Audit Risk Assessment Process
Understanding Audit Risk
Assessment
Objectives of This Course:
•
Outline the PPC audit risk assessment process
•
Understand how to use PPC practice aids to
perform and document risk assessment
What is Risk Assessment?
Risk Assessment
•
Obtain an understanding of
the client, including internal
control
•
Identify and assess risks of
material misstatement of
the financial statements,
whether due to error or
fraud
•
Evaluate both overall risks
and risks that affect only
specific assertions
Linkage
Audit Procedures
•
Concentrate audit effort in
high risk areas
–
Inherent risk
–
Control risk
•
Perform less extensive
procedures in low risk areas
PPC Audit Approach
Preliminary Engagement Activities
Client Acceptance/Continuance
Consider:
•
Nature and purpose of
engagement
•
Preconditions for an audit
•
Client’s reputation, integrity, and
competence
•
Communication with predecessor
•
Compliance with ethical
requirements, including
independence
•
Adequacy of accounting records
•
Firm resources and competence
•
Engagement economics
•
Other risk concerns
Document
•
CX-1.1: “Engagement
Acceptance and Continuance
Form”
•
CX-1.2: “Engagement
Independence Compliance and
Nonattest Services
Documentation Form”
•
CX-7.1: “Risk Assessment
Summary Form” (if risks are
identified)
Establish an Understanding with the
Client
•
Establish an understanding about:
Objectives of the engagement
Auditor’s services to be performed, including
nonattest services
Management’s responsibilities
Auditor’s responsibilities
Limitations of the engagement
•
Communicate the understanding in a written
engagement letter
•
CL-1.1: “Audit Engagement Letter”
Planning and Risk Assessment
Procedures
Engagement Team Discussion
•
Susceptibility of the financial statements to material
misstatement, including material misstatement due to fraud
or error that could result from the related party relationships
•
Application of GAAP to the entity’s facts and circumstances in
light of its accounting policies
•
Fraud-related matters
•
Include:
Critical issues and areas of significant audit risk
Areas susceptible to management override of controls
Unusual accounting practices
Important control systems
Significant IT applications and how IT may affect the audit
Materiality considerations
Need to exercise professional skepticism
Business risks
Engagement Team Discussion
(cont.)
•
Attendance:
Engagement partner
Key members of engagement team
•
Document:
How and when the discussion occurred, who participated, and decisions
about planned responses
CX-3.2: “Engagement Team Discussion”
CX-7.1: “Risk Assessment Summary Form” (if risks are identified)
Materiality
•
Materiality for the financial statements as a
whole
•
Materiality for particular items of lesser
amounts
•
Performance materiality
•
Component materiality (group audits only)
Materiality
(
cont
.)
•
Apply professional judgment
•
Consider decisions that users make
•
Use appropriate benchmarks, such as % of
assets or revenue
•
Re-evaluate materiality as the audit
progresses. If lower, reconsider:
Level of performance materiality
Adequacy of procedures
Materiality
(cont…)
•
Document:
Materiality at the financial statement level
If applicable, materiality level(s) for particular transaction
classes, account balances, or disclosures
Performance materiality
Factors considered in their determination
Any revisions made during the audit
The amount below which misstatements would be
considered clearly trivial
CX-2: “Financial Statement Materiality Worksheet for
Planning Purposes”
CX-3.5: “Analysis of Group Components and Determination
of Component Materiality”
Risk Assessment
Two categories of audit procedures:
•
Risk assessment procedures
•
Further audit procedures
Both Provide
Audit Evidence
Risk
Assessment
Procedures
Further
Audit
Procedures
Risk Assessment Procedures Diagram
Risk Assessment Procedures
(cont…)
•
Performed to obtain an understanding of the
entity and its environment, including internal
control, for the purpose of assessing risks
•
All of the procedures should be performed
•
Inquiry alone is not sufficient to understand
internal control
•
Provide audit evidence
Inquiries
•
Management
•
Internal audit (if such a function exists)
•
Other employees
•
External parties (maybe)
Required Inquiries
•
Inquire about:
Entity and its environment
Fraud-related matters
Related parties
Accounting estimates
Compliance with laws and regulations
Service organizations
•
Document the inquiries:
CX-3.3, “Fraud Risk Inquiries Form”
CX-7.1, “Risk Assessment Summary Form” (if risks are
identified)
Observation and Inspection
•
Inspect documents and records
•
Read management and internal reports and
minutes
•
Read external information
•
Visit premises and plant facilities
•
Trace transactions through the system
(walkthroughs)
Analytical Procedures
•
Preliminary analytical procedures
•
Analytical procedures related to revenue
required by AU-C 240
•
To enhance understanding of the business and
identify potential risk areas
•
Documented by completing a step on AP-1:
“Audit Program for General Planning
Procedures”
•
Add risks to CX-7.1: “Risk Assessment
Summary Form”
Risk Assessment Procedures
•
Document the procedures performed
•
AU-C 230 provides guidance on documenting
procedures
For inquiries, document the date, name, and title
of individual, inquiry, and response
For observation, document what was observed,
where, when, and entity personnel involved
For inspection, document the identifying
characteristics, for example, document name or
number and date
Understanding the Entity and Its
Environment
•
Perform risk assessment procedures (inquiry,
analytics, observation, and inspection) to
gather information about:
Industry, regulatory, and other external factors
Nature of the entity
Objectives, strategies, and related business risks
Measurement and review of the entity’s financial
performance
Selection and application of accounting policies
Internal control
Understanding the Entity and Its
Environment
(cont)
•
Obtain an understanding of the client’s
selection and application of accounting
policies
Are accounting policies appropriate for the entity
and consistent with the industry?
Are there any changes in accounting policies?
23
Understanding the Entity and Its
Environment
(cont.)
•
Consider the presence of fraud risk factors
•
Update information obtained in prior years by
performing risk assessment procedures to
determine if the information has changed
Using the PPC Approach
•
CX-3.1: “Understanding the Entity and Identifying
Risks”
Key elements of the understanding
The consideration of fraud risk factors
Sources of information
Risk assessment procedures performed
•
CX-7.1: “Risk Assessment Summary Form”
•
CX-6.1: “Entity Risk Factors” and CX-6.2:
“Fraud Risk Factors” (memory joggers)
25
Understanding Internal Control
Diagram
26
Understanding Internal Control
•
Understand design and implementation
•
Perform inquiry, observation, and inspection
•
Inquiry alone is not sufficient to understand
the design and implementation of controls
27
Understanding Internal Control
(cont.)
•
Evaluate the design and implementation of
controls
—
Related to significant risks
Related to risks that cannot be tested effectively
using substantive procedures alone
•
Understand
—
How the incorrect processing of transactions is
resolved
How detail is reconciled to the general ledger for
material accounts
28
Understanding Internal Control
(cont)
•
Document the following:
Understanding of internal control components
Sources of information
Procedures performed
Controls evaluated related to significant risks and
risks for which substantive procedures alone are
not effective
The PPC Approach
•
Entity-level controls
Control environment
Risk assessment
Information and communication
Monitoring
•
Activity-level controls
Financial reporting system
Control activities
•
IT environment and general IT controls
Using the PPC Approach
(cont)
•
CX-4.1: “Understanding the Design and
Implementation of Internal Control”
Evaluate entity-level controls
Identify significant transaction classes
•
CX-4.2.1: “Financial Reporting System
Documentation Form—Significant Transaction
Classes”
Document the processing of transactions for each
significant transaction class
Document the financial close and reporting process
Using the PPC Approach
(cont…)
•
CX-4.2.2: “Financial Reporting System
Documentation Form—IT Environment and
General IT Controls”
Understand the effect of IT
•
CX-4.3.1: “Walkthrough Documentation
Memo” or CX-4.3.2: “Walkthrough
Documentation Table”
For each walkthrough
•
CX-5: “Activity and Entity-level Control Forms”
(optional)
Identifying Significant Transaction
Classes
•
Transaction classes that present a reasonable
possibility of material misstatement of the
financial statements or disclosures based on:
Volume of activity
Size and composition of accounts
Types of transactions
Presence of fraud risks or other significant risks
Changes from the prior period
Understanding Significant Transaction
Classes
•
How are transactions initiated and
authorized?
•
How are transactions recorded, processed,
and corrected?
•
How are transactions transferred to the
general ledger and reconciled?
•
What reports are generated and how are they
used?
Understanding Significant Transaction
Classes
(cont)
•
Consider control objectives:
Completeness: All transactions are recorded
Occurrence: All recorded transactions occurred
and pertain to the entity
Accuracy: Transactions are recorded in the proper
amount
Classification: Transactions are recorded in the
proper account
Cutoff: Transactions are recorded in the proper
period
Documenting Significant Transaction
Classes
•
Narrative description
•
Focus on key controls and control objectives
related to identified risks
•
How are control objectives achieved?
•
What controls are in place to address
significant or fraud risks?
•
Are controls properly designed and
implemented?
Performing Walkthroughs
•
Select one or a few transactions
•
Trace from initial creation of the source
document to final posting in the general
ledger
•
Inspect documents and records used in
processing, make inquiries, and observe
procedures being performed
Retrospective Review of Accounting
Estimates
•
Performed to evaluate:
Effectiveness of management’s estimation process
Information relevant to current year estimates
The need for disclosure
The existence of possible management bias
•
AP-1: “Audit Program for General Planning
Procedures”
Assessing Risks and Developing
Responses
Assess Risks at the Financial Statement
Level
•
Identify risks that are pervasive to the financial
statements and potentially affect many
assertions
•
Assess the risk of material misstatement at the
financial statement level
•
Develop overall responses
•
Document the risk assessment and the
responses
CX-7.1: “Risk Assessment Summary Form” (Part I)
40
Develop the Overall Audit Strategy
•
Characteristics of the engagement that define
its scope
•
Reporting objectives of the engagement
•
Important factors that determine audit focus
•
Resources needed to perform the audit
41
Factors That Determine Audit Focus
•
Materiality levels
•
Assessed risk of material misstatement at
financial statement level
•
Preliminary identification of high risk audit
areas
•
Whether you plan to test controls
•
Level of client assistance
42
Assess Risks at the Relevant Assertion
Level
•
Identify risks of material misstatement (due to
error or fraud) for specific
—
Account balances
Transaction classes
Disclosures
•
Consider what can go wrong at the relevant
assertion level
43
Assess Risks at the Relevant Assertion
Level Diagram
44
Assess Risks at the Relevant Assertion
Level
(cont)
•
Assessing risks at the assertion level
Are the risks of a magnitude that could result
in material misstatement?
What is the likelihood that the risks could
result in material misstatement?
•
Likelihood is a function of:
Inherent risk
Control risk
•
Need a basis for the assessment
45
Assess Risks at the Relevant Assertion
Level
(cont..)
•
Identify significant risks that require special
audit consideration
Fraud risks
Other significant risks
•
Significant risks often relate to:
Significant economic, accounting, or other
developments
Complex, nonroutine, or judgmental matters
Transactions with related parties
46
Assess Risks at the Relevant Assertion
Level
(cont…)
•
Identify risks for which substantive procedures
alone are not adequate
•
Revise the risk assessment and reconsider
planned audit procedures if audit evidence
contradicts the original risk assessment
Assess Risks
•
Document the following:
Risk assessment at the relevant assertion level
Basis for the assessment
Significant risks
Risks for which substantive procedures alone are
not adequate
•
CX-7.1: “Risk Assessment Summary Form”
(Part II)
48
The Detailed Audit Plan
•
The nature, timing, and extent of further audit
procedures to respond to the risk assessment
(i.e., the audit program)
•
Provides linkage between the risk assessment
and the responses at the assertion level
49
Tailoring the PPC Audit Programs
Performing Further Audit Procedures
51
Tests of Controls
•
Perform tests of controls if:
Relying on them to reduce the risk assessment
Substantive tests alone are not adequate
•
Inquiry alone is not sufficient for testing
controls
52
Tests of Controls
(cont)
•
Rotational tests of controls are permitted:
Obtain evidence about whether the controls have changed
using inquiry, observation, and inspection
If controls have changed, rotation is not appropriate
Test a control at least once every three years
If several controls are rotationally tested, test some
controls each year
If relying on controls for significant risks, controls must be
tested in the current year
•
CX-10.1: “Test of Controls Form”
53
Substantive Procedures
•
Test
all
relevant assertions for material
account balances, transaction classes, and
disclosures
•
Perform procedures specifically to address
significant risks
•
Substantive analytical procedures alone are
not sufficient for significant risks
54
Substantive Procedures
(cont)
•
Perform the following substantive procedures
in all audits:
Agree or reconcile the financial statements and
notes to the accounting records
Examine material journal entries and other
adjustments made when preparing the financial
statements
Procedures required by AU-C 240 to address the
risk of management override of controls
•
Required procedures are on AP-2, “Audit
Program for General Auditing and
Completion Procedures”
55
Documenting Further Audit Procedures
•
Document the following:
Nature, timing, and extent
Linkage
Results, including results of procedures to address
management override
Conclusion about relying on tests of controls
performed in a prior audit
56
Summary
•
Completed risk assessment consists of:
AP-1: “Audit Program for General Planning Procedures”
CX-1.1: “Engagement Acceptance and Continuance Form”
CX-1.2: “Engagement Independence Compliance and
Nonattest Services Documentation Form
CX-2: “Financial Statement Materiality Worksheet for
Planning Purposes”
CX-3.1: “Understanding the Entity and Identifying Risks”
CX-3.2: “Engagement Team Discussion”
CX-3.3: “Fraud Risk Inquiries Form”
Summary
(cont)
•
Completed risk assessment (cont.)
CX-4.1: “Understanding the Design and Implementation of
Internal Control”
CX-4.2.1: “Financial Reporting System Documentation
Form—Significant Transaction Classes” (for each significant
transaction class and financial close and reporting)
CX-4.2.2: “Financial Reporting System Documentation
Form—IT Environment and General IT Controls”
CX-4.3: “Walkthrough Documentation Table” (for each
walkthrough)
CX-7.1: “Risk Assessment Summary Form”
Summary
(cont…)
•
Other PPC practice aids related to risk
assessment
CX-5: “Activity and Entity-level Control Forms” (optional)
CX-6.1: “Entity Risk Factors” (memory jogger)
CX-6.2: “Fraud Risk Factors” (memory jogger)
CX-10.1: “Test of Controls Form” (if controls are tested)
CX-12.2: “Audit Difference Evaluation Form”
AP-2: “Audit Program for General Auditing and Completion
Procedures”
Tailored audit programs for individual audit areas
SAS No. 145 Highlights
Enhances and clarifies aspects of assessing the risks of material
misstatement
Introduces or revises key definitions, such as significant risk and
spectrum of inherent risk
Requires separate assessment of inherent risk and control risk
Revises requirements related to understanding the entity’s
system of internal control and the evaluation of the design of
certain controls
Implements a new stand-back requirement
Effective for audits of financial statements for periods ending
on or after December 15, 2023
Questions?
Learn about the audit risk assessment process, including objectives, risk assessment techniques, and the PPC audit approach. Understand preliminary engagement activities, client acceptance/continuance considerations, and important documentation. Explore how to assess risks of material misstatement and develop responses, as well as perform further audit procedures and evaluate findings. Enhance your understanding of identifying and assessing risks, concentrating audit effort in high-risk areas, and issuing reports and communications.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Understanding Audit Risk Assessment
Objectives of This Course: Outline the PPC audit risk assessment process Understand how to use PPC practice aids to perform and document risk assessment
What is Risk Assessment? Risk Assessment Obtain an understanding of the client, including internal control Identify and assess risks of material misstatement of the financial statements, whether due to error or fraud Evaluate both overall risks and risks that affect only specific assertions Audit Procedures Concentrate audit effort in high risk areas Inherent risk Control risk Perform less extensive procedures in low risk areas Linkage
PPC Audit Approach Step Description Perform Preliminary Engagement Activities Client acceptance/continuance Establish an understanding with the client in an engagement letter 1 Perform Planning and Risk Assessment Procedures Hold an engagement team discussion Determine materiality Perform risk assessment procedures Understand the entity and its environment, including internal control Perform a retrospective review of accounting estimates 2 Assess Risks and Develop Responses Assess risks at the financial statement level Develop the overall audit strategy Assess risks at the relevant assertion level Develop the detailed audit plan 3 Perform Further Audit Procedures Tests of controls Substantive procedures 4 Evaluate Audit Findings 5 Issue Reports and Communications 6
Preliminary Engagement Activities Client acceptance/continuance Establish an understanding with the client
Client Acceptance/Continuance Consider: Nature and purpose of engagement Preconditions for an audit Client s reputation, integrity, and competence Communication with predecessor Compliance with ethical requirements, including independence Adequacy of accounting records Firm resources and competence Engagement economics Other risk concerns Document CX-1.1: Engagement Acceptance and Continuance Form CX-1.2: Engagement Independence Compliance and Nonattest Services Documentation Form CX-7.1: Risk Assessment Summary Form (if risks are identified)
Establish an Understanding with the Client Establish an understanding about: Objectives of the engagement Auditor s services to be performed, including nonattest services Management s responsibilities Auditor s responsibilities Limitations of the engagement Communicate the understanding in a written engagement letter CL-1.1: Audit Engagement Letter
Planning and Risk Assessment Procedures Hold an engagement team discussion Determine materiality Perform risk assessment procedures Understand the entity and its environment, including internal control Perform a retrospective review of accounting estimates
Engagement Team Discussion Susceptibility of the financial statements to material misstatement, including material misstatement due to fraud or error that could result from the related party relationships Application of GAAP to the entity s facts and circumstances in light of its accounting policies Fraud-related matters Include: Critical issues and areas of significant audit risk Areas susceptible to management override of controls Unusual accounting practices Important control systems Significant IT applications and how IT may affect the audit Materiality considerations Need to exercise professional skepticism Business risks
Engagement Team Discussion (cont.) Attendance: Engagement partner Key members of engagement team Document: How and when the discussion occurred, who participated, and decisions about planned responses CX-3.2: Engagement Team Discussion CX-7.1: Risk Assessment Summary Form (if risks are identified)
Materiality Materiality for the financial statements as a whole Materiality for particular items of lesser amounts Performance materiality Component materiality (group audits only)
Materiality (cont.) Apply professional judgment Consider decisions that users make Use appropriate benchmarks, such as % of assets or revenue Re-evaluate materiality as the audit progresses. If lower, reconsider: Level of performance materiality Adequacy of procedures
Materiality (cont) Document: Materiality at the financial statement level If applicable, materiality level(s) for particular transaction classes, account balances, or disclosures Performance materiality Factors considered in their determination Any revisions made during the audit The amount below which misstatements would be considered clearly trivial CX-2: Financial Statement Materiality Worksheet for Planning Purposes CX-3.5: Analysis of Group Components and Determination of Component Materiality
Risk Assessment Two categories of audit procedures: Risk assessment procedures Further audit procedures Risk Assessment Procedures Both Provide Audit Evidence Further Audit Procedures
Risk Assessment Procedures Diagram Observation and Inspection Analytical Procedures Inquiry Risk Assessment Procedures
Risk Assessment Procedures (cont) Performed to obtain an understanding of the entity and its environment, including internal control, for the purpose of assessing risks All of the procedures should be performed Inquiry alone is not sufficient to understand internal control Provide audit evidence
Inquiries Management Internal audit (if such a function exists) Other employees External parties (maybe)
Required Inquiries Inquire about: Entity and its environment Fraud-related matters Related parties Accounting estimates Compliance with laws and regulations Service organizations Document the inquiries: CX-3.3, Fraud Risk Inquiries Form CX-7.1, Risk Assessment Summary Form (if risks are identified)
Observation and Inspection Inspect documents and records Read management and internal reports and minutes Read external information Visit premises and plant facilities Trace transactions through the system (walkthroughs)
Analytical Procedures Preliminary analytical procedures Analytical procedures related to revenue required by AU-C 240 To enhance understanding of the business and identify potential risk areas Documented by completing a step on AP-1: Audit Program for General Planning Procedures Add risks to CX-7.1: Risk Assessment Summary Form
Risk Assessment Procedures Document the procedures performed AU-C 230 provides guidance on documenting procedures For inquiries, document the date, name, and title of individual, inquiry, and response For observation, document what was observed, where, when, and entity personnel involved For inspection, document the identifying characteristics, for example, document name or number and date
Understanding the Entity and Its Environment Perform risk assessment procedures (inquiry, analytics, observation, and inspection) to gather information about: Industry, regulatory, and other external factors Nature of the entity Objectives, strategies, and related business risks Measurement and review of the entity s financial performance Selection and application of accounting policies Internal control
Understanding the Entity and Its Environment (cont) Obtain an understanding of the client s selection and application of accounting policies Are accounting policies appropriate for the entity and consistent with the industry? Are there any changes in accounting policies? 23
Understanding the Entity and Its Environment (cont.) Consider the presence of fraud risk factors Update information obtained in prior years by performing risk assessment procedures to determine if the information has changed
Using the PPC Approach CX-3.1: Understanding the Entity and Identifying Risks Key elements of the understanding The consideration of fraud risk factors Sources of information Risk assessment procedures performed CX-7.1: Risk Assessment Summary Form CX-6.1: Entity Risk Factors and CX-6.2: Fraud Risk Factors (memory joggers) 25
Understanding Internal Control Diagram Control Environment Risk Assessment Information and Communication Monitoring Control Activities 26
Understanding Internal Control Understand design and implementation Perform inquiry, observation, and inspection Inquiry alone is not sufficient to understand the design and implementation of controls 27
Understanding Internal Control (cont.) Evaluate the design and implementation of controls Related to significant risks Related to risks that cannot be tested effectively using substantive procedures alone Understand How the incorrect processing of transactions is resolved How detail is reconciled to the general ledger for material accounts 28
Understanding Internal Control (cont) Document the following: Understanding of internal control components Sources of information Procedures performed Controls evaluated related to significant risks and risks for which substantive procedures alone are not effective
The PPC Approach Entity-level controls Control environment Risk assessment Information and communication Monitoring Activity-level controls Financial reporting system Control activities IT environment and general IT controls
Using the PPC Approach (cont) CX-4.1: Understanding the Design and Implementation of Internal Control Evaluate entity-level controls Identify significant transaction classes CX-4.2.1: Financial Reporting System Documentation Form Significant Transaction Classes Document the processing of transactions for each significant transaction class Document the financial close and reporting process
Using the PPC Approach (cont) CX-4.2.2: Financial Reporting System Documentation Form IT Environment and General IT Controls Understand the effect of IT CX-4.3.1: Walkthrough Documentation Memo or CX-4.3.2: Walkthrough Documentation Table For each walkthrough CX-5: Activity and Entity-level Control Forms (optional)
Identifying Significant Transaction Classes Transaction classes that present a reasonable possibility of material misstatement of the financial statements or disclosures based on: Volume of activity Size and composition of accounts Types of transactions Presence of fraud risks or other significant risks Changes from the prior period
Understanding Significant Transaction Classes How are transactions initiated and authorized? How are transactions recorded, processed, and corrected? How are transactions transferred to the general ledger and reconciled? What reports are generated and how are they used?
Understanding Significant Transaction Classes (cont) Consider control objectives: Completeness: All transactions are recorded Occurrence: All recorded transactions occurred and pertain to the entity Accuracy: Transactions are recorded in the proper amount Classification: Transactions are recorded in the proper account Cutoff: Transactions are recorded in the proper period
Documenting Significant Transaction Classes Narrative description Focus on key controls and control objectives related to identified risks How are control objectives achieved? What controls are in place to address significant or fraud risks? Are controls properly designed and implemented?
Performing Walkthroughs Select one or a few transactions Trace from initial creation of the source document to final posting in the general ledger Inspect documents and records used in processing, make inquiries, and observe procedures being performed
Retrospective Review of Accounting Estimates Performed to evaluate: Effectiveness of management s estimation process Information relevant to current year estimates The need for disclosure The existence of possible management bias AP-1: Audit Program for General Planning Procedures
Assessing Risks and Developing Responses Assess risks at the financial statement level Develop the overall audit strategy Assess risks at the relevant assertion level Develop the detailed audit plan
Assess Risks at the Financial Statement Level Identify risks that are pervasive to the financial statements and potentially affect many assertions Assess the risk of material misstatement at the financial statement level Develop overall responses Document the risk assessment and the responses CX-7.1: Risk Assessment Summary Form (Part I) 40
Develop the Overall Audit Strategy Characteristics of the engagement that define its scope Reporting objectives of the engagement Important factors that determine audit focus Resources needed to perform the audit 41
Factors That Determine Audit Focus Materiality levels Assessed risk of material misstatement at financial statement level Preliminary identification of high risk audit areas Whether you plan to test controls Level of client assistance 42
Assess Risks at the Relevant Assertion Level Identify risks of material misstatement (due to error or fraud) for specific Account balances Transaction classes Disclosures Consider what can go wrong at the relevant assertion level 43
Assess Risks at the Relevant Assertion Level Diagram Rights or Obligations Valuation or Allocation Accuracy or Classification Completeness Account Balances, Transaction Classes, Disclosures Existence or Occurrence Cutoff 44
Assess Risks at the Relevant Assertion Level (cont) Assessing risks at the assertion level Are the risks of a magnitude that could result in material misstatement? What is the likelihood that the risks could result in material misstatement? Likelihood is a function of: Inherent risk Control risk Need a basis for the assessment 45
Assess Risks at the Relevant Assertion Level (cont..) Identify significant risks that require special audit consideration Fraud risks Other significant risks Significant risks often relate to: Significant economic, accounting, or other developments Complex, nonroutine, or judgmental matters Transactions with related parties 46
Assess Risks at the Relevant Assertion Level (cont ) Identify risks for which substantive procedures alone are not adequate Revise the risk assessment and reconsider planned audit procedures if audit evidence contradicts the original risk assessment
Assess Risks Document the following: Risk assessment at the relevant assertion level Basis for the assessment Significant risks Risks for which substantive procedures alone are not adequate CX-7.1: Risk Assessment Summary Form (Part II) 48
The Detailed Audit Plan The nature, timing, and extent of further audit procedures to respond to the risk assessment (i.e., the audit program) Provides linkage between the risk assessment and the responses at the assertion level 49
Tailoring the PPC Audit Programs No audit program Used for insignificant audit areas with low RMM Limited Primarily substantive analytics Some tests of details (required by GAAS) Basic Basic + Extended Tests of details and extended analytics For audit areas or assertions with higher risk
