Audit Group Presentation Risk

Andalas University 2013

RISK
Auditors accept some level of risk or uncertainty in performing the audit function. The auditor recognizes, for example, the inherent uncertainty about the appropriateness of evidence, uncertainty about the effectiveness of a clients internal controls, and uncertainty about whether the financial statements are fairly stated when the audit is completed. An effective auditor recognizes that risks exist and deals with those risks in an appropriate manner. Most risks auditors encounter are difficult to measure and require careful consideration before the auditor can respond appropriately. Responding to these risks properly is critical to achieving a high-quality audit.

Audit Risk Model for Planning

PDR

where:

PDR = Planned detection risk AAR = Acceptable audit risk IR = Inherent risk CR = Control risk The audit risk model helps auditors decide how much and what types of evidence to

accumulate in each cycle.

AUDIT RISK MODEL COMPONENTS

Planned detection risk is the risk that audit evidence for a segment will fail to detect misstatements exceeding tolerable misstatement. Planned detection risk is dependent on the other three factors in the model. It will change only if the auditor changes one of the other risk model factors. Planned detection risk determines the amount of substantive evidence that the auditor plans to accumulate, inversely with the size of planned detection risk. If planned detection risk is reduced, the auditor needs to accumulate more evidence to achieve the reduced planned risk. Inherent risk measures the auditors assessment of the likelihood that there are material misstatements due to error or fraud in a segment before considering the effectiveness of internal control. If the auditor concludes that a high likelihood of misstatement exists, the

auditor will conclude that inherent risk is high. Internal controls are ignored in setting inherent risk because they are considered separately in the audit risk model as control risk. Control risk measures the auditors assessment of whether misstatements exceeding a tolerable amount in a segment will be prevented or detected on a timely basis by the clients internal controls. Assume that the auditor concludes that internal controls are completely ineffective to prevent or detect misstatements. Acceptable audit risk is a measure of how willing the auditor is to accept that the financial statements may be materially misstated after the audit is completed and an unqualified opinion has been issued. When auditors decide on a lower acceptable audit risk, they want to be more certain that the financial statements are not materially misstated. Zero risk is certainty, and a 100 percent risk is complete uncertainty. Complete assurance (zero risk) of the accuracy of the financial statements is not economically practical. There are important distinctions in how the auditor assesses the four risk factors in the audit risk model. For acceptable audit risk, the auditor decides the risk the CPA firm is willing to take that the financial statements are misstated after the audit is completed, based on certain client related factors.

ASSESSING ACCEPTABLE AUDIT RISK

Impact of Engagement Risk on Acceptable Audit Risk

Auditors must decide the appropriate acceptable audit risk for an audit, preferably during audit planning. First, auditors decide engagement risk and then use engagement risk to modify acceptable audit risk.

Engagement risk is the risk that the auditor or audit firm will suffer harm after the audit is finished, even though the audit report was correct. Engagement risk is closely related to client business risk. For example, if a client declares bankruptcy after an audit is completed, the likelihood of a lawsuit against the CPA firm is reasonably high, even if the quality of the audit was high.
Factors Affecting Acceptable Audit Risk

The Degree to Which External Users Rely on the Statements When external users place heavy reliance on the financial statements, it is appropriate to decrease acceptable audit risk.

When the statements are heavily relied on, a great social harm can result if a significant misstatement remains undetected in the financial statements. Auditors can more easily justify the cost of additional evidence when the loss to users from material misstatements is substantial. Several factors are good indicators of the degree to which statements are relied on by external users: Clients size. Generally speaking, the larger a clients operations, the more widely the statements are used. The clients size, measured by total assets or total revenues, will have an effect on acceptable audit risk. Distribution of ownership. The statements of publicly held corporations are normally relied on by many more users than those of closely held corporations. For these companies, the interested parties include the SEC, financial analysts, and the general public. Nature and amount of liabilities. When statements include a large amount of liabilities, they are more likely to be used extensively by actual and potential creditors than when there are few liabilities. The Likelihood That a Client Will Have Financial Difficulties After the Audit Report Is Issued If a client is forced to file for bankruptcy or suffers a significant loss after completion of the audit, auditors face a greater chance of being required to defend the quality of the audit than if the client were under no financial strain. The natural tendency for those who lose money in a bankruptcy, or because of a stock price reversal, is to file suit against the auditor. This can result both from the honest belief that the auditor failed to conduct an adequate audit and from the users desire to recover part of their loss regardless of the adequacy of the audit work. In situations in which the auditor believes the chance of financial failure or loss is high and a corresponding increase in engagement risk occurs, acceptable audit risk should be reduced.

It is difficult for an auditor to predict financial failure before it occurs, but certain factors are good indicators of its increased probability: Liquidity position. If a client is constantly short of cash and working capital, it indicates a future problem in paying bills. The auditor must assess the likelihood and significance of a steadily declining liquidity position. Profits (losses) in previous years. When a company has rapidly declining profits or increasing losses for several years, the auditor should recognize the future solvency problems

that the client is likely to encounter. It is also important to consider the changing profits relative to the balance remaining in retained earnings. Method of financing growth. The more a client relies on debt as a means of financing, the greater the risk of financial difficulty if the clients operating success declines. Auditors should evaluate whether fixed assets are being financed with short- or long-term loans, as large amounts of required cash outflows during a short time can force a company into bankruptcy. Nature of the clients operations. Certain types of businesses are inherently riskier than others. For example, other things being equal, a start-up technology company dependent on one product is much more likely to go bankrupt than a diversified food manufacturer. Competence of management. Competent management is constantly alert for potential financial difficulties and modifies its operating methods to minimize the effects of short-run problems. Auditors must assess the ability of management as a part of the evaluation of the likelihood of bankruptcy. The Auditors Evaluation of Managements Integrity As we discussed in Chapter 8 as a part of new client investigation and continuing client evaluation, if a client has questionable integrity, the auditor is likely to assess a lower acceptable audit risk. Companies with low integrity often conduct their business affairs in a manner that results in conflicts with their stockholders, regulators, and customers.
Methods Practitioners Use to Assess Acceptable Audit Risk Factors External users reliance on Financial statements o o o o o o o Methods Used to Assess Acceptable Audit Risk Examine financial statements Read minutes of the board Examine form 10K Discuss financing plans with management Analyze financial statements for difficulties using ratios Examine inflows and outflows of cash flow statements See Chapter 8 for client acceptance and continuance

Likelihood of financial difficulties Management integrity

ASSESSING INHERENT RISK

Factors Affecting Inherent Risk

The inclusion of inherent risk in the audit risk model is one of the most important concepts in auditing. It implies that auditors should attempt to predict where misstatements are most and least likely in the financial statement segments. This information affects the amount of evidence that the auditor needs to accumulate, the assignment of staff and the review of audit documentation.

The auditor must assess the factors that make up the risk and modify audit evidence to take them into consideration. The auditor should consider several major factors when assessing inherent risk: Nature of the clients business: Inherent risk for certain accounts is affected by the nature of the clients business. Results of previous audits: Misstatements found in the previous years audit have a high likelihood of occurring again in the current years audit, because many types of misstatements are systemic in nature, and organizations are often slow in making changes to eliminate them. Initial versus repeat engagement: Auditors gain experience and knowledge about the likelihood of misstatements after auditing a client for several years. Related parties: Transactions between parent and subsidiary companies, and those between management and the corporate entity, are examples of related-party transactions as defined by accounting standards. Nonroutine transactions: Transactions that are unusual for a client are more likely to be incorrectly recorded than routine transactions because the client often lacks experience recording them. Judgment required to correctly record account balances and transactions: Many account balances such as certain investments recorded at fair value, allowances for uncollectible accounts receivable, obsolete inventory, liability for warranty payments, major repairs versus partial replacement of assets, and bank loan loss reserves require estimates and a great deal of management judgment. Makeup of the population: Often, individual items making up the total population also affect the auditors expectation of material misstatement. Most auditors use a higher

inherent risk for accounts receivable where most accounts are significantly overdue than where most accounts are current. Factors related to fraudulent financial reporting and to misappropriation of assets: the auditors responsibilities to assess the risk of fraudulent financial reporting and misappropriation of assets. It is difficult in concept and practice to separate fraud risk factors into acceptable audit risk, inherent risk, or control risk.

RELATIONSHIP OF RISKS TO EVIDENCE AND FACTORS INFLUENCING RISKS

Auditors respond to risk primarily by changing the extent of testing and types of audit procedures, including incorporating unpredictability in the audit procedures used. In addition to modifying audit evidence, there are two other ways that auditors can change the audit to respond to risks: 1. The engagement may require more experienced staff. CPA firms should staff all engagements with qualified staff. For low acceptable audit risk clients, special care is appropriate in staffing, and the importance of professional skepticism should be emphasized. Similarly, if an audit area such as inventory has a high inherent risk, it is important to assign that area to someone with experience in auditing inventory. 2. The engagement will be reviewed more carefully than usual. CPA firms need to ensure adequate review of the audit files that document the auditors planning, evidence accumulation and conclusions, and other matters in the audit. When acceptable audit risk is low, more extensive review is often warranted, including a review by personnel who were not assigned to the engagement. If the risk of material misstatement (the combination of inherent risk and control risk) is high for certain accounts, the reviewer will likely spend more time making sure the evidence was appropriate and correctly evaluated.

Relating Tolerable Misstatement and Risks to Balance-Related Audit Objectives

Although it is common in practice to assess inherent and control risks for each balancerelated audit objective, it is not common to allocate materiality to those objectives. Auditors are able to effectively associate most risks with different objectives, and it is reasonably easy to determine the relationship between a risk and one or two objectives. For example, obsolescence in inventory is unlikely to affect any objective other than realizable value. It is

more difficult to decide how much of the materiality allocated to a given account should in turn be allocated to one or two objectives. Therefore, most auditors do not attempt to do so.

Evaluating Result
After the auditor plans the engagement and accumulates audit evidence, result can also be stated in terms of the evaluation version of the audit risk model. The audit risk model for evaluating audit result is stated: AcAR = IR x CR x AcDR Where: AcAR = Achieved audit risk. A measure of the risk the auditor has taken that an

account in the financial statements is materially misstated after the auditor has accumulated audit evidence. IR = Inherent risk. It is the same as the risk factor discussed in planning unless it has been revised as a result of new information. CR = Control risk. It also the same control risk discussed previously unless it has been revised during the audit. AcDR = Achieved detection risk. A measure of the risk that audit evidence for a

segment did not detect misstatements exceeding a tolerable amount, if such misstatement existed. The auditor can reduce achieved detection risk only by accumulating evidence. The formula shows three ways to reduce achieved audit risk to an acceptable level: 1. Reduce inherent risk. Because inherent risk is assessed by the auditor based on the clients circumstances, this assessment is done during planning and is typically not changed unless new fact is uncovered as the audit progress. 2. Reduce control risk. Assessed control risk is affected by the clients internal controls and the auditors test of those controls. Auditor can reduce control risk by more extensive test of controls of the client has effective controls. 3. Reduce achieved detection risk by increasing substantive audit test. Auditors reduce achieved detection risk by accumulating evidence using analytical procedures, substantive test of transactions, and test of details of balances. Additional audit procedures, assuming that they are effective, and larger sample sizes both reduce achieved detection risk.

The audit risk model is primarily a planning model and is, therefore, of limited use in evaluating results. No difculties occur when the auditor accumulates planned evidence and concludes that the assessment of each of the risks was reasonable or better than originally thought. The auditor will conclude that sufcient appropriate evidence has been collected for that account or cycle. However, special care must be exercised when the auditor decides, on the basis of accumulated evidence, that the original assessment of control risk or inherent risk was understated or acceptable audit risk was overstated. In such a circumstance, the auditor should follow a two-step approach. 1. The auditor must revise the original assessment of the appropriate risk. It violates due care to leave the original assessment unchanged if the auditor knows it is inappropriate. 2. The auditor should consider the effect of the revision on evidence require ments, without use of the audit risk model. If a revised risk is used in the audit risk model to determine a revised planned detection risk, there is a danger of not increasing the evidence sufciently. Instead, the auditor should carefully evaluate the implications of the revision of the risk and modify evidence appropriately, outside of the audit risk model. For example, assume that the auditor conrms accounts receivable and, based on the misstatements found, concludes that the original control risk assessment as low was inappropriate. The auditor should revise the estimate of control risk upward and care- fully consider the effect of the revision on the additional evidence needed in the audit of receivables and the sales and collection cycle. Based on the results of the additional tests performed, the auditor should carefully evaluate whether sufcient appropriate evidence has been gathered in the circumstances to reduce audit risk to an acceptable level.

Cases

9-36 Whitehead, CPA, is planning the audit of newly obtained client, Henderson Energy Corporation, for the year ended December 31, 2007. Henderson Energy is regulated by the state of utility commission and because it is a publicly traded company the audited financial statements must be filed with the Securities and Exchange Commission (SEC). Henderson Energy is considerably more profitable than many its competitors, largely due to its extensive investment in information technologies used in its energy distribution and other key business processes. Recent growth into rural markets, however, has placed some strain on 2007 operations. Additionally, Henderson Energy expanded its investment into speculative markets and is also marking greater use of derivative and hedging transactions to mitigate some of its investment risks. Because of the complexities of the underlying accounting associated with these activities, Henderson Energy added several highly experienced accountants within its financial reporting team. Internal audit, which has direct reporting responsibility to the audit committee, is also actively involved in reviewing key accounting assumptions and estimates on a quarterly basis. Whiteheads discussion with the predecessor auditor revealed that the client has experienced some difficulty in correctly tracking existing property, plant, and equipment items. This largely involves equipment located at its multiple energy production facilities. During the recent year, Henderson acquired a regional electric company, which expanded the number of the energy production facilities. Whitehead plans to staff the audit engagement with several members of the firm who have experience in auditing energy and public companies. The extent of partner review of key accounts will be extensive. Required : based on the above information, identify factors that affect the risk of material misstatement in the December 31, 2007 financial statement of Henderson Energy.

FACTOR 1. Henderson is a new client. 2. Henderson operates in a regulated industry, which increases regulatory oversight and need for compliance with regulations.

EFFECT ON THE RISK OF MATERIAL MISSTATEMENT Increases Increases

AUDIT RISK MODEL COMPONENT Inherent risk Acceptable audit risk

3. The companys stock is publicly traded. 4. The company is more profitable than competitors, but recent growth has strained operations. 5. The company has expanded its use of derivatives and hedging transactions. 6. Henderson has added competent accounting staff and has an internal audit function with direct reporting to the audit committee.

Increases Increases

Acceptable audit risk Acceptable audit risk Inherent risk

Increases

Decreases

Control risk

FACTOR 7. The financial statements contain several accounting estimates that are based on management assumptions. 8. The company has struggled in tracking property, plant & equipment. 9. Henderson acquired a regional electric company. 10. The audit engagement staff have experience in auditing energy and public companies. 11. Partner review of key accounts will be extensive.

EFFECT ON THE RISK OF MATERIAL MISSTATEMENT Increases

AUDIT RISK MODEL COMPONENT Inherent risk

Increases

Control risk

Increases Decreases

Inherent risk Planned detection risk Planned detection risk.

Decreases