Risk Assessment and Response to Assessed Risks

Page 1 of 7 AUDITING THEORY Risk Assessment and Response to Assessed Risks Related PSAs: PSA 400, 315 and 330 1. Which of the following is correct statement? a. The auditor should use professional judgment to assess audit risk and to design audit procedures to ensure it is eliminated. b. The auditor is an insurer, and his or her report constitutes a guarantee. c. The subsequent discovery that a material misstatement exists in the financial statements is evidence of inadequate planning, performance, or judgment on the part of the auditor. d. The auditor should obtain an understanding of the accounting and internal control systems sufficient to plan the audit and develop an effective audit approach. 2. According to PSA 400 – Risk Assessments and Internal Control, audit risk means a. The susceptibility of an account balance or class of transactions to misstatement that could be material, individually or when aggregated with misstatements in other balances or classes, assuming that there were no related internal controls. b. The risk that a misstatement, that could occur in an account balance or class of transactions and that could be material, individually or when aggregated with misstatements in other balances or classes, will not be prevented or detected and corrected on a timely basis by the accounting and internal control systems. c. The risk that an auditor’s substantive procedures will not detect a misstatement that exists in an account balance or class of transactions that could be material, individually or when aggregated with misstatements in other balances or classes. d. The risk that the auditor gives an inappropriate audit opinion when the financial statements are materially misstated. 3. Inherent risk and control risk differ from detection risk in that they a. Arise from the misapplication of auditing procedures. b. May be assessed in either quantitative or nonquantitative terms. c. Exist independently of the financial statement audit. d. Can be changed at the auditor’s discretion. 4. Inherent risk and control risk differ from detection risk in that inherent risk and control risk are a. Elements of audit risk while detection risk is not. b. Changed at the auditor’s discretion while detection risk is not. c. Considered at the individual account-balance level while detection risk is not. d. Functions of the client and its environment while detection risk is not. 5. Which of the following is an incorrect statement? a. Detection risk is a function of the effectiveness of an auditing procedure and its application. b. Detection risk arises partly from uncertainties that exists when the auditor does not examine 100 percent of the population. c. Detection risk arises partly because of other uncertainties that exist even if the auditor were to examine 100 percent of the population. d. Detection risk exists independently of the audit of the financial statements. 6. Which of the following is an incorrect statement? a. Detection risk cannot be changed at the auditor’s discretion. b. If individual audit risk remains the same, detection risk bears an inverse relationship to inherent and control risks. c. The greater the inherent and control risks the auditor believes exists, the less detection risk that can be accepted. d. The auditor might make separate or combined assessments of inherent risk and control risk. 7. Why would the auditor assess control risk? a. Because it indicates where inherent risk may be the greatest. b. Because it determines whether sampling risk is sufficiently low. c. Because it affects the level of detection risk the auditor may accept. d. Because it includes the aspects of nonsampling risk that are controllable. Page 2 of 7 8. The relationship between acceptable level of detection risk and the combined level of inherent and control risk is a. Direct b. Inverse c. Parallel d. Independent 9. The audit risk model consists of: AR = IR x CR x DR The detection risk is the dependent variable. What is the acceptable level of detection risk if the assessed level of Inherent risk is High and the Control risk is Low? a. Highest b. Medium c. Lower d. Higher 10. An auditor decides to increase the assessed level of control risk from that originally planned on the basis of audit evidence gathered and evaluated. To achieve an overall audit risk level that is substantially the same as the planned audit risk level, the auditor would a. Decrease substantive testing. c. Increase inherent risk. b. Increase materiality levels. d. Decrease detection risk. 11. As the acceptable level of detection risk decreases, the assurance directly provided from a. Substantive tests should increase. c. Substantive tests should decrease. b. Tests of controls should increase. d. Tests of controls should decrease. 12. Which of the following statements is true? a. If control risk is assessed at maximum, the nature of related substantive tests should be changed from more to less effective. b. If control risk is assessed at maximum, the nature of related substantive tests should be changed from less to more effective. c. If control risk is assessed at maximum, the timing of related substantive tests should be changed from year-end to an interim date. d. If control risk is assessed at maximum, the extent of related substantive tests should be changed from a larger to a smaller sample. 13. When the auditor determines that detection risk regarding a financial statement assertion for a material account balance or class of transactions cannot be reduced to an acceptable level, the auditor should express a. Qualified or adverse opinion c. Unqualified opinion with explanatory paragraph b. Qualified or disclaimer of opinion d. Unqualified opinion. 14. Which of the following is not a distinguishing feature of risk-based auditing? a. Identifying areas posing the highest risk of financial statement errors. b. Analysis of internal control. c. Collecting and evaluating evidence. d. Concentrating audit resources in those areas presenting the highest risk of financial statement errors. 15. Which of the following factors is not a good indicator of potential financial failure? a. Client is constantly short of cash and working capital. b. Client’s retained earnings were reduced by half as a result of a large dividend payout. c. Client relies heavily on debt financing, especially by financing permanent assets with short-term loans. d. Client has had increasing net losses for several years. PSA 315 – Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement 16. PSA 315 requires a. The auditor to obtain an understanding of the entity and its environment, including its internal control. b. Discussion among the engagement team about the susceptibility of the entity’s financial statements to material misstatement. c. The auditor to identify and assess the risks of material misstatement at the financial statement and assertion levels. d. All of the above. Page 3 of 7 17. Which of the following is incorrect regarding PSA 315? a. The purpose of this PSA is to establish standards and to provide guidance on obtaining an understanding of the entity and its environment, including its internal control, and on assessing the risks of material misstatement in a financial statement audit. b. This PSA requires the auditor to make risk assessments at the financial statement and assertion levels based on an appropriate understanding of the entity and its environment, including its internal control. c. The requirements and guidance of this PSA are to be applied in conjunction with the requirements and guidance provided in other PSAs. d. This PSA discusses the auditor’s responsibility to determine overall responses and to design and perform further audit procedures whose nature, timing, and extent are responsive to the risk assessments. 18. Which statement is incorrect regarding obtaining an understanding of the entity and its environment? a. Obtaining an understanding of the entity and its environment is an essential aspect of performing an audit in accordance with PSAs. b. That understanding establishes a frame of reference within which the auditor plans the audit and exercises professional judgment about assessing risks of material misstatement of the financial statements and responding to those risks throughout the audit. c. The auditor’s primary consideration is whether the understanding that has been obtained is sufficient to assess the risks of material misstatement of the financial statements and to design and perform further audit procedures. d. The depth of the overall understanding that is required by the auditor in performing the audit is equal to that possessed by management in managing the entity. 19. The main purpose of risk assessment procedures is to a. Obtain an understanding of the entity and its environment, including its internal control, to assess the risks of material misstatement at the financial statement and assertion levels. b. Test the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level. c. Detect material misstatements at the assertion level. d. All of the above. 20. The auditor should perform the following risk assessment procedures to obtain an understanding of the entity and its environment, including its internal control, except: a. Inquiries of management and others within the entity. b. Inquiries of the entity’s external legal counsel or of valuation experts that the entity has used. c. Analytical procedures. d. Observation and inspection. 21. Inquiries directed towards those charged with governance may most likely a. Relate to their activities concerning the design and effectiveness of the entity’s internal control and whether management has satisfactorily responded to any findings from these activities. b. Help the auditor understand the environment in which the financial statements are prepared. c. Relate to changes in the entity’s marketing strategies, sales trends, or contractual arrangements with its customers. d. Help the auditor in evaluating the appropriateness of the selection and application of certain accounting policies. 22. Which statement is incorrect regarding analytical procedures? a. Analytical procedures may be helpful in identifying the existence of unusual transactions or events, and amounts, ratios, and trends that might indicate matters that have financial statement and audit implications. b. In performing analytical procedures as risk assessment procedures, the auditor develops expectations about plausible relationships that are reasonably expected to exist. c. When comparison of those expectations with recorded amounts or ratios developed from recorded amounts yields unusual or unexpected relationships, the auditor considers those results in identifying risks of material misstatement. d. When such analytical procedures use data aggregated at a high level (which is often the situation), the results of those analytical procedures provide a clear-cut indication about whether a material misstatement may exist. Page 4 of 7 23. Which statement is incorrect regarding the discussion among the engagement team about the susceptibility of the entity’s financial statements to material misstatements? a. The members of the engagement team should discuss the susceptibility of the entity’s financial statements to material misstatements. b. The objective of this discussion is for members of the engagement team to gain a better understanding of the potential for material misstatements of the financial statements resulting from fraud or error in the specific areas assigned to them, and to understand how the results of the audit procedures that they perform may affect other aspects of the audit. c. The discussion provides an opportunity for more experienced engagement team members, including the engagement partner, to share their insights based on their knowledge of the entity, and for the team members to exchange information about the business risks. d. All the team members should have a comprehensive knowledge of all aspects of the audit. 24. The auditor’s understanding of the entity and its environment consists of an understanding of the following aspects: I. Industry, regulatory, and other external factors, including the applicable financial reporting framework. II. Nature of the entity, including the entity’s selection and application of accounting policies. III. Objectives and strategies and the related business risks that may result in a material misstatement of the financial statements. IV. Measurement and review of the entity’s financial performance. V. Internal control. a. All of the above c. I, II and III b. I, II, III and IV d. I, II, III and V 25. Nature of an entity refers to a. The entity’s operations, its ownership and governance, the types of investments that it is making and plans to make, the way that the entity is structured and how it is financed. b. The overall plans for the entity. c. The operational approaches by which management intends to achieve its objectives. d. The result of significant conditions, events, circumstances, actions or inactions that could adversely affect the entity’s ability to achieve its objectives and execute its strategies, or the setting of inappropriate objectives and strategies. 26. Which statement is correct regarding business risks? a. The risk of material misstatement of the financial statements is broader than business risk, though it includes the latter. b. The auditor should identify or assess all business risks. c. All business risks give rise to risks of material misstatement. d. A business risk may have an immediate consequence for the risk of misstatement for classes of transactions, account balances, and disclosures at the assertion level or the financial statements as a whole. 27. A potential business risk created by industry developments may most likely include a. Increased product liability. b. increased legal exposure c. The entity does not have the personnel or expertise to deal with the changes in the industry. d. Loss of financing due to the entity’s inability to meet financing requirements. 28. The following are examples of conditions and events that may indicate the existence of risks of material misstatement, except a. Operations in regions that are economically stable. b. Pending litigation and contingent liabilities. c. Application of new accounting pronouncements. d. Entities or business segments likely to be sold. 29. Which of the following conditions and events may most likely indicate the existence of risks of material misstatement? a. Having personnel with appropriate accounting and financial reporting skills. b. Accounting measurements that involve simple processes. c. Significant amount of routine or systematic transactions. d. Constraints on the availability of capital and credit. Page 5 of 7 30. Which statement is incorrect regarding significant risks that require special audit consideration? a. The auditor should determine which of the risks identified are, in the auditor’s judgment, risks that require special audit consideration. b. The auditor excludes the effect of identified controls related to the risk to determine whether the nature of the risk, the likely magnitude of the potential misstatement including the possibility that the risk may give rise to multiple misstatements, and the likelihood of the risk occurring are such that they require special audit consideration. c. Routine, non-complex transactions that are subject to systematic processing are more likely to give rise to significant risks because they have higher inherent risks. d. Significant risks are often derived from business risks that may result in a material misstatement. 31. Examples of situations where the auditor may find it impossible to design effective substantive procedures that by themselves provide sufficient appropriate audit evidence that certain assertions are not materially misstated include the following: I. An entity that conducts its business using IT to initiate orders for the purchase and delivery of goods based on predetermined rules of what to order and in what quantities and to pay the related accounts payable based on system-generated decisions initiated upon the confirmed receipt of goods and terms of payment. No other documentation of orders placed or goods received is produced or maintained, other than through the IT system. II. An entity that provides services to customers via electronic media (for example, an Internet service provider or a telecommunications company) and uses IT to create a log of the services provided to its customers, initiate and process its billings for the services and automatically record such amounts in electronic accounting records that are part of the system used to produce the entity’s financial statements. a. I and II b. I only c. II only d. Neither I nor II PSA 330 – The Auditor’s Procedures In Response to Assessed Risks 32. PSA 330 requires the auditor to a. Determine overall responses to address risks of material misstatement at the financial statement level. b. Design and perform further audit procedures, including tests of the operating effectiveness of controls, when relevant or required, and substantive procedures, whose nature, timing, and extent are responsive to the assessed risks of material misstatement at the assertion level. c. Evaluate whether the risk assessment remain appropriate and to conclude whether sufficient appropriate audit evidence has been obtained. d. All of the above. 33. The auditor should determine overall responses to address the risks of material misstatement at the financial statement level. Such responses least likely include a. Emphasizing to the audit team the need to maintain professional skepticism in gathering and evaluating audit evidence. b. Assigning more experienced staff or those with special skills or using experts. c. Incorporating additional elements of unpredictability in the selection of further audit procedures to be performed. d. Performing substantive procedures at an interim date instead of at period end. 34. The assessment of the risks of material misstatement at the financial statement level is affected by the auditor’s understanding of the control environment. Weaknesses in the control environment ordinarily will lead the auditor to a. Have more confidence in internal control and the reliability of audit evidence generated internally within the entity. b. Conduct some audit procedures at an interim date rather than at period end. c. Modify the nature of audit procedures to obtain more persuasive audit evidence. d. Decrease the number of locations to be included in the audit scope. 35. The auditor should design and perform further audit procedures whose nature, timing, and extent are responsive to the assessed risks of material misstatement at the assertion level. Which of the following is the most important consideration in responding to the assessed risks? a. The nature of the audit procedures. c. The timing of the audit procedures. b. The extent of the audit procedures. d. All of these are equally important. Page 6 of 7 36. The auditor’s assessment of the identified risks at the assertion level provides a basis for considering the appropriate audit approach for designing and performing further audit procedures. Which of the following is incorrect? a. The auditor may determine that only by performing tests of controls may the auditor achieve an effective response to the assessed risk of material misstatement for a particular assertion. b. The auditor may determine that performing only substantive procedures is appropriate for specific assertions and, therefore, the auditor excludes the effect of controls from the relevant risk assessment. c. The auditor needs to be satisfied that performing only substantive procedures for the relevant assertion would be effective in reducing the risk of material misstatement to an acceptably low level. d. The auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure only when the auditor uses the substantive approach. 37. Which statement is incorrect regarding the nature of further audit procedures? a. The nature of further audit procedures refers to their purpose and their type. b. Certain audit procedures may be more appropriate for some assertions than others. c. The higher the auditor’s assessment of risk, the less reliable and relevant is the audit evidence sought by the auditor from substantive procedures. d. The auditor is required to obtain audit evidence about the accuracy and completeness of information produced by the entity’s information system when that information is used in performing audit procedures. 38. Which statement is incorrect regarding the timing of further audit procedures? a. Timing refers to when audit procedures are performed or the period or date to which the audit evidence applies. b. The auditor may perform tests of controls or substantive procedures at an interim date or at period end. c. If the auditor performs tests of controls or substantive procedures prior to period end, the auditor considers the additional evidence required for the remaining period. d. All audit procedures can be performed prior to period end. 39. Which statement is incorrect regarding the extent of further audit procedures? a. Extent includes the quantity of a specific audit procedure to be performed. b. The extent of an audit procedure is determined by the judgment of the auditor after considering the materiality, the assessed risk, and the degree of assurance the auditor plans to obtain. c. The auditor ordinarily decreases the extent of audit procedures as the risk of material misstatement increases. d. Increasing the extent of an audit procedure is effective only if the audit procedure itself is relevant to the specific risk. 40. Which statement is incorrect regarding tests of controls? a. Tests of controls are required under certain circumstances. b. Tests of controls are required when an entity conducts its business using IT and no documentation of transactions is produced or maintained, other than through the IT system. c. Tests of the operating effectiveness of controls are performed only on those controls that the auditor has determined are suitably designed to prevent, or detect and correct, a material misstatement in an assertion. d. Testing the operating effectiveness of controls is the same as obtaining audit evidence that controls have been implemented. 41. Which statement is incorrect regarding the nature of tests of controls? a. As the planned level of assurance increases, the auditor seeks more reliable audit evidence. b. Those controls subject to testing by performing inquiry combined with inspection or reperformance ordinarily provide more assurance than those controls for which the audit evidence consists solely of inquiry and observation. c. The absence of misstatements detected by a substantive procedure provides audit evidence that controls related to the assertion being tested are effective. d. A material misstatement detected by the auditor’s procedures that was not identified by the entity ordinarily is indicative of the existence of a material weakness in internal control. Page 7 of 7 42. Which statement is incorrect regarding the timing of tests of controls? a. Audit evidence pertaining only to a point in time may be sufficient for the auditor’s purpose, for example, when testing controls over the entity’s physical inventory counting at the period end. b. If the auditor plans to rely on controls that have changed since they were last tested, the auditor should test the operating effectiveness of such controls in the current audit. c. If the auditor plans to rely on controls that have not changed since they were last tested, the auditor should test the operating effectiveness of such controls at least once in every second audit. d. When there are a number of controls for which the auditor determines that it is appropriate to use audit evidence obtained in prior audits, the auditor should test the operating effectiveness of some controls each audit. 43. Which statement is incorrect regarding the extent of tests of controls? a. The auditor designs tests of controls to obtain sufficient appropriate audit evidence that the controls operated effectively throughout the period of reliance. b. The more the auditor relies on the operating effectiveness of controls in the assessment of risk, the lesser is the extent of the auditor’s tests of controls. c. If the rate of expected deviation is expected to be too high, the auditor may determine that tests of controls for a particular assertion may not be effective. d. Because of the inherent consistency of IT processing, the auditor may not need to increase the extent of testing of an automated control. 44. Which statement is incorrect regarding substantive procedures? a. Substantive procedures are performed in order to detect material misstatements at the assertion level, and include tests of details of classes of transactions, account balances, and disclosures and substantive analytical procedures. b. The auditor always performs substantive procedures for each class of transactions, account balance, and disclosure. c. When the auditor has determined that an assessed risk of material misstatement at the assertion level is a significant risk, the auditor should perform substantive procedures that are specifically responsive to that risk. d. In order to obtain sufficient appropriate audit evidence, the substantive procedures related to significant risks are most often designed to obtain audit evidence with high reliability. 45. The auditor’s substantive procedures should include the following audit procedures related to the financial statement closing process: I. Agreeing the financial statements to the underlying accounting records. II. Examining material journal entries and other adjustments made during the course of preparing the financial statements. a. I and II b. I only c. II only d. Neither I nor II 46. Which statement is incorrect regarding the nature, timing and extent of substantive procedures? a. Substantive analytical procedures are generally more applicable to large volumes of transactions that tend to be predictable over time. b. Tests of details are ordinarily more appropriate to obtain audit evidence regarding certain assertions about account balances, including existence and valuation. c. Substantive procedures cannot be performed at an interim date. d. The greater the risk of material misstatement, the greater the extent of substantive procedures. 47. Which statement is incorrect regarding evaluation of the sufficiency and appropriateness of audit evidence obtained? a. Based on the audit procedures performed and the audit evidence obtained, the auditor should evaluate whether the assessments of the risks of material misstatement at the assertion level remain appropriate. b. As the auditor performs planned audit procedures, the audit evidence obtained may cause the auditor to modify the nature, timing, or extent of other planned audit procedures. c. In developing an opinion, the auditor considers only the audit evidence which corroborate the assertions in the financial statements. d. If the auditor is unable to obtain sufficient appropriate audit evidence, the auditor should express a qualified opinion or a disclaimer of opinion.