Auditing C4

Audit Risk (AR)

The risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated (issuing an unqualified opinion on materially misstated financials).

Components of Audit Risk at the Assertion Level

The risk of material misstatement (combining inherent risk and control risk) and detection risk.

Inherent Risk (IR)

The susceptibility of an assertion about a class of transaction, account balance, or disclosure to a material misstatement before consideration of any related controls.

Control Risk (CR)

The risk that a material misstatement in an assertion will not be prevented, or detected and corrected, on a timely basis by the entity's internal control.

Risk of Material Misstatement (RMM)

The combination of inherent risk and control risk (RMM = IR × CR), which is a function of the entity and its environment over which the auditor has little or no control.

Detection Risk (DR)

The risk that the procedures performed by the auditor to reduce audit risk will not detect an existing material misstatement.

Relationship Between Detection Risk and RMM

Detection risk has an inverse relationship to inherent risk and control risk (e.g., higher RMM requires a lower level of detection risk).

Audit Risk Model Equation

AR = RMM × DR (where RMM = IR × CR).

Engagement Risk

The risk that the auditor is exposed to financial loss or damage to their professional reputation from litigation, adverse publicity, or other events arising from the audited financial statements.

Three Steps in Using the Audit Risk Model at the Assertion Level

Set a planned level of audit risk, assess the risk of material misstatement, and determine the appropriate level of detection risk.

Sources of Inquiry for Risk Assessment

Management, financial reporting personnel, governance (board/audit committee), internal audit, employees handling unusual transactions, in-house legal counsel, production/marketing/sales, risk management, and IT personnel.

Observation and Inspection Procedures

Observing operations, inspecting documents/records/control manuals, reading reports, visiting premises/facilities, tracing transactions (walkthroughs), reviewing external information sources, and observing management behaviors (e.g., audit committee meetings).

Categories of the Entity to Understand

Nature of the entity, selection/application of accounting principles, industry/regulatory/external factors, objectives/strategies/business risks, entity performance measures, and system of internal control.

Additional Public Entity Risk Procedures (PCAOB)

Reading public info, observing/reading transcripts of earnings calls, reviewing significant unusual trading activity, understanding executive compensation arrangements with the compensation committee chair, and reviewing executive expense reimbursement policies.

Categories of Industry, Regulatory, and Other External Factors

Market and competition, product technology, energy supply costs, regulatory environment (accounting principles, industry practices, legislation, taxation, government policies, environmental requirements), and other external factors (general economic conditions, interest rates, inflation, currency revaluation).

Business Risks

Threats from significant conditions, events, actions, or inactions that could adversely affect the entity's ability to achieve its objectives through specific strategies.

Errors vs. Fraud

Errors are unintentional misstatements or omissions, whereas fraud involves intentional acts using deception to misstate financial statements.

Factual Misstatements

Misstatements about which there is no doubt and the exact amount is known (e.g., an error on a sales invoice pricing).

Judgmental Misstatements

Misstatements arising from management's unreasonable or inappropriate judgments concerning recognition, measurement, presentation, or disclosure.

Projected Misstatements

The auditor's best estimate of misstatements in a population, derived by projecting misstatements found in an audit sample to the entire population.

Fraudulent Financial Reporting

Intentional misstatements or omissions of amounts or disclosures designed to deceive financial statement users.

Misappropriation of Assets (Defalcation)

The theft of an entity's assets that causes the financial statements to be misstated (e.g., embezzling cash, stealing physical or intellectual property, paying for goods not received, or personal use of assets).

Fraud Risk Assessment Planning Steps

Discussion among audit team members, inquiries of management and the audit committee, identification and assessment of fraud risk factors, consideration of unusual analytical relationships, and understanding the period-end closing process.

Audit Team Discussion Requirements on Fraud

Discuss external/internal factors creating incentives/opportunities/rationalizations, management override of controls, earnings management indicators, maintaining professional skepticism, and potential auditor responses.

The Fraud Risk Triangle

The three conditions generally present when fraud occurs: incentives/pressures, opportunities, and attitudes/rationalizations.

Management Override of Controls

Management's ability to directly or indirectly manipulate accounting records and prepare fraudulent reports because of their unique position.

Financial Statement Level Risks (Pervasive Risks)

Risks that apply to multiple components in the financial statements rather than just specific assertions.

Auditor Responses to Pervasive Risks

Assigning more experienced personnel, evaluating accounting policy selection/bias for earnings management, and incorporating an element of unpredictability in audit procedures.

Examples of Significant Risks

Assertions with fraud risk factors, nonroutine transactions, significant estimates/judgments, complex transactions, new accounting standards, revenue recognition, and industry-specific issues.

Auditor Procedures When Fraud is Suspected

Attempt to obtain evidence to determine if material fraud occurred, consider implications for other audit areas, discuss with management at least one level above those involved, suggest management consult legal counsel, and consider withdrawing from the engagement.

Fraud Incentive/Pressure Risk Factors

Financial stability/profitability threatened (competition, rapid changes, operating losses, negative cash flows), excessive pressure to meet third-party expectations, and personal financial threats to management/board members.

Fraud Opportunity Risk Factors

Nature of industry/operations (related party transactions, subjective estimates, complex/unusual transactions, tax havens), ineffective monitoring of management (single-person domination, weak board oversight), complex/unstable organizational structure, and deficient internal controls.

Fraud Attitude/Rationalization Risk Factors

Ineffective communication of ethical standards, nonfinancial management participation in accounting choices, history of securities violations, excessive stock price interest, commitment to unrealistic forecasts, failure to correct known conditions, and strained auditor relations.

Asset Misappropriation Incentive Risk Factors

Personal financial obligations creating pressure for employees with access to cash/assets, and adverse relationships between the entity and those employees.

Asset Misappropriation Opportunity Risk Factors

Characteristics increasing asset susceptibility (large cash on hand) and inadequate internal control/oversight over assets (poor supervision of remote locations).

Asset Misappropriation Attitude/Rationalization Risk Factors

Disregard for monitoring/reducing asset risks, disregard for internal controls, employee displeasure or dissatisfaction, and unexplained changes in behavior or lifestyle.

Required Documentation for Risk Assessment & Fraud

Planning discussion details (participants, decisions, timing), procedures performed to understand the business/environment, identified risks, evaluation of management's response, assessment of error/fraud risk, additional procedures triggered by fraud risks, nature/timing/extent of fraud response procedures, and communications about error or fraud made to management/audit committee.

Reporting Requirements When Fraud is Found

Fraud involving senior management or causing a material misstatement must be reported directly to the audit committee; lower-level employee misappropriations follow an understanding reached with the audit committee.

General Rule on Disclosing Fraud Outside the Entity

Disclosure to parties outside senior management and the audit committee is ordinarily precluded by confidentiality obligations.

Exceptions Where Duty to Disclose Fraud Outside the Entity Exists

Complying with legal/regulatory requirements, responding to inquiries from a successor auditor, responding to a subpoena, or reporting to a funding/specified agency for entities receiving government financial assistance.