Chapter 7 Risk Assessment and Inherent Risk

Overall goal of the audit risk model

To determine the risk of material misstatement (RMM) at the overall financial statement level (OSFL) and for the specific assertions related to classes of transactions, balances and disclosures. 

What is the Audit risk model

Assessing and managing risk is the key to conducting a quality audit. 

Acceptable Audit Risk (AAR)

is a measure of how willing the auditor is to accept that the financial statements may be materially misstated after the audit is completed and an unqualified audit opinion has been issued.

Factors that affect Acceptable Audit Risk (AAR)

• The degree to which external users rely on the financial statements.

• The likelihood that a client will have financial difficulties after the audit report is issued.

• The auditor’s evaluation of management integrity

Audit Risk (AR)

Is the risk that the auditor will express an inappropriate audit opinion when the financial statements are materially misstated.

how does the Audit risk model help auditors plan their risk response.

The model states that audit risk (AR) is a function of risk of material misstatement (which consists of inherent risk (IR), Control Risk (CR), and Detection Risk (DR)). 

RMM formula

Inherent Risk (IR) X Control Risk (CR)

Inherent risk (IR)

The auditor's assessment of the susceptibility to material misstatement of an assertion about a class of transactions, an account balance or disclosure, either individually or in the aggregate, before considering the effectiveness of related internal controls. 

Control Risk (CR)

The auditor’s assessment of the risk that a material misstatement could occur in an assertion about a class of transaction, an account balance, or a disclosure, and not be prevented or detected on a timely basis by the client’s internal controls.

Detection Risk (DR)

The risk is that auditors’ procedures will not be effective in detecting a material misstatement when one exists. 

What risk is the only component of audit risk that the auditor can control.

Detection Risk

Audit Risk

Inherent Risk (IR) X Control Risk (CR) X Detection Risk (DR)

Why is inherent risk included in the Audit Risk model

auditors should attempt to predict where misstatements are most and least likely in the financial statement segments. 

What relationship do IR and CR have with DR in relationship to amount of substantive audit evidence.

Inverse

Inherent risks factors

Events or conditions that affect the risk of material misstatement before the consideration of controls. These may be either quantitative or qualitative in nature. 

What type of risk is Nature of the client’s business

Inherent risk

What type of risk is First time audit client

Inherent risk

What type of risk is Results of previous audits / past misstatements, history of errors, or a significant amount of adjustments at year-end

Inherent Risk

What type of risk is Complex or nonroutine transactions

Inherent Risk

What type of risk is Related parties identification/measurement

Inherent Risk

What type of risk is Subjectivity/judgment required to correctly record account balances and transactions

Inherent risk

What type of risk is Uncertainty related to estimates/provisions

Inherent risk

What type of risk is Change in accounting standards, business model, environment

Inherent risk

What kind of risk is management motivation and biases/factors related to fraud risk factors/management integrity issues

Inherent Risk

What type of risk is a history of ongoing losses and liquidity problems that suggest going-concern issues

Inherent risk

Significant risks

inherent risk factors, either individually or in combination, that in the auditor’s professional judgement, have increased the likelihood of a misstatement occurring or the magnitude of the misstatement. 

Examples of significant risks

• Transactions for which there are multiple acceptable accounting treatments such that subjectivity is involved

• Accounting estimates that have high estimation uncertainty or complex models. Estimation uncertainty is often related to assumptions about future events, which are difficult to predict

• Account balances or quantitative disclosures that involve complex calculations

• Accounting principles that may be subject to differing interpretation

• Changes in the entity’s business that involve changes in accounting, fo example, mergers and acquisitions

•  Nonroutine related-party transactions

Risk response at the OSFL

• Assign more experienced staff or those with special skills or use experts

• Instruct the engagement team to use a heightened level of professional skepticism

• Increase involvement of audit partners and managers

• Closer supervision and review

• Incorporate additional elements of unpredictability in the selection of further audit procedures to be performed

• Consider if changes need to be made to the overall audit strategy (such as performance materiality, audit approach, nature, timing, and extent of substantive procedures)

Risk Response at the assertion level

• (1) tests of controls, if applicable 

• (2) substantive audit procedures that will test the specific assertions regarding the relevant classes of transactions, account balance and disclosures 

RAMP

RMM @ OSFL

Audit approach

Materiality

Procedures addressing RMM @ the assertion level

What is the process to preform a fraud risk assessment Step 1

Discuss with audit team members the risk of material misstatement due to fraud 

What is the process to preform a fraud risk assessment Step 2

Make inquiries of management, those in charge of governance, and others regarding the  process for identifying and responding to fraud risk

What is the process to preform a fraud risk assessment Step 3

Evaluate unusual/ unexpected relationships when performing analytical procedures 

What is the process to preform a fraud risk assessment Step 4

Evaluate the risk for revenue fraud and management override, and understand period end. 

Conditions for fraud

Incentives, Opportunities and attitudes / rationalization

Incentives / Pressures

Managers or other employees have incentives or pressures to commit fraud

Opportunities

Circumstances Provided opportunities for management or employees to commit fraud

Attitudes/ Rationalization

An attitude, character, or set of ethical values exists that allows management or employees to intentionally commit a dishonest act, or the environment imposes pressure sufficient to cause them to rationalize committing a dishonest act

What is the Fraud triangles requirement

All three elements of fraud must be present