Risk Assessment and Responses

Introduction

Auditing is a risk-based process. An auditor cannot examine every transaction with equal intensity, so audit effort is directed toward matters that could cause a material misstatement in the financial statements. Risk assessment connects the auditor’s understanding of an entity with the design of further audit procedures.

A sound risk assessment requires more than listing possible errors. The auditor must understand the entity and its environment, identify risks at the financial-statement and assertion levels, assess inherent and control risk, determine the risk of material misstatement, and design appropriate responses. Professional judgment remains essential because risk models support, but do not replace, judgment.

Learning Objectives

After studying this chapter, you should be able to:

1. Explain why understanding the entity, industry and business model is central to audit planning.
2. Apply the audit risk model and distinguish its components.
3. Identify risks of material misstatement at financial-statement and assertion levels.
4. Assess inherent risk and control risk using professional judgment.
5. Explain significant risks under the current risk-assessment approach.
6. Design overall responses and assertion-level audit procedures.
7. Evaluate the limitations of risk assessment and the effects of technology, fraud and professional skepticism.

1. The Risk-Based Audit Approach

The objective of a financial statement audit is to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by fraud or error. Reasonable assurance is a high, but not absolute, level of assurance. Absolute assurance is impossible because of sampling, judgment, inherent limitations of controls, and the possibility of sophisticated concealment.

A misstatement is material if, individually or in combination, it could reasonably be expected to influence the economic decisions of users. Materiality is therefore both quantitative and qualitative. A small misstatement may be material if it conceals an unlawful transaction, changes a loss into profit, affects compliance with a loan covenant, or masks a trend.

Risk assessment is iterative. Initial assessments guide audit procedures, but evidence obtained during the audit may change the assessment. For example, a control initially judged effective may fail during operating-effectiveness testing, requiring greater substantive work.

2. Understanding the Entity and Its Environment

The auditor obtains an understanding sufficient to identify and assess risks and to design further audit procedures. The understanding normally covers the following areas.

2.1 Industry and external environment

Relevant matters include:

• industry competition, demand and technological change;
• regulation, taxation and financial reporting requirements;
• economic conditions, interest rates, inflation and foreign exchange exposure;
• supply-chain dependence and labor-market conditions; and
• environmental, social and governance pressures where they affect financial reporting.

For example, a retailer facing rapid technological obsolescence may have elevated inventory valuation risk. A bank operating in a volatile interest-rate environment may face heightened valuation and expected-credit-loss risk.

2.2 Nature of the entity

The auditor considers ownership, governance, organizational structure, sources of finance, locations, subsidiaries, related parties and information systems. Complex structures can create consolidation, related-party and presentation risks.

2.3 Objectives, strategies and business risks

Business risks arise from conditions that may prevent an entity from achieving its objectives. They are not automatically risks of material misstatement, but they may lead to such risks. Examples include:

• a strategy of aggressive expansion increasing capitalization and impairment risk;
• dependence on one customer increasing revenue-recognition and going-concern risk; and
• acquisition activity increasing valuation, classification and consolidation risk.

The auditor should trace the connection: business condition → management response → possible financial reporting effect → affected assertion.

2.4 Measurement and review of financial performance

Management may monitor budgets, margins, cash flows, debt ratios, customer churn, inventory turnover or segment performance. Such measures can create pressure to meet targets and therefore increase management-bias or fraud risk. They also help the auditor identify unusual relationships.

2.5 Applicable financial reporting framework

The auditor considers the accounting policies selected, changes in policies, estimates, disclosures and areas involving significant judgment. Inconsistent application of policies may indicate control deficiencies or management bias.

2.6 Internal control and information technology

The auditor obtains an understanding of relevant controls, including the control environment, risk-assessment process, information system, control activities, monitoring and controls relevant to financial reporting. Understanding a control does not mean that the auditor has concluded it operates effectively.

Technology-related matters include automated controls, access rights, privileged users, program changes, interfaces, data conversion and dependence on third-party service organizations. A highly automated system may reduce some routine processing errors while increasing the importance of access and change-management controls.

3. The Audit Risk Model

A traditional planning representation is:

where:

• AR = acceptable audit risk;
• RMM = risk of material misstatement; and
• DR = detection risk.

Risk of material misstatement is commonly decomposed as:

where IR is inherent risk and CR is control risk. Combining the relationships gives:

These equations are planning models, not precise probability laws. In practice, risks may not be statistically independent, and auditors do not normally assign objectively measurable probabilities to every component. The model is useful because it shows the direction of audit response: when assessed inherent or control risk increases, the auditor generally needs to reduce detection risk through more persuasive or extensive procedures.

Worked example: determining a planning level of detection risk

Assume an auditor uses illustrative planning assessments of:

• acceptable audit risk = 4% or 0.04;
• inherent risk = 75% or 0.75; and
• control risk = 60% or 0.60.

Using AR = IR × CR × DR:

The calculation is illustrative. It does not imply that audit risk can be measured with mathematical precision. It indicates that the auditor’s planned detection risk is relatively low and therefore more persuasive procedures are required.

4. Inherent Risk and the Inherent-Risk Spectrum

Inherent risk is the susceptibility of an assertion about a class of transactions, account balance or disclosure to misstatement that could be material, before considering related controls. It is influenced by the nature of the item and the way the entity operates.

Factors that may increase inherent risk include:

• complexity;
• subjectivity and estimation uncertainty;
• change or uncertainty;
• susceptibility to management bias or fraud;
• unusual transactions;
• volume and repetitive processing; and
• dependence on specialized knowledge.

Inherent risk is better viewed as a spectrum rather than simply “high” or “low.” For example, an account requiring a simple recalculation may be near the lower end, whereas a complex fair-value estimate based on unobservable assumptions may be near the upper end.

A significant risk is a risk of material misstatement that, in the auditor’s professional judgment, requires special audit consideration. Under the current risk-assessment approach, this principally includes risks whose inherent risk is assessed near the upper end of the spectrum of inherent risk, and risks that are required to be treated as significant by another ISA. The designation is not based merely on the existence of a large account or on the auditor’s decision to perform more work.

Fraud risks are ordinarily treated as significant risks because fraud may involve intentional concealment, collusion or management override. The auditor must also consider whether the accounting treatment for the significant risk is appropriate and whether responses address the specific risk.

5. Control Risk and Internal Control

Control risk is the risk that a misstatement that could occur in an assertion and that could be material will not be prevented, or detected and corrected, on a timely basis by controls.

Controls may be:

• Preventive, such as credit limits or segregation of duties;
• Detective, such as reconciliations and management review;
• Manual, such as approval of a journal entry; or
• Automated, such as system validation of an invoice number.

The auditor evaluates the design and implementation of relevant controls. If the auditor intends to rely on controls, operating effectiveness must also be tested. Inquiry alone generally does not provide sufficient evidence of operating effectiveness. Inspection, observation, reperformance and testing of relevant system-generated information may be necessary.

A control deficiency may arise from poor design, inadequate implementation or ineffective operation. Deficiencies are evaluated individually and in combination. Significant deficiencies and material weaknesses, where relevant under the applicable framework, must be communicated to those charged with governance at the required time.

Control reliance and substantive work

If controls are effective and the auditor plans to rely on them, tests of controls are performed. Substantive procedures are still required for material classes of transactions, account balances and disclosures; reliance on controls does not eliminate substantive procedures. For significant risks, substantive procedures responsive to the risk are generally required even when controls are tested.

6. Identifying Risks of Material Misstatement

Risk identification should be specific. “Revenue is risky” is less useful than “cut-off risk exists because sales representatives receive bonuses for shipments recorded before year-end.” A disciplined process is:

1. Identify relevant events and conditions.
2. Determine how they could cause a misstatement.
3. Identify the affected account, transaction class or disclosure.
4. Link the risk to assertions.
5. Assess inherent risk, considering likelihood and magnitude.
6. Consider relevant controls and assess control risk.
7. Determine whether the risk is significant.
8. Design responses and update the assessment as evidence is obtained.

Assertions

For transactions and events, relevant assertions include occurrence, completeness, accuracy, cut-off, classification and presentation. For account balances, they include existence, rights and obligations, completeness, valuation and allocation. For disclosures, they include occurrence and rights and obligations, completeness, classification and understandability, and accuracy and valuation.

7. Overall Responses to Assessed Risks

Overall responses address risks at the financial-statement level. They may include:

• assigning more experienced staff or specialists;
• increasing supervision and review;
• emphasizing professional skepticism;
• incorporating unpredictability into procedures;
• changing the timing of procedures, including work nearer year-end; and
• increasing the extent of supervision, review or substantive testing where justified.

Documentation is essential, but “expanding the nature and extent of documentation” is not itself an audit-risk response. Documentation records the auditor’s understanding, judgments, evidence and conclusions; it does not reduce audit risk. A genuine response changes the nature, timing or extent of audit work, staffing, supervision or skepticism.

8. Assertion-Level Responses

Assertion-level responses consist of tests of controls, substantive analytical procedures and tests of details.

Tests of controls

These determine whether controls operated effectively during the relevant period. Examples include inspecting evidence of authorization, observing performance of a control, reperformance of a reconciliation and testing automated controls with appropriate IT procedures.

Substantive analytical procedures

Analytical procedures evaluate plausible relationships among financial and non-financial data. They are effective when relationships are predictable and data are reliable. The auditor develops an expectation, determines an acceptable difference, compares the recorded amount with the expectation and investigates significant differences.

Tests of details

Tests of details inspect documentary evidence, confirm balances, observe assets, recalculate amounts, perform cut-off tests and search for unrecorded liabilities. The procedure must match the assertion. Confirmation may provide evidence about existence of receivables but is less direct evidence about valuation or completeness of liabilities.

Nature, timing and extent

• Nature concerns the type and persuasiveness of procedure.
• Timing concerns when it is performed.
• Extent concerns the amount of testing, such as sample size or number of locations.

When risk increases, the auditor may use more reliable evidence, perform work closer to year-end, increase sample sizes or test more locations. These are judgments, not automatic mechanical consequences.

9. Fraud, Estimates and Professional Skepticism

Fraud risk assessment requires discussion among the engagement team, inquiries of management and others, consideration of incentives and opportunities, and attention to management override. Journal-entry testing should be risk-directed rather than a purely mechanical search.

Accounting estimates require attention to methods, assumptions, data, estimation uncertainty and potential management bias. Retrospective review of prior estimates may reveal systematic optimism or pessimism, although differences do not automatically prove misstatement.

Professional skepticism means maintaining a questioning mind and critically assessing audit evidence. It is not an assumption that management is dishonest; nor is it uncritical acceptance of management representations.

10. Applied Case: Northstar Components Ltd.

This is an illustrative fictional case.

Background

Northstar Components manufactures electronic parts. It expanded rapidly, introduced a new enterprise-resource-planning system in November, and obtained a loan containing an earnings covenant. Management bonuses depend on annual revenue and operating profit.

Problem

Preliminary analytics show a sharp increase in December sales, a decline in gross margin, and a rise in inventory days. Several customers have extended payment terms. Management has capitalized substantial development expenditure.

Analysis

The circumstances indicate several risks:

1. Revenue occurrence and cut-off: bonus incentives and unusual December growth create a risk that goods were recorded before transfer or without valid customer orders.
2. Receivables valuation: extended payment terms and slow collections create expected-credit-loss risk.
3. Inventory valuation: rising inventory days and lower margins suggest obsolescence or net-realizable-value problems.
4. Development costs: capitalization may be inappropriate if recognition criteria are not met.
5. IT change risk: the new system may have interface, access or data-conversion errors.
6. Covenant pressure: incentives increase management-bias and override risk.

Revenue occurrence and cut-off, and management override, may require special consideration because their inherent risk is high and fraud is possible.

Approach and solution

The auditor should assign experienced staff, increase supervision, and include unpredictable procedures. At assertion level, the auditor should:

• inspect contracts, dispatch records and customer acceptances for December and January;
• confirm selected receivables and examine subsequent cash receipts;
• test inventory aging, physical condition and post-year-end selling prices;
• inspect development project records and assess applicable recognition criteria;
• test system migration reconciliations, access rights and relevant automated controls;
• test selected manual and unusual journal entries, especially those posted near year-end; and
• evaluate covenant calculations and related disclosures.

The auditor should revise the risk assessment if exceptions arise. For example, failed controls over shipping dates would justify increased substantive cut-off testing and reduced reliance on those controls.

Outcome

Assume the work identifies several January dispatches recorded as December sales and obsolete inventory requiring a write-down. Management adjusts the financial statements and strengthens shipping controls. The auditor communicates control deficiencies and concludes whether remaining unadjusted misstatements are material individually or in aggregate.

Learning points

The case demonstrates that business pressures become audit risks only after their financial reporting consequences are identified. It also shows why risk assessment must connect incentives, systems, assertions, evidence and responses.

11. Limitations, Governance and Contemporary Practice

Risk assessment involves uncertainty. Sampling risk, management representations, weak evidence, time pressure and confirmation failures can lead to inappropriate conclusions. A sophisticated control environment may still be defeated by collusion or management override.

Governance bodies should challenge management’s estimates, significant transactions, related-party relationships and control deficiencies. Auditors must comply with applicable auditing standards, independence requirements, confidentiality obligations and documentation requirements.

Data analytics and AI can help identify unusual journal entries, duplicate payments, abnormal margins and outlier transactions. However, an algorithm does not establish that a transaction is misstated. Data completeness, model bias, explainability, cybersecurity and human review remain important. Technology should enhance professional judgment, not replace it.

Best-practice checklist

• Understand how the entity creates value and generates cash.
• Link business risks to accounts and assertions.
• Distinguish inherent risk from control risk.
• Treat the inherent-risk spectrum as a matter of professional judgment.
• Design responses that actually alter audit work; do not confuse documentation with risk reduction.
• Use evidence appropriate to the assertion.
• Reassess risk when contradictory evidence appears.
• Communicate significant deficiencies and significant risks appropriately.
• Maintain independence, skepticism and confidentiality.

Chapter Summary

Risk assessment is the foundation of an effective audit. The auditor understands the entity, industry, business model, financial reporting framework, internal control and information technology to identify risks of material misstatement. The audit risk model expresses the planning relationship AR = IR × CR × DR, while recognizing that the components are professional judgments rather than exact statistical probabilities.

Inherent risk reflects susceptibility before controls and is assessed along a spectrum. Significant risks principally involve risks near the upper end of that spectrum or risks designated under another auditing standard. Control risk concerns whether relevant controls prevent, detect or correct misstatements. Responses operate at both the overall financial-statement level and the assertion level through tests of controls, analytical procedures and tests of details. Documentation supports and records the audit; it is not, by itself, a response that reduces audit risk. Effective auditing also requires skepticism, attention to fraud and estimates, appropriate use of technology, ethical conduct and continual reassessment.

Key Terms

Audit risk: Risk that the auditor expresses an inappropriate opinion when financial statements are materially misstated.

Assertion: A representation by management embodied in the financial statements.

Business risk: A condition or event that may prevent the entity from achieving its objectives.

Control risk: Risk that relevant controls fail to prevent, detect or correct a material misstatement.

Detection risk: Risk that audit procedures fail to detect a material misstatement that exists.

Financial-statement-level risk: Risk affecting the financial statements broadly, often involving the control environment or management integrity.

Inherent risk: Susceptibility of an assertion to material misstatement before related controls.

Inherent-risk spectrum: Range from lower to higher susceptibility to material misstatement.

Material misstatement: A misstatement that could influence users’ decisions.

Materiality: The significance of information or misstatement to financial statement users.

Professional skepticism: A questioning mind and critical assessment of audit evidence.

Reasonable assurance: A high, but not absolute, level of assurance.

Risk of material misstatement: Combined effect of inherent risk and control risk.

Significant risk: A risk requiring special audit consideration, principally because inherent risk is near the upper end of its spectrum or another ISA requires the designation.

Substantive analytical procedure: Evaluation of financial information through analysis of plausible relationships.

Test of controls: Audit procedure evaluating operating effectiveness of controls.

Test of details: Direct examination of transactions, balances or disclosures.

Unpredictability: Variation in audit procedures intended to reduce the ability to anticipate all procedures.

Review Questions

Short Answer Questions

1. Why must an auditor understand an entity’s industry and business model?
2. Define inherent risk and control risk.
3. What is the purpose of assertions in audit planning?
4. Distinguish tests of controls from tests of details.
5. Why is documentation not itself an audit-risk response?

Long Answer Questions

1. Explain the audit risk model and discuss its limitations as a planning model.
2. Describe a systematic process for identifying and assessing risks of material misstatement.
3. Explain how the inherent-risk spectrum informs the identification of significant risks.
4. Compare overall responses with assertion-level responses and provide examples of each.
5. Discuss how fraud incentives, accounting estimates and management override affect audit risk.

Analytical / Application Questions

1. A company offers unusually generous year-end return rights and records a large December sales increase. Identify the affected assertions, assess the likely risks and design audit responses.
2. An auditor assesses acceptable audit risk at 5%, inherent risk at 80% and control risk at 50%. Using the planning model, calculate detection risk and explain what the result implies for audit procedures.
3. During testing, a supposedly effective approval control is found to have failed repeatedly. Explain how the auditor should revise the risk assessment, reliance on controls and substantive procedures.

Multiple Choice Questions with Answers

Question 1

Which statement best describes inherent risk?

A. The risk that the auditor selects an inappropriate opinion

B. The susceptibility of an assertion to material misstatement before related controls

C. The risk that a control fails during the audit

D. The risk that audit documentation is incomplete

Correct Answer: B. The susceptibility of an assertion to material misstatement before related controls

Question 2

Under the audit risk model, if assessed inherent risk and control risk increase while acceptable audit risk remains unchanged, the auditor will generally need to:

A. Increase planned detection risk

B. Reduce planned detection risk

C. Eliminate substantive procedures

D. Ignore the control environment

Correct Answer: B. Reduce planned detection risk

Question 3

Using AR = IR × CR × DR, if AR = 0.04, IR = 0.75 and CR = 0.60, planned detection risk is approximately:

A. 8.9%

B. 10.7%

C. 18.0%

D. 31.7%

Correct Answer: A. 8.9%

Question 4

Which is the best example of an assertion-level response to a revenue cut-off risk?

A. Assigning a more experienced audit manager

B. Increasing engagement-team supervision generally

C. Inspecting shipping documents immediately before and after year-end

D. Improving the audit file index

Correct Answer: C. Inspecting shipping documents immediately before and after year-end

Question 5

A significant risk is principally a risk that:

A. Relates only to a large account balance

B. Is near the upper end of the inherent-risk spectrum or is designated under another ISA

C. Can be eliminated by management representation

D. Requires documentation but no further audit work

Correct Answer: B. Is near the upper end of the inherent-risk spectrum or is designated under another ISA

Question 6

Which procedure primarily tests the existence of trade receivables?

A. Confirming selected balances with customers

B. Inspecting the depreciation policy

C. Recalculating inventory quantities

D. Reviewing employee expense claims

Correct Answer: A. Confirming selected balances with customers

Question 7

Which statement about documentation is correct?

A. More documentation automatically reduces audit risk

B. Documentation replaces substantive testing

C. Documentation records judgments and evidence but is not itself a risk-reducing audit response

D. Documentation is unnecessary when controls are effective

Correct Answer: C. Documentation records judgments and evidence but is not itself a risk-reducing audit response

Question 8

Which condition most directly increases inventory valuation risk?

A. Stable demand and rapid inventory turnover

B. Aged inventory and declining post-year-end selling prices

C. A completed bank reconciliation

D. A reduction in the number of suppliers

Correct Answer: B. Aged inventory and declining post-year-end selling prices

Question 9

Which is an overall response to financial-statement-level risk?

A. Confirming individual receivable balances

B. Testing inventory count sheets

C. Assigning more experienced personnel and increasing supervision

D. Recalculating one interest expense amount

Correct Answer: C. Assigning more experienced personnel and increasing supervision

Question 10

An auditor’s acceptable audit risk is 5%, inherent risk is 80%, and control risk is 50%. What is the planned detection risk using the audit risk model?

A. 12.5%

B. 20.0%

C. 25.0%

D. 62.5%

Correct Answer: A. 12.5%