Risk assessment: A critical part of the audit process
Audit season is right around the corner for calendar-year entities. Here’s what your auditor is doing behind the scenes to prepare — and how you can help facilitate the audit planning process.
The big picture
Every audit starts with assessing “audit risk.” This refers to the likelihood that the auditor will issue an adverse opinion when the financial statements are actually in accordance with U.S. Generally Accepted Accounting Principles or (more likely) an unqualified opinion when the opinion should be either modified or adverse.
Auditors can’t test every single transaction, recalculate every estimate or examine every external document. Instead, they tailor their audit procedures and assign audit personnel to keep audit risk as low as possible.
Inherent risk vs. control risk
Auditors evaluate two types of risk:
1. Inherent risk. This is the risk that material departures could occur in the financial statements. Examples of inherent-risk factors include complexity, volume of transactions, competence of the accounting personnel, company size and use of estimates.
2. Control risk. This is the risk that the entity’s internal controls won’t prevent or correct material misstatements in the financial statements.
Separate risk assessments are done at the financial statement level and then for each major account — such as cash, receivables, inventory, fixed assets, other assets, payables, accrued expenses, long-term debt, equity, and revenue and expenses. A high-risk account (say, inventory) might warrant more extensive audit procedures and be assigned to more experienced audit team members than one with lower risk (say, equity).
How auditors assess risk
New risk assessments must be done each year, even if the company has had the same auditor for many years. That’s because internal and external factors may change over time. For example, new government or accounting regulations may be implemented, and company personnel or accounting software may change, causing the company’s risk assessment to change. As a result, audit procedures may vary from year to year or from one audit firm to the next.
The risk assessment process starts with an auditing checklist and, for existing audit clients, last year’s workpapers. But auditors must dig deeper to determine current risk levels. In addition to researching public sources of information, including your company’s website, your auditor may call you with a list of open-ended questions (inquiries) and request a walk-through to evaluate whether your internal controls are operating as designed. Timely responses can help auditors plan their procedures to minimize audit risk.
Your role
Audit fieldwork is only as effective as the risk assessment. Evidence obtained from further audit procedures may be ineffective if it’s not properly linked to the assessed risks. So, it’s important for you to help the audit team understand the risks your business is currently facing and the challenges you’ve experienced reporting financial performance, especially as companies implement updated accounting rules in the coming years.
© 2019