Summary Auditing and Assurance Services

RISK ASSESSMENT Audit Risk ● Audit risk: is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated (aka) they will issue an unqualified opinion on materially misstated financial statements. ● Assertion: worried about account balances and disclosure levels instead of financial statements thus audit risk at this level contains ○ Risk that relevant assertions related to the account balances or disclosures contain misstatements that could be material to the financial statements (risk of material misstatement) ○ Risk that the auditor will not detect such misstatements (detection risk) Audit Risk Model ● At assertion level - relevant assertion risk of misstated consists of (entity and envir) ○ Inherent Risk (IR): susceptibility of an assertion in an account or disclosure to a misstatement due to error or fraud that could be material, either individually or when aggregate with other misstatements, before consideration of any related controls ○ Control Risk (CR): risk that misstatement could occur in an assertion about an account or disclosure and that could be material, either individually, or when aggregated w/ other misstatements will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control ● Risk of Material Misstatement (RMM): combination of IR and CR or called “client risk” ● Detection risk (DR): risk that procedures performed by auditor to reduce audit risk to an acceptably low level will not detect a misstatement that exists and that could be material, either individually or when aggregated w/ other misstatements ○ Has inverse relationship w/ IR and CR - if IR/CR risk is high = setting low DR ○ AR = RMM x DR ○ DR = AR/RMM ○ Determined by effectiveness of audit procedures and how well they are applied by the auditor ● Non-sampling Risk: Audit evidence is collection of audit processes, analysis, assessments, and professional judgement and such processes are subject to human error ○ Could be inappropriate procedures, misinterpretation, failure to recognize ● Standards do not set specific guidance on what is an acceptable level of audit risk ● Unqualified report: if auditor assesses achieved audit risk is less than or equal to planned level of audit risk ● Qualified (aka modify): assessment of achieved level of audit risk is greater than the planned level, either conduct additional work or qualify opinion ● Engagement risk: risk that an auditor is exposed to financial loss or damage to his or her professional reputation from litigation, adverse publicity, or other events arising in connection w/ the audited financial statements - even if ligiation won, rep can be ruined - can't be controlled by auditor, but can exercise control through careful acceptance and continuance of clients Use of Audit Risk Model ● Model useful for planning scoping decisions for audit procedures ● 3 steps in auditor’s use of the audit risk model at assertion level: ○ Setting a planned level of audit risk ■ Sets audit risk for each account balance / disclosure so @ completion, an opinion can be issues on the financial statements w/ an acceptably low level of audit risk ■ Public companies usually 5% or less ○ Assessing the risk of material misstatement ■ Evaluates entity’s business risk and how those risks could lead to material misstatements ○ Determine the appropriate level of detection risk ■ If AR is 5% and RMM is 60% then DR is 8% Auditor’s Risk Assessment Process ● Need to understand management objectives and strategies / related business risk that may result in material misstatements Management’s Strategies, Objectives, and Business Risks ● Management is responsible for identifying risks and responding to them usually by risk assessment process - entity’s face pressure to maintain historical profit margins which increases risk of misstatement associated w/ value of assets Auditor’s Risk Assessment Procedures Obtains understanding of entity and environment by performing risk assessment procedures; inquiries of management, other entity personnel, outside entity; analytical procedures, and observation / inspection ● Inquiries of management, other entity personnel, and others outside the entity ○ Offers different perspective from someone not responsible for financial reporting ■ Those charged w/ governance (BOD) ■ Internal audit function ■ Employees involved in initiating, authorizing, processing, and recording complex or unusual transactions ■ In legal counsel ■ Production, marketing, sales, and other personnel ● Analytical Procedures ○ Evaluations of financial information made through analysis of plausible relationships among both financial and nonfinancial data (aka planning and preliminary analytical procedures) ○ Can help by identifying existence of unusual transactions or events amounts / ratios / trends that might have implications for audit planning ● Observations and Inspection ○ May support inquiries of management, examples are ■ Observation of entity activities and operations ■ Inspection of documents, records, and internal control manuals ■ Reading reports prepared by management, the audit committee or those charged w/ governance, the internal audit function ■ Visits to the entity’s premises and plant facilities ■ Tracing transactions through the information system relevant to financial reporting, which may be performed as part of walkthrough ○ Could examine previous audits, consulting and tax engagements, reports, etc ● Assessing Business Risk ○ Goal to assess business risk faced by entity and how those risk are controlled / not controlled ○ Risk of material misstatement refers to misstatements cause by errors or fraud Auditor understanding of environment includes ● Nature of entity - gives better idea of what potential misstatements might be found ○ Business operations information ○ Ownership and governance structures ■ Example: if complex organization structure, may give rise to misstatements for accounting investments ○ Investments and investment activities ○ Financing activities ○ Financial reporting ○ ● ● ● ● PCOB states should consider performing additional procedures to understand ■ Read public information ■ Observe or read transcripts of earnings calls ■ Obtain information about significant unusual developing regarding trading activity ■ Understand compensation arrangements w/ senior management Industry, regulatory, and other external factor ○ Some need unique accounting estimates - ex. Insurance companies need loss reserves based on estimates ○ Industry conditions: ■ Market / competition, including demand, capacity and price competition ■ Cyclical or seasonal activity ■ Product technology relating to entity’s products ■ Energy supply cost ○ Regulatory Environment ■ Accounting principles and industry specific practices ■ Regulatory framework for regulated industry ■ Legislation and regulation that significantly affect the entity’s operations ■ Taxation ■ Gov policies affecting business entity conduct ■ Environmental requirements affecting industry and entity’s business ○ Other external factors ■ General economic conditions (recession, growth) ■ Interest rates and availability of financing ■ Inflation and currency revaluation Objectives, strategies, and related business risk Entity performance measures ○ Companies have performance measures to compare and contrast how they are doing, a change in those might indicate risk of misstatement Internal control ○ Name for entity’s policies and procedures designed to provide reasonable assurance about achievement of objectives - implemented by BOD -- need to understand and assess effectiveness ■ Active and qualified BOD and independent audit committee members ■ ■ ■ ■ ■ Effective risk assessment process Competent and objective internal audit function Proper authorization of transactions Procedures to ensure assets exist Monitoring of controls Evaluate Entity’s Risk Assessment Process ● Learn about entity’s risk assessment process and if it’s efficient - could be misstatements if not effective process Assessing the Risk of Material Misstatement Determine at assertion level - use identified risks to assess if they could contribute to material misstatement -- but entity could have places of risk, but then also have set good controls in place to counter that so the risk of misstatement would be low Causes and Types of Misstatements ● Errors: unintentional misstatements of amounts or disclosures in financial statements ● Fraud: intentional act by one or more among management, those charged w/ governance, employees, or third parties, involving deception that results in misstatement of financials ○ Misstatement due to fraudulent reporting ○ Misstatement due to misappropriation of assets (aka defalcation): thefts of an entity’s assets where theft causes financial statements to be misstated ■ Examples: embezzling cash received, stealing physical assets, pay for goods / services not received, using assets for personal use ● hard to distinguish error versus fraud - examples include ○ Inaccuracy in gathering / processing data from which financials are prepared ○ Omission of an amount or disclosure ○ Financial statement disclosure that is not presented in accordance w/ GAAP ○ Incorrect accounting estimate arising from overlooking or clear misinterpretation of facts ○ Judgements of management concerning account estimates that the auditor considers unreasonable or selection or application of accounting policies that the auditor considers inappropriate ● Factual misstatements: misstatements w/ no doubt - exact amounts are known ● Judgemental misstatements: misstatements arise from judgements of management concerning accounting estimates that auditor considers unreasonable ● Projected misstatements: auditor’s best estimate of misstatements in populations, involving the projection of misstatements identified in audit sample to entire population which sample was drawn Fraud Risk Assessment Process ● Steps to assess fraud risk ○ ○ ○ ○ ○ Discussion among audit team members regarding risk of material misstatement due to fraud ■ Audit team required to hold discussions (brainstorming sessions) about entity financial statements susceptibility to fraud - engagement partner or manager should determine which members to include in communication, how it should occur, and extent of it - objectives are: ● Share insight about entity / environment and business risk ● Risk of management override of controls ● Opportunity for team members to discuss how / where entity might be susceptible ● Importance of maintaining professional skepticism throughout audit regarding potential due to fraud ● How auditor might respond to susceptibility of fraud ■ Auditor should conduct engagement assuming possibility of fraud due to someone present Inquiries of managements, audit committee, and others about their view son risk of fraud and how to address it ■ Conversation takes place when auditor obtains understanding of entity and its environment (know programs / controls and how combat that) ■ Might also inquire from third parties (vendors, customers, regulators) Consideration of any unusual / unexpected relationships that have been identified in performing analytical procedures Understanding entity’s period-end closing process and investigate unexpected period end adjustments Identification and assessment of fraud risk factors ■ 3 conditions present (usually) when material misstatement due to fraud ( fraud risk triangle) ● Management / employees have incentive or under pressure to provide a reason to commit fraud ● Circumstance exist that provide opportunity to be carried out ● Those involved able to rationalize committing fraud, might possess an attitude, character, or set of ethical values that allow them to knowingly and intentionally commit a dishonest act Auditor’s Response to the Result of the Risk Assessments Determine if risk of material misstatement have been identified - determine whether they relate more pervasively to overall financial statements and potentially affect many relevant assertions or whether the identified risks relate to specific relevant assertions related to accounts and disclosures - auditor’s response to risks may include ● Assigning more experienced personnel w/ specialized knowledge ● ● ● ● ● ● Evaluating whether selection / application of policies may be indicative of fraudulent financial reporting may create material misstatement Incorporating an element of unpredictability in selection of the nature, timing, and extent of audit procedures Evaluation of Audit Test Results At completion, consider whether accumulated results of audit procedures indicate the financial statements are materially misstated - if so, request management eliminate them.. If not then auditor issues a qualified / modified or adverse opinion If possible fraud, auditor should ○ Attempt to obtain audit evidence to determine whether, material fraud has occurred ○ Consider implications of other aspects of the audit ○ Discuss the matter and approach further investigation w/ appropriate level of management ○ Suggest to management to consult w/ legal counsel Documentation of the Auditor’s Risk Assessment and Response Standards require extensive documentation of the auditor’s risk assessment procedures and audit responses to identified risks, also document ○ Discussion among engagement team, significant decisions reached, how / when discussion occurred, and audit team members who participated ○ Steps performed in obtaining knowledge about entity’s business and its environment, including documentation of ■ Risks identified, evaluation of management’s response, auditor's assessment of the risk of error or fraud after considering the entity’s response ○ Fraud risks that caused auditor to believe that additional audit procedures were required ○ Nature, timing, and extent of the procedures performed in response to risk of material misstatement due to fraud and results ○ Nature of communication about error or fraud made to management Communications about Fraud to Management, the Audit Committee, and Others Fraud involving senior management or material misstatement reported to audit committee - don't usually tell anyone else unless duty to ○ Comply legal / regulatory requirements ○ Successor auditor when successor makes inquiries of the predecessor audit about the client ○ Response to subpoena ○ Funding agency in accordance w/ requirement for the audits of entities that receive government financial assistance