1. Chapter 4
Risk Assessment

2. LO# 1
Audit Risk
The risk that an auditor expresses an inappropriate audit opinion when the financial statements are materially misstated.
Financial statement level
Individual account balance or disclosure
level
Assertion level
4-2

3. The Audit Risk Model Audit Risk = IR × CR × DR
LO# 2
The Audit Risk Model
Inherent risk and control risk: Risk of material misstatement
Audit Risk = IR × CR × DR
Detection risk: Risk that auditor will not detect misstatements
Nonsampling risk
Sampling risk
Ineffective audit procedures
Whether the audit procedures
were performed with due care
4-3

4. LO# 2
Engagement Risk
Litigation
An auditor’s exposure to financial loss and damage to professional reputation.
Negative publicity
4-4

5. Using the Audit Risk Model: Quant approach
LO# 3
Using the Audit Risk Model: Quant approach
 Set a level of audit risk.
 Assess the risk of material misstatement (IR x CR).
 Use the audit risk equation to solve for the appropriate level of detection risk:
Auditors use this level of detection risk to determine the needed
audit resources. The lower the DR the greater the needed
audit resources
4-5

6. Audit Risk Model: IR and CR verbal approach
LO# 3
Audit Risk Model: IR and CR verbal approach
Qualitative terms may also be used in the audit risk model

7. Audit Risk Model: RMM verbal approach (RMM is simply IR times CR)
LO# 3
Audit Risk Model: RMM verbal approach (RMM is simply IR times CR)
Qualitative terms may also be used in the audit risk model.
4-7

8. Limitations of the Audit Risk Model
LO# 3
The audit risk model is a planning tool, but it has some limitations.
A major limitation is that inherent risk and control risk are estimates, and you cannot know how accurate those estimates are.
For example, the model may suggest that detection risk should be high (which means the amount of audit resources needed is low) when detection risk should be low (which means the amount of audit resources needed is high).

9. The Auditor’s Risk Assessment Process
LO# 4
The Auditor’s Risk Assessment Process
Auditors need to identify business risks and understand the potential misstatements that may result.
Business risks are risks that result from
significant conditions, events,
circumstances or actions that
impair management’s ability
to execute strategies.
4-9

10. LO# 4
The Auditor’s Risk Assessment Process Figure 4-2 An Overview of the Auditor’s Assessment of Business Risks and the Risk of Material Misstatements
4-10

11. Auditor’s Risk Assessment Procedures (How do we gather this evidence?)
LO# 4
Auditor’s Risk Assessment Procedures (How do we gather this evidence?)
Inquiries of Management,
Other Entity Personnel, and
Others Outside the Entity
Analytical Procedures
Observation and Inspection
4-11

12. Understanding the Entity and Its Environment
LO# 4
Understanding the Entity and Its Environment
Nature of the Entity
Industry, Regulatory,
and External Factors
Internal Control
Objectives, Strategies,
and Business Risks
Entity Performance
Measures
4-12

13. LO# 4
Nature of the Entity
The sources of funding of the entity’s operations and investment activities, including the entity’s capital structure, noncapital funding, and other debt instruments.
The sources of the entity’s earnings, including the relative profitability of key products and services.
Key supplier and customer relationships.
4-13

14. Industry, Regulatory, and Other External Factors
LO# 4
Industry, Regulatory, and Other External Factors
4-14

15. LO# 4
Understanding the Entity’s Objectives, Strategies, Risks and Risk Assessment Process
Now, the Countrywide case will deepen our understanding of these things by focusing on one company.
4-15

16. Assessing the Risk of Material Misstatement Due to Error or Fraud
LO# 5
Assessing the Risk of Material Misstatement Due to Error or Fraud
Errors are unintentional:
Mistakes in gathering or processing financial data used to prepare financial statements.
Unreasonable accounting estimates arising from oversight or misinterpretation of facts.
Mistakes in the application of accounting principles relating to amount, classification, manner of presentation, or disclosure.
4-16

17. Assessing the Risk of Material Misstatement Due to Error or Fraud
LO# 6
Assessing the Risk of Material Misstatement Due to Error or Fraud
Fraud is intentional. The fraud risk identification process includes:
Sources of information about possible fraud―
Brainstorming among the audit team
Inquiries of management and others
Analytical procedures
4-17

18. The Fraud Triangle Fraud Triangle Opportunity (weak internal control)
LO# 6
The Fraud Triangle
Incentive or motivation or pressure
Opportunity
(weak internal control)
Fraud
Triangle
Attitude or Rationalization (bad ethics)

19. Fraudulent Financial Reporting
LO# 6
Fraudulent Financial Reporting
Risk Factors Relating to Incentive/Pressure include:
Excessive pressure for management to meet third party expectations
Financial stability or profitability is threatened
Management’s personal financial situation is threatened
4-19

20. Risk Factors Relating to Attitudes/Rationalizations
LO# 6
Risk Factors Relating to Attitudes/Rationalizations
Fraudulent Financial Reporting
Risk Factors Relating to Attitudes/Rationalizations include:
Most difficult of the 3
corners of the fraud
triangle to identify
Weak or bad ethics on the
part of management
Corporate or personal
Symptoms may - or may not -
be present
4-20

21. Co. paying for goods and services not received by
LO# 6
The auditing standards require auditors to be vigilant, not just re financial reporting fraud, but also re misappropriation of assets.
Misappropriation of assets involves the theft of an entity’s assets to the extent that financial statements are misstated.
Examples include:
Stealing assets
Co. paying for goods and services not received by
the co.
Embezzling cash
4-21

22. Assessing the Risk of Misappropriation of Assets
LO# 6
Assessing the Risk of Misappropriation of Assets
4-22

23. Auditor’s Response to the Risk Assessment (See Figure 4-3)
LO# 7
Assess the risk of material misstatement at the financial statement and assertion levels.
Financial statement level risks
Assertion level risks
Do these
risks relate
pervasively to
the financial
statements? No
Determine what can go wrong
at the account or assertion level.
Design audit
procedures for
assertion level risks.
Yes
Develop an overall
response.
4-23

24. Auditor’s Response to the Risk Assessment
LO# 7
To respond appropriately to financial statement level risks, the auditor may do the following:
Emphasize to the audit team the need to maintain professional skepticism.
Assign more experienced staff or those with specialized skills.
Provide more supervision.
Incorporate additional elements of unpredictability in the selection of audit procedures.
4-24 24

25. Evaluation of Audit Test Results
LO# 8
Evaluation of Audit Test Results
At the completion of the audit, the auditor should consider:
1. Whether the accumulated results of audit procedures affect the assessments of the entity’s business risk and the risk of material misstatement, and
2. Whether the total misstatements cause the financial statements to be materially misstated.
THEN …
If the financial statements are materially misstated, the auditor should:
1. Request management to eliminate the material misstatement, or
2. If management does not make needed adjustments, the auditor should issue a qualified or adverse opinion.
4-25

26. Evaluation of Audit Test Results
LO# 8
If the auditor determines that the misstatement is or may be the result of fraud, and has determined that the effect could be material, the auditor should:
Attempt to obtain audit evidence to determine whether, in fact, material fraud has occurred and, if so, its effect.
Consider the implications for other aspects of the audit.
Discuss the matter and the approach to further investigation with an appropriate level of management that is at least one level above those involved in committing the fraud and with senior management.
If appropriate, suggest that the client consult with legal counsel.
Consider withdrawing from the engagement.
4-26

27. Documentation of the Auditor’s Risk Assessment
LO# 9
Documentation of the Auditor’s Risk Assessment
The auditor should document:
Discussions among engagement personnel.
Procedures performed to identify and assess the risks of material misstatement due to fraud.
Risks of identified material misstatement due to fraud and a description of the auditor’s response to the risks.
Fraud risks or other conditions that result in additional audit procedures.
The nature of the communications about fraud made to management, the audit committee, and others.
4-27

28. Communications about Fraud
LO# 10
If the auditor decides fraud may exist, it should be brought to the attention of management. Fraud involving senior management or that causes a material misstatement of the financial statements should be reported to the audit committee.
As with Illegal Acts, if the company is publicly held, and does not promptly disclose a material misstatement of the financial statements to the SEC, the auditor must do so.
The auditor must disclose fraud to a successor auditor.
The auditor must disclose fraud if ordered to do so by a court (subpoena).
4-28

29. End of Chapter 4
4-29