Joanne M. Flood - Wiley Practitioner's Guide to GAAS 2020

Failure to gain an understanding of internal control

Improperly assessing control risk

Insufficient risk assessment

Failure to link procedures performed to the risk assessment

According to the AICPA, 40% of identified issues related to failure to gain an understanding of internal control. Auditors must understand internal control in order to identify related risks and design proper responses. Auditors are reminded to:

Consider what could go wrong in financial statement preparation,

Identify the controls intended to mitigate identified risks, and

Evaluate the likelihood those controls can prevent, detect, and correct material misstatements.

Auditors are cautioned that it is incorrect to think that AU-C 315.14 does not apply to an engagement where the client has no controls. Similarly, auditors are reminded that even when they do not plan to rely on internal control, defaulting to setting control risk at the maximum level is not permitted.

Improperly assessing control risk as less than high without appropriately testing controls accounted for 13% of the violations. Auditors are reminded not to reduce control risk to less than high without appropriately testing the relevant controls. Reducing control risk to less than maximum can only be done if the auditors have tested controls and are comfortable relying on their operating effectiveness.

This risk comprises 14% of identified issues related to risk assessment. Failure to assess risk can result in over-auditing or worse, a failure to obtain sufficient appropriate audit evidence. The alert reminds auditors that:

Regardless of the nature and extent of substantive procedures, they must:Identify the client’s risk of material misstatement through an understanding of its internal control,Assess the risk of material misstatement, andDesign or select procedures in response to those risks.

Failure to identify at least one significant risk is likely to mean the auditor has failed to comply with AU-C 315.28.Auditors are reminded of the presumption of fraud in revenue recognition and that should be treated as a significant risk. (AU-C 240.26–.27)

They must identify risk at both the financial statement and relevant assertion levels (AU-C 315.26)

It is not necessary to document the risk of material misstatement for every audit area. Some assertions are not relevant.

Of the most common risk assessment violations, 24% related to not linking risk assessment to auditors’ responses. The Alert reminds auditors to be responsive to the financial statement and relevant assertion level risks and that the linkage is at the assertion, not account, level. The AICPA discovered that auditors are not designing procedures with regard to the results of their risk assessment. Therefore, the risk is not reduced to an appropriate level, and the standards are not complied with.

Source: AU-C 315.04.For definitions related to this standard, see Appendix A, “Definitions of Terms”: Assertions, Business risk, Internal control, Relevant assertion, Risk assessment procedures, Significant risk.

The objective of the auditor is to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement and relevant assertion levels through understanding the entity and its environment, including the entity’s internal control, thereby providing a basis for designing and implementing responses to the assessed risks of material misstatement.

(AU-C Section 315.03)

The audit risk model describes audit risk as:

AR = RMM × DR

where AR is audit risk, RMM is the risk of material misstatement, and DR is detection risk. The risk of material misstatement is a combination of inherent and control risk. Although GAAS describes a combined risk assessment, the auditor may perform separate assessments of inherent and control risks.

AU-C 315 describes how the auditor should identify and assess the risk of material misstatement, which, in turn, provides a basis for designing further audit procedures. These further audit procedures (which consist of tests of controls and substantive tests) must be clearly linked and responsive to assessed risks.

AU-C 315 also includes the concept of significant risks , which are risks that require special audit consideration. (See “Definitions of Terms.”) One or more significant risks arise on all audits.

The following is an overview of how the process is described in AU-C 315:

Step 1. Perform risk assessment procedures to gather information and gain an understanding of the entity and its environment, including internal control.

Step 2. Based on this understanding, identify risks of material misstatement, which may exist at either the financial statement or the relevant assertion level.

Step 3. Assess the risk of material misstatement, which requires the auditor to:Identify the risk of material misstatement.Describe the identified risks in terms of what can go wrong in specific assertions.Consider the significance and likelihood of material misstatement for each identified risk.

AU-C 330 provides guidance on the design and performance of further audit procedures. In all audits, the auditor must obtain a sufficient understanding of the entity and its environment, including its internal control, to assess the risk of material misstatement of the financial statements whether due to error or to fraud, and to design the nature, timing, and extent of further audit procedures. (AU-C 315.12)

This assessment of the risk of material misstatement becomes the basis for the proper design of further audit procedures.

Even if the auditor plans a purely substantive audit, he or she still is required to obtain an understanding of internal control. Such an understanding is necessary to:

Identify missing or ineffective controls.

Evaluate identified control deficiencies.

Confirm that substantive procedures alone are sufficient to design and perform an appropriate audit strategy and provide sufficient appropriate audit evidence to support the audit opinion.

The auditor should perform risk assessment procedures to provide a basis for the identification and assessment of material misstatement at the financial statement and relevant assertion level. (AU-C 315.05) Risk assessment procedures include:

Inquiries of management, individuals in the internal audit function, and others at the client

Analytical procedures

Observation and inspection

(AU-C 315.06)

The auditor’s risk assessment procedures provide the audit evidence necessary to support the auditor’s risk assessments, which in turn support the determination of the nature, timing, and extent of further audit procedures. Thus, the results of the auditor’s risk assessment procedures are an integral part of the audit evidence obtained to support the opinion on the financial statements.

In the course of gathering information about the client, the auditor should perform all the risk assessment procedures.

Other procedures may provide relevant information about the entity. For example:

When relevant to the audit, the auditor should consider other information, which may include:Information obtained from the client acceptance or continuance process (AU-C 315.07)Experience and knowledge gained on other engagements performed for the entity (AU-C 315.08)