.
  • under AU-C 330, the specifically responsive substantive procedures plus current-period testing of any relied-upon control addressing a significant risk.

On the PCAOB side, by topic:

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.

See also

• Sources for every AUD topic
• Free AUD sample questions
• The CPA exam glossary