What is risk assessment in audit planning?
|
– September 16, 2021 Show
 Risk assessments establish the audit approach and procedures that need to be performed on an audit. As auditors plan an audit, they assess the risk of material misstatement of a company or organization at the assertion level so that they can determine the level of substantive audit testing that needs to be performed. The assessed risk of material misstatement is determined by assessing the inherent and control risk at the relevant assertion level of a company by its significant audit areas. These risk assessments and conclusions in audits can be challenging, but they are necessary and important to perform an efficient and effective audit. These risk assessments also need to be documented appropriately, and that is where auditors commonly run into some issues with the audits. Common pitfalls in the documenting of risk assessments include the following:
1. Document Inherent RiskInherent risk is the susceptibility of an assertion about a class of transaction, account balance or disclosure to a misstatement that could be material without considering any internal controls. Although auditors are always able to explain the reasons for the determination of the inherent risks assessed on a company or organization being audited, those considerations are not always documented appropriately. It is important to document the reasons for the inherent risk assessment determination for each significant audit area and relevant assertion. Some audit areas and assertions might have inherent risk assessment set at high, for example, due to transactions being difficult to audit or containing complex calculations. Others might be set at low or moderate because the calculations are simple and the transactions are not difficult to audit. Documenting these considerations is important to determine an auditor’s reasons for their assessments, their audit approach and to properly design the audit procedures being performed. 2. Sufficiently Test the ControlsTo be able to assess control risk at less than high, an auditor must have performed a test of controls on the audit areas and relevant assertions. Preparing a narrative or memorandum on the internal controls that are in place in the respective audit areas without performing any test of controls on the audit areas is not sufficient to assess control risk at less than high. Testing of the actual controls that are in place must be performed, and the details of those tests must be documented to support the control risk assessment. 3. Use the Relevant Assertion LevelThere are six categories of assertions when an auditor makes their risk assessments:
When documenting risk assessments, an auditor needs to make an assessment for each relevant assertion, regardless of whether an auditor has identified any specific risks related to that assertion. Risk assessment can no longer be performed by the audit area and must be performed by the assertion level. 4. Assess All Significant Audit AreasAn audit area is considered significant if it contains significant transaction class, material account balance, fraud risk or other significant risk, or if it requires significant disclosures. It is important to perform a risk assessment on all the audit areas considered significant in order to be able to develop an appropriate audit approach and procedures for that area. If a significant area is missed, the audit can be ineffective. Additionally, assessing risk on a nonsignificant audit area can cause the audit to be inefficient. 5. Provide Proper DocumentationThe risk assessed should link to the nature, timing and extent of audit procedures performed. The risk assessment documentation should reference — or comments should be made — linking the assessments to the audit work performed. Audit procedures might need to be tailored to do the risk assessments, or the risk assessments might need to be revised due to changes needed in the audit procedures being performed. The risk assessments are developed at planning but can change throughout the audit process. These changes should be documented, and the risk assessments should be updated during the audit. Explaining the reasons why a certain audit approach and certain audit procedures were taken on an audit is not enough without any documentation for those decisions. Documentation of the risk assessments that lead to those audit approaches and audit procedures are necessary for an audit to be in compliance with the risk assessment standards. Michael CaroMichael Caro, Jr., CPA, CFE, PSA, is a partner at Bederson LLP. He is a member of the NJCPA. This article appeared in the Fall 2021 issue of New Jersey CPA magazine. Read the full issue. What is risk assessment planning?The risk assessment plan shows how potential risks are assessed and mitigated in order to avoid any negative influence on the ADMONT project objectives. The interrelated risk assessment plan – risk identification, handling and monitoring – were established.
What is the risk assessment?What is a risk assessment? Risk assessment is a term used to describe the overall process or method where you: Identify hazards and risk factors that have the potential to cause harm (hazard identification). Analyze and evaluate the risk associated with that hazard (risk analysis, and risk evaluation).
What is risk assessment in internal audit?Risk assessment is the identification and analysis of relevant risks to the achievement of an organization's objectives, for the purpose of determining how those risks should be managed.
How do you perform a risk assessment procedure in auditing?During the initial planning phase of an audit, an auditor should do the following:. Understand the entity and its environment.. Understand entity-level controls.. Understand the transaction level controls.. Use preliminary analytical procedures to identify risk.. Perform fraud risk analysis.. Assess risk.. |
