0:00:08.033,0:00:15.033
In this lesson, I’m going to explain what exactly
is the client risk profile and how is it used.
0:00:15.033,0:00:22.033
GAAS requires that we gain an understanding of
the client’s business and document this
understanding in our audit file.
0:00:22.033,0:00:28.033
The better we understand our client’s business,
the better we are able to assess the client
business risk.
0:00:28.033,0:00:36.066
Client business risk is simply that it will fail to
achieve its objectives, possibly even leading to a
going concern issue.
0:00:36.066,0:00:42.066
Client business risk can arise from both internal
and external sources.
0:00:42.066,0:00:49.000
Our primary concern is to determine the extent
to which the risk of material misstatement in
can arise due to client business risk.
0:00:49.000,0:00:54.066
So to understand how client business risk and
the risk of material misstatement are connected,
0:00:54.066,0:00:59.000
let’s go through the sorts of things that get
documented.
0:00:59.000,0:01:05.066
Before we get started though, I find it interesting
to note the many high profile business failures
that have arisen in recent years,
0:01:05.066,0:01:10.066
and question whether the auditors got this
assessment right.
0:01:10.066,0:01:16.000
Of course I’m talking about all the usual
suspects like Enron, Worldcom, and Nortel.
0:01:16.000,0:01:22.033
But we have more recent examples of Sino
Forest and SNC Lavalin- two Canadian giants.
0:01:22.033,0:01:27.000
Sino Forest for apparently overstating their
timberland in China.
0:01:27.000,0:01:33.000
And SNC Lavalin for making $56 million in bribes
to foreign agents to land major projects.
0:01:33.000,0:01:41.066
In Sino Forest’s situation, the auditors, E&Y,
have resigned, but it almost feels like an
afterthought.
0:01:41.066,0:01:46.000
Like the horse has already left the barn by the
time the auditors have taken this action.
0:01:46.000,0:01:55.000
My point is that getting this client risk profile
assessment correct is not only important to do,
but I think it’s extremely challenging for auditors.
0:01:55.000,0:01:59.000
I also think auditors are not well trained in
performing this assessment.
0:01:59.000,0:02:10.066
Checklists work well for mindless yes or no type
disclosures, but work less effectively for making
judgmental assessments such as the risk profile
0:02:10.066,0:02:16.066
Just imagine for a moment putting yourself in
that situation with one of those clients.
0:02:16.066,0:02:23.066
It would take some serious amount of courage
to walk into the partners office and suggest that
client business risk is high because you-
0:02:23.066,0:02:29.066
the lowly little junior auditor – think the company
may not be a going concern,
0:02:29.066,0:02:33.066
or perhaps even more judgmentally you question
management integrity.
0:02:33.066,0:02:37.000
This is truly one of the greatest challenges of
the profession.
0:02:37.000,0:02:45.066
Imagine walking into the SNC Lavalin Audit
Committee meeting and telling the directors that
SNC represents a high client business risk.
0:02:45.066,0:02:52.033
Then imagine telling the directors that your audit
firm will have to perform more work to enable an
opinion to be rendered,
0:02:52.033,0:02:59.000
which of course means extra fees.
And if the
committee disagrees, the firm is contemplating
resignation from the engagement.
0:02:59.000,0:03:07.000
How many auditors would have the courage to
do that for a client with a prestigous client such
as SNC Lavalin.
0:03:07.000,0:03:12.033
Keep this context in mind as we go through the
sorts of things the auditor examines to enable
them to make this assessment.
0:03:12.033,0:03:17.033
So, let’s start putting our arms around what we
need to know about the client’s business and
industry.
0:03:17.033,0:03:21.033
First, the industry and the external environment
0:03:21.033,0:03:27.000
You can be the most efficient operator in the
industry and do everything right, yet still go out
of business.
0:03:27.000,0:03:34.033
In certain industries, participants have no pricing
power or are subject to rapid obsolescence due
to new technologies.
0:03:34.033,0:03:39.066
Some industries even have their own accounting
practices, which have become generally
accepted,
0:03:39.066,0:03:43.033
for example the utility, real estate, oil and gas
industries among others.
0:03:43.033,0:03:48.033
Thus, it is imperative for the auditors to
understand the industry almost as well as their
clients do.
0:03:48.033,0:03:54.033
The client will provide a lot of this information,
but there is also often plenty of information
available
0:03:54.033,0:03:58.066
from industry associations, analysts, and
industry specialists.
0:03:58.066,0:04:03.033
Next we need to consider business operations
and processes.
0:04:03.033,0:04:05.066
No two businesses are set up alike.
0:04:05.066,0:04:11.066
For instance, business structure has a huge
impact on the day-to-day activities and the
organizational culture.
0:04:11.066,0:04:15.066
Highly decentralized businesses empower the
individuals
0:04:15.066,0:04:18.066
and may have less formal processes.
0:04:18.066,0:04:24.000
Whereas a highly centralized structure would
have a more bureaucratic, formal structure.
0:04:24.000,0:04:28.033
Consider the sort of IT systems the client has
implemented.
0:04:28.033,0:04:32.000
Is it an advanced integrated Enterprise Resource
System like SAP,
0:04:32.000,0:04:38.000
or is it a mishmash of different systems strung
together with electronic and manual interfaces?
0:04:38.000,0:04:45.033
Often, the auditor will do a plant tour to get a
feel for the operations and meet the people
outside of the finance department.
0:04:45.033,0:04:49.066
You can learn a lot by seeing the equipment and
the inventory for yourself
0:04:49.066,0:04:55.033
and this will later help you visualize the dollars
they see flowing through the statements.
0:04:55.033,0:04:59.066
Keep in mind that the financial statements tell a
story of what has gone on in the business.
0:04:59.066,0:05:07.000
What you see happening in the plant or during
conversations with operating personnel, should
be reflected in the numbers you are auditing.
0:05:07.000,0:05:11.000
Next, we have a need to document our
evaluation of management.
0:05:11.000,0:05:18.000
This is where things get really tricky because
we are not only looking for appropriate approvals
of major transactions,
0:05:18.000,0:05:21.066
like issuances of debt or major business
acquisitions,
0:05:21.066,0:05:25.033
but we are also looking to assess the overall
tone at the top of the organization.
0:05:25.033,0:05:29.000
The auditors will spend time reading the minutes
of Board meetings,
0:05:29.000,0:05:32.033
looking for indications of significant matters
discussed
0:05:32.033,0:05:36.033
and determine what impact these might have on
the risk of material misstatement.
0:05:36.033,0:05:43.066
The auditor will spend time looking at the ethical
code of conduct, any violations in the code, and
the actions taken by the company.
0:05:43.066,0:05:47.066
The auditor will identify and read major
contracts.
0:05:47.066,0:05:53.033
The auditor will identify related parties so that
later they can ensure that all transactions with
related parties have been identified...
0:05:53.033,0:05:55.000
and disclosed.
0:05:55.000,0:06:01.066
More importantly, they need to consider the
business risk associated with transacting with
related parties.
0:06:01.066,0:06:04.033
There could be conflicts of interest to consider.
0:06:04.033,0:06:11.000
There could be economic dependence on key
suppliers or customers that may not even be a
related party in legal form,
0:06:11.000,0:06:13.033
but in substance- absolutely.
0:06:13.033,0:06:19.033
The tricky part of assessing management and
governance in my mind is that you are
evaluating a group of...
0:06:19.033,0:06:24.066
very senior people with often decades of
individual experience.
0:06:24.066,0:06:29.000
There is clearly in imbalance in power between
what you know and they know.
0:06:29.000,0:06:35.000
Having documented the effectiveness of
management, we next look at the client’s
objectives and strategies.
0:06:35.000,0:06:39.000
Objectives can be broken down into different
categories.
0:06:39.000,0:06:43.066
Strategic objectives are those that plan for the
growth and development of the business.
0:06:43.066,0:06:50.000
Financial reporting objectives are those
concerned with accurate and timely internal and
external reporting.
0:06:50.000,0:06:56.066
Operational objectives are those designed to
improve the efficient and economic productivity
of the business.
0:06:56.066,0:07:02.000
Compliance objectives ensure the business
stays onside with all legal and regulatory
requirements.
0:07:02.000,0:07:09.000
Obviously, the auditors are primarily concerned
with the client’s achievement of the financial
reporting objectives,
0:07:09.000,0:07:12.033
but the different categories do not exist in
isolation.
0:07:12.033,0:07:20.000
If a client fails to meet its strategic objectives,
you could easily find a company facing a going
concern issue.
0:07:20.000,0:07:21.000
Do you care about that?
0:07:21.000,0:07:23.066
You are damn right you do!
0:07:23.066,0:07:27.000
If a client is failing to achieve operational
objectives, say there are issues with product
quality.
0:07:27.000,0:07:29.066
Do you care?
0:07:29.066,0:07:30.066
Sure you do!
0:07:30.066,0:07:38.000
There could be return allowances to consider,
product liability lawsuits, and inventory valuation
assertion issue to consider.
0:07:38.000,0:07:42.066
If a client is failing to meeting a legal or
regulatory standard, same question?
0:07:42.066,0:07:47.000
Well there is absolutely financial reporting
implications to consider!
0:07:47.000,0:07:55.033
Everything from fines, to environmental clean
ups, to contingent liabilities, to loss of an ability
to operate.
0:07:55.033,0:07:59.033
If someone has the power to shut you down,
then that’s a going concern issue as well.
0:07:59.033,0:08:07.066
So getting a handle on the client’s objectives,
and broadly across the four categories, is
important.
0:08:07.066,0:08:11.066
And finally, we need to consider performance
and measurement.
0:08:11.066,0:08:18.033
Certain companies place a tremendous amount
of pressure on management and employees to
perform and achieve desired results.
0:08:18.033,0:08:25.000
This pressure to perform can create
management bias to report more favorable
results than are actually achieved.
0:08:25.000,0:08:27.033
It may not be individually motivated.
0:08:27.033,0:08:33.066
For instance, a company that has certain debt
covenants that it is required to maintain to
sustain financing obviously...
0:08:33.066,0:08:39.066
has a vested interest in ensuring that the
covenants are maintained at all costs.
0:08:39.066,0:08:42.066
So these are other items that we need to be
aware of.
0:08:42.066,0:08:46.033
So as you can see from this discussion of the
client risk profile,
0:08:46.033,0:08:53.066
there are pervasive factors at play that can
override everything else that is going on in the
day-to-day business.
0:08:53.066,0:08:58.066
This overall assessment gives the auditor a
“theme” to work with throughout the audit.
0:08:58.066,0:09:02.066
If the analysis suggest more caution is
necessary than normal,
0:09:02.066,0:09:06.066
then it should be incorporated into the audit plan
and audit execution.
0:09:06.066,0:09:11.000
Auditing is made of hundreds, if not thousands
of hours of mundane testing,
0:09:11.000,0:09:21.066
but it’s the assessments we have discussed in
this lesson that truly get at the major risks of an
engagement, which is why we do this first.
0:09:21.066,0:09:27.033
If you get this assessment wrong, then the
thousands of hours you spend testing, may be
irrelevant.
0:09:27.033,0:09:28.000
That is all for now, until next time.
0:09:28.000,0:09:31.066
Don’t stop until you get to the top and when you
get to the top, don’t stop.