Chapter 7 - Risk Assessment and Inherent Risk

Question 1

What is audit risk?

Answer 1

It is the risk that an inappropriate or erroneous conclusion is made even when audit plans and procedures are in accordance to GAAP, but it is materially misstated.

Question 2

What do we do if it is impossible to eliminate audit risk?

Answer 2

If it is impossible to eliminate audit risk you will collect sufficient appropriate audit evidence to reduce it to an acceptable level. It will then allow the auditor to draw a reasonable conclusion

Question 3

What is the relationship of audit risk to the auditor?

Answer 3

Audit risk is related to the process of auditing. It is not the auditors business risk, such as loss from litigation or adverse publicity, that can arise as a result of an audit.

Question 4

What are the two components of audit risk?

Answer 4

Audit risk is comprised of inherent risk, control risk, and detection risk. It is the foundation for all audits.

Question 5

What are the two levels that RMM exists at?

Answer 5

1. The overall financial statement level
2. The assertion level for classes of transactions, account balances, and disclosures.

Question 6

What is the risk of material misstatement at the financial statement level? What causes it?

Answer 6

Risks that relate perversely to the financial statements as a whole and potentially affect many assertions. Business risk, fraud, or deficiencies in the control environment.

Question 7

What is the risk of material misstatement at the assertion level? What are the two components of RMM at the assertion level?

Answer 7

Refers to the risks that affect classes of transactions, account balances, and disclosures. Inherent risk and control risk.

Question 8

What is inherent risk?

Answer 8

The susceptibility of an assertion relating to a class of transaction, account balance, or the disclosure before considering the effectiveness of the clients internal controls.

Question 9

What is control risk?

Answer 9

It is the risk that a clients internal controls systems will not prevent or detect material misstatement in a timely manner.

Question 10

Who does control risk and inherent risk belong too?

Answer 10

Control risk and inherent risk belong to the client, they are independent of the audit of the financial statements. Auditors have no control over these risks.

Question 11

What precedes RMM at the assertion level?

Answer 11

The nature, timing, and extent of further audit procedures - These are the procedures that go beyond the risk assessment procedures as a response to RMM

Question 12

What is detection risk?

Answer 12

It is the risk that the auditors procedures will not be effective in detecting a material misstatement when one exists. It is the only component that auditors are able to control.

Question 13

What is the audit risk model?

Answer 13

It is a conceptual tool, not a precise formula, which helps the auditor plan their risk response. It is comprised of the following

AR = RMM * Detection Risk
RMM = Inherent Risk * Control Risk

Question 14

What is the relationship between RMM and Detection risk?

Answer 14

There is an inverse relationship.

As RMM goes up, detection risk will go down as we will perform more substantive procedure ensuring we do not miss anything. They do this to make audit risk low
Ad RMM goes down, detection risk goes up as we perform less substantive procedures and focus more on the internal controls.

Question 15

What are the two most common formulas for the audit risk model? What is the relationship between control risk and sufficient appropriate audit evidence?

Answer 15

Remember we always want the Audit Risk to be low, therefore these are common:

1. Audit Risk (L) = Control Risk (H) * Inherent Risk (H) * Detection Risk (L) - More sufficient appropriate audit evidence
2. Audit Risk (L) = Control Risk (L) * Inherent Risk (L) * Detection Risk (H) - less sufficient appropriate audit evidence.

There is a direct relationship. As the control risk goes up, sufficient appropriate audit evidence goes down, and vice versa.

Question 16

How do we manage detection risk?

Answer 16

Essentially if the detection risk is high that means that the auditor will be relying on the internal controls and therefore does not care about the substantive testing rigorous processes lowering sample size, quality, etc. If the detection risk is low, this means that the auditor will be relying heavily on the substantive test procedures and thus place more of an emphasis on it.

Question 17

What are relevant assertions? When are these assertions determined?

Answer 17

Relevant assertions are assertions about a class of transactions, account balances, or disclosures that are relevant when it has an identified RMM. Before considering the internal controls.

Question 18

What are three ways to manage detection risk?

Answer 18

1. Change the nature of the audit procedures - Use high quality evidence
2. Change the timing of the audit procedures - Perform the audit procedure at the end of the year rather than during an interim period.
3. Change the extent of the audit procedures - Use a large sample size

Question 19

What does the audit risk model focus on? What are two practical ways auditors manage detection risk?

Answer 19

The audit risk model focuses on the adjustment of the further audit procedures.
1. Assigning more experienced staff to that area
2. Reviewing the completed audit tests more thoroughly.

Question 20

How do we determine the existence of RMM? What is it?

Answer 20

We assess the inherent risk factors. Inherent risk factors are events or conditions that affect RMM before the consideration of controls. It may be quantitative or qualitative.

Question 21

What are the five inherent risk factors. Briefly describe each one

Answer 21

1. Complexity - The complexity and confusing nature of the accounting records
2. Bias - Management skewing the information for their own benefit or fraud, they fail to remain neutral.
3. Subjectivity - A misunderstanding of different method to apply an accounting framework or policy, the ability to prepare in an objective manner.
4. Change - There was a change in an accounting policy, model, or environment
5. Uncertainty - Management makes estimates on the basis of imprecise non comprehensive data

Question 22

Are these factors assessed independently?

Answer 22

No, these factors are not assessed independently rather they are assessed as a whole, in a holistic manner.

Question 23

What is the purpose of evaluating the nature and significance of the risks?

Answer 23

1. Determine the overall risk response at the financial statement level. 2
2. Design the further audit procedures that address the risks at the assertion level.

Question 24

What are overall financial statement level risks?

Answer 24

These are risks that pervasively affect the financial statements as a whole or many different assertions.

Question 25

What is assessed after the overall financial statement level risk has been identified

Answer 25

1. Determine whether the risks affect the assessment of risks at the assertion level. 2. Evaluate the nature and extent of the pervasive effect on the financial statements.

Question 26

What are examples of events and conditions that are pervasive risk?

Answer 26

1. Poorly trained or inexperienced accounting staff 2. Significant control deficiencies. 3. A history of ongoing loss and liquidity problems 4. Past misstatements a/history of errors/significant amount of adjustments. 5. Fraud 6. Management integrity

Question 27

How do we develop an appropriate risk response at the assertion level?

Answer 27

We need to identify the significant class of transactions, account balances, and disclosures, with significance being related to materiality and risk factors

Question 28

What happens once the risk has been identified?

Answer 28

Determine the relevant assertion and assess the inherent risk for the assertion that depends upon the degree of the likelihood and the magnitude of misstatement, on the spectrum of inherent risk.

Question 29

What is significant risk?

Answer 29

It is the inherent risk factors, that when individual or aggregated, have increased the likelihood of misstatements occurring or the magnitude of the misstatement. Significant risks need special attention.

Question 30

What are 5 examples of significant risks?

Answer 30

1. Transactions where there are multiple acceptable accounting treatments 2. Accounting estimates that have high estimation uncertainty or complex models. 3. Account balances or quantitative disclosures that involve complex calculations 4. Accounting principles that may be subject to different interpretations 5. Changes in the entity's business

Question 31

What are two significant risks as defined by audit standards?

Answer 31

1. Related party transactions outside the normal course of business 2. Assume there is fraud in the revenue cycle.

Question 32

What is a related party? What is an example of a related party

Answer 32

A party that has the ability to influence decisions either directly or indirectly. A parent company and its subsidiary

Question 33

What is an economic dependence?

Answer 33

Is the potential for exercise of significant influence on an audit client by its most important supplier, customer, lender, or borrower.

Question 34

What are non routine transactions? Why are these transactions more risky?

Answer 34

Transactions that are unusual due to the size, nature, or they are infrequent in nature. They are more risky because they are subjected to management interventions, manual data collection and processing, complex accounting principles or calculations not fixed by internal controls systems.

Question 35

What are IFRS and ASPE requirements for non routine related party transactions on the side of those engaging in the transaction? What is a potential risk?

Answer 35

1. Disclosure the nature of the relationship 2. Description of the transaction with dollar amounts 3. Amounts due from and to related parties. - Since they are not arms length transaction parties there is a risk that they were not valued at the same amounts.

Question 36

What are the two types of responses developed by the auditor?

Answer 36

1. Overall risk response (audit strategy) addressing the pervasive risks at the financial statement level. 2. A risk response on the assertion level, further audit procedures like substantive testing and test of controls.

Question 37

What are examples of risk response at the overall financial statement level?

Answer 37

1. Assign more experienced staff of those with special skills 2. Instruct the engagement team to have heightened professional skepticism. 3. Increase the involvement of the audit partner and management 4. Closer supervision and review 5. Incorporate elements of unpredictability in the selection of the further audit procedures 6. Consider if changes need to be made to the overall audit strategy/

Question 38

What are the risk responses at the assertion level?

Answer 38

1. Test of controls 2. Test of details / substantive audit procedures

Question 39

Which is higher the fraud risk or the error risk? Why?

Answer 39

Fraud risk because it involves complex sophisticated schemes designed by perpetrators to conceal it who misrepresent information to the auditor, colluding and concealing it with other people involved.

Question 40

What are 4 ways to highlight and assess the RMM due to fraud?

Answer 40

1. Discuss with the audit team members the RMM due to fraud. 2. Make inquiries to management, those in charge of governance, and others regarding processes 3. Evaluate unusual and unexpected relationships identified when performing analytical review procedures. 4. Evaluate the risk for revenue fraud and management override and period end.

Question 41

At what level is the consideration of RMM for fraud made at?

Answer 41

It is made at the financial statement level and the assertion level for classes of transactions, account balances, presentations and disclosures.

Question 42

What are the 4 components of discussions with the audit team according to CAS regarding fraud?

Answer 42

1. How and where they believe the entity's financial statements might be susceptible to material misstatements due to fraud. - Include know internal and external factors like opportunities, pressures, and environment 2. How management could perpetrate and conceal financial reporting fraud 3. How anyone might misappropriate assets of the entity 4. How the auditor might respond to the susceptibility of material misstatements due to the fraud.

Question 43

Describe inquiries with those in charge of management, governance, and others for fraud

Answer 43

Management - Inquiries about if they are aware of any fraud, process of assessing fraud and it frequency, nature of fraud risk, internal controls, and fraud risks reported to the committee. Governance - Views on the risk for fraud and if they know knowledge or suspects of fraud Others - Ask other people like inventory management

Question 44

Describe the evaluation of unusual or unexpected relationships identified

Answer 44

As we know these analytical procedures must be done at the beginning and at completion. The auditor should evaluate results that significantly differ from the expectations

Question 45

What is the fraud triangle?

Answer 45

Represents the three conditions for fraud: Incentives / pressure, opportunities, and attitudes/rationalizations

Question 46

Describe the 3 parts of the fraud triangle

Answer 46

Incentives / pressures - Management or the employees have incentives or pressures to behave unethically Opportunities - Opportunities arise for the management or employees to behave unethically. Attitudes / Rationalizations - An attitude, character, or set of ethical values exist such that management or employees intentionally unethically. They are in an environment where they are encouraged to act unethically.

Question 47

What are fraud risk factors?

Answer 47

Entity factors that increase the risk of fraud

Question 48

What are the two parts of misappropriation of assets? What is it heavily focused on?

Answer 48

1. Theft 2. Corruption - Owner, executive, or employees abuses his or her power to subvert the decision making process for personal or company gain. - Heavier emphasis on personal interest and theft

Question 49

What are the three levels to respond to for fraud risks?

Answer 49

1. Overall financial statement level 2. Assertion level 3. Management override level.

Question 50

Describe overall response to fraud risk

Answer 50

Essentially in this section apply the 6 different types of possible responses to the overall risk response level. Ensure you use more skilled people, more skepticism, more managers and partners, closer supervision, adding elements of surprise to the nature, timing, and extent of the procedures, as well as considering changes to the overall audit strategy.

Question 51

Describe overall response to the assertion level fraud risk

Answer 51

Essentially perform more substantive analytical procedures to the account that is subjected to fraud and the type of fraud risk identified. Essentially we perform the three aspect of modifying the nature, extent, and timing of the audit procedures.

Question 52

What are the three fraud risk responses to management override and describe them

Answer 52

1. Examine the journal entries and other adjustments for evidence of possible misstatements 2. Review accounting estimates for biases - Look back at significant prior year estimates and assess any significant changes in the company's processes or managements judgments 3.Evaluate the business rationale for significant unusual transactions -

Question 53

What are the three types of automated tools and techniques that can be used to detect fraud? Briefly describe them

Answer 53

- They will typically use audit software or machine learning like MindBridge 1. Audit Data Analytics - Excel and PowerBI to look for fake revenue transactions by looking for duplicates of invoices or reconciling sales database with receivables database. , sort transactions or account balances into subcategories for further audit testing , or spreadsheet data visualization tools to perform analytical procedures at a disaggregated level 2. AI understand complex relationships among a vast amount of data, including the entities transactions, third party data, and years of journal entries and records - Looks for issues, flags them, and people follow up, and cause codes 3. Human intervention and professional judgement - ATT's do not detect fraud with a click of a mouse but rather highlight anomalies. The auditor can then focus on those high risk anomalies, you look at documentation, people, and procedures. Only then can fraud truly be determined, and it needs human intervention to execute, assess, and examine.