chp 9 - audit risk model

phase 1 of audit planning

plan and design an audit approach based on risk assessment procedures

what part of phase 1 deals with audit risk

• set materiality and assess acceptable audit risk and inherent risk

• understand internal control and assess control risk

• gather information to assess fraud risks

• develop overall audit strategy and audit program

risk of material misstatement

While planning procedures to obtain audit evidence, auditors consider risk at both the overall F/S and relevant assertion level

• (i.e. classes of transactions, account balances, and presentation and disclosures)

overall financial statement level

• issues with management integrity or competence

• ineffective BOD oversight

• ineffective internal control systems

assertion level

• think about assertions and audit objectives from chapter 6

  • we identify a risk for each assertion for each balance, transaction, and disclosure

  • each risk is comprised of two components: inherent risk and control risk

Example: Sales

Assertion – Occurrence

Risk - Sales transactions that are recorded are to fictitious customers

• To determine how much work we need to do related to that assertion and risk, we assess both Inherent Risk & Control Risk

acronyms for the audit risk model

• PDR = Planned Detection Risk

• AAR = Acceptable Audit Risk

• IR = Inherent Risk

• CR = Control Risk

PDR formula & AAR formula

PDR = AAR/(IR x CR)

AAR = (IR x CR) x PDR

definitions of risk types

• acceptable audit risk: likelihood that material misstatement exists after audit and auditor issued unqualified opinion (i.e., audit failed to detect MM)

• inherent risk: likelihood of material misstatements generated, before considering client’s internal controls

• control risk: likelihood of material misstatements will not be prevented or detected by client’s internal controls

  • IR x CR = Risk of Material Misstatement

• planned detection risk: likelihood that audit procedures fail to detect material misstatement

acceptable audit risk

measure of how willing the auditor is to accept that the F/S may be materially misstated after the audit and an unqualified opinion was issued (i.e., the risk that auditors issue a clean opinion when they shouldn’t have)

the assessment of AAR is based on:

• engagement risk: the risk that the auditor will suffer harm after the audit is finished, even though the audit report was correct (i.e., the likelihood that the auditor will have to defend their work)

• AAR = 0% is CERTAINTY; AAR = 100% is TOTAL UNCERTAINTY

• terms audit assurance, overall assurance, or level of assurance all represent 1-AAR

• AAR is POSITIVELY related to PDR (inversely related to planned evidence)

acceptable audit risk diagram

• usually assess during planning for entire audit

• auditors usually want to keep AAR low

inherent risk

auditor’s assessment of the susceptibility of an assertion to material misstatement, before considering the effectiveness of internal controls

• where are misstatements most likely to occur, just BECAUSE?

• INVERSELY related to PDR (positively related to planned evidence)

• assessed for each cycle, account, and often assertion

assessing inherent risk

auditor tries to predict which segments within the company are likely to be misstated

• IR does not change based on what the auditor does

  • the auditor assesses and considers effect on evidence, but DOES NOT and CANNOT alter the risk that is inherent to the client

  • assessment begins during the planning and is updated throughout the audit

factors that affect the assessment of IR

• nature of client’s business (electronics company w/ obsolete inventory)

• results of previous audits (any misstatements in prior years?)

• initial v. repeat engagement (higher risk in first year of audit)

• complex or nonroutine transactions (complex investments, restructuring)

• accounts requiring judgment (asset impairment, allowance for A/R)

• makeup of the population (A/R with old balances or new?)

control risk

auditor’s assessment of the risk that a material misstatement could occur in an assertion and not be prevented or detected by the client’s internal controls

• assessed (not set! unless auditor is not relying on IC) based on auditor’s understanding of how well the client’s internal controls are designed and operating

• degree of auditor’s reliance on controls:

  • assess CR as HIGH (100%) if auditor does not want to rely on client’s IC at all — small public and private companies

  • reduce CR assessment if auditor wants to rely on client’s IC to reduce audit work

• INVERSELY related to PDR (Positively related to planned evidence)

assessing control risk

initial assessment of control risk:

• obtained through gaining an understanding of the entity and their control environment

  • assessing the control environment

  • evaluating design and implementation of controls

updated assessment of control risk:

• updated throughout the audit based on results of control procedures

• it may change, it may not, but we should reassess in light of any new information

  • ineffective control design? reassess control risk

  • effectively designed but not implemented? reassess control risk

  • effectively designed and implemented but not operating as intended? reassess control risk

IR x CR = Risk of Material Misstatement

• the auditor may make a combined assessment of inherent risk and control risk which is known as the risk of material misstatement

• you can think of the risk of material misstatement as the risk that the financial statements are materially misstated prior to the audit

planned detection risk

the risk that audit evidence for an audit objective will fail to detect misstatements exceeding performance materiality

• PDR is determined by other factors (AAR, IR, CR)

• PDR has an inverse relationship with the amount of evidence auditors plan to accumulate

  • so a lower planned detection risk means more audit evidence will need to be accumulated (to achieve AAR)

responding to assessed risks chart

limitations of the audit risk model

• the desired level of audit risk may not actually be achieved (will we ever know the achieved levels?)

• it does not consider potential auditor error

• there is no way of knowing what the preliminary level of risk actually was