0:00:08.033,0:00:17.033
This is perhaps the most important lesson in the
course because it really gets at the heart of how
audits are tailored for different circumstances.
0:00:17.033,0:00:20.033
Today we are going to tackle audit risk.
0:00:20.033,0:00:24.033
Audit risk is quite simply the risk that the
auditor gets it wrong.
0:00:24.033,0:00:28.066
But what does a wrong opinion really mean?
0:00:28.066,0:00:37.000
Well, first of all, we need to recognize that an
audit provides reasonable assurance, not
absolute assurance or a guarantee.
0:00:37.000,0:00:46.033
Secondly, the opinion states that the financial
statements are free of material misstatements,
not all misstatements- just material ones.
0:00:46.033,0:00:54.066
With this understanding in mind, it is entirely
possible that auditor gets their opinion wrong
when there is in fact one or more...
0:00:54.066,0:00:59.000
material misstatements contained within the
financial statements that were not detected
during the course of the audit.
0:00:59.000,0:01:04.033
Users commonly misinterpret what an audit
opinion represents.
0:01:04.033,0:01:11.066
As a result, when a company fails, it’s common
for the auditors to get dragged into the ensuing
litigation...
0:01:11.066,0:01:17.000
as stakeholders scramble to recover as much of
their investment as possible from anyone
remotely...
0:01:17.000,0:01:19.066
involved with the information they relied upon.
0:01:19.066,0:01:23.000
Audits are fraught with uncertainty, which gives
rise to risk.
0:01:23.000,0:01:28.000
How auditors deal with risk is of utmost
importance.
0:01:28.000,0:01:35.033
As we have mentioned in previous lessons, audit
work is directed on the areas that pose the
greatest risk.
0:01:35.033,0:01:42.033
The audit risk model is generally accepted as
the conceptual model for assessing risk,
evaluating it,
0:01:42.033,0:01:46.066
and ultimately reducing it through the gathering
of audit evidence.
0:01:46.066,0:01:50.066
The audit risk model is represented by the
equation...
0:01:50.066,0:01:56.066
Audit risk equals inherent risk times control risk
times planned detection risk [AR=IR x CR x
PDR].
0:01:56.066,0:02:00.000
Let’s spend a few minutes discussing the
components of the model.
0:02:00.000,0:02:04.033
Then we’ll play with some scenarios so that you
can see the model in action.
0:02:04.033,0:02:08.033
Audit risk can be thought of in terms of an
acceptable tolerance for screwing up.
0:02:08.033,0:02:15.066
As we have discussed in previous lessons, it is
not practical to totally eliminate audit risk.
0:02:15.066,0:02:21.066
To do so would require the auditor to look at
every single shred of evidence possible.
0:02:21.066,0:02:29.033
The audit would never get done on a timely
basis, and the cost would be prohibitive for the
company.
0:02:29.033,0:02:33.033
Obviously, auditors don’t want to get opinions
wrong all that often.
0:02:33.033,0:02:40.066
So the public accounting firms strive to minimize
this risk to the extent possible trading off
cost/benefit considerations.
0:02:40.066,0:02:47.000
For many firms, the quantified tolerance of audit
risk is 5% or lower.
0:02:47.000,0:02:54.066
Audit assurance is the complement of audit
risk, that is, one minus audit risk.
0:02:54.066,0:02:58.066
It’s another way of describing the other side of
the same coin.
0:02:58.066,0:03:03.066
So if our audit risk is 5%, our audit assurance is
95%.
0:03:03.066,0:03:10.066
Thus, the auditor can say they are 95%
confident that they’ve issued the right audit
opinion.
0:03:10.066,0:03:17.033
Generally speaking, the more risky the
engagement, the lower the level of audit risk the
auditors will be willing to take on.
0:03:17.033,0:03:19.000
Why?
0:03:19.000,0:03:27.033
Well, simply because a risky engagement, for
example one where the company has a high
likelihood of failure,
0:03:27.033,0:03:30.033
exposes the auditor to greater threats of
litigation.
0:03:30.033,0:03:34.033
The key areas to consider in assessing
engagement risk are:
0:03:34.033,0:03:43.000
The degree to which external users will rely on
the financial statements, the greater the
reliance, the greater the engagement risk.
0:03:43.000,0:03:50.033
The likelihood of financial difficulties for the
client, the weaker the client’s financial strength,
the greater the engagement risk.
0:03:50.033,0:03:54.066
Management’s integrity.
The less integrity, the
higher the engagement risk.
0:03:54.066,0:04:03.033
So in a highly risky engagement, the auditors
may try to minimize audit risk to 1 or 2%
instead of the 5% we just spoke of,
0:04:03.033,0:04:07.033
at least conceptually that's how they ensure
they cover their ass.
0:04:07.033,0:04:15.033
I say conceptually, because while I will throw
percentages around, which seem very precise,
auditing is not that precise in reality.
0:04:15.033,0:04:21.033
Normally auditors will talk about risks in terms
of low, medium or high.
0:04:21.033,0:04:23.066
Auditing is laced with professional judgement.
0:04:23.066,0:04:30.000
And by the end of this lesson you’ll understand
better what I mean, but for now,
0:04:30.000,0:04:32.000
let’s just pretend that the audit risk model is a
true mathematical equation.
0:04:32.000,0:04:38.000
Let’s move to the other side of the equal sign
and define the other elements of the model.
0:04:38.000,0:04:40.066
First we have inherent risk.
0:04:40.066,0:04:48.033
Inherent risk is the likelihood that a material
misstatement might occur in the first place
assuming no internal controls exist.
0:04:48.033,0:04:50.000
Next, we have control risk.
0:04:50.000,0:04:57.066
Control risk is the likelihood that the client’s
system of internal controls will not prevent or
detect a material misstatement.
0:04:57.066,0:05:02.000
Finally, we have planned detection risk, or
simply detection risk.
0:05:02.000,0:05:08.033
Detection risk is the risk that our audit
procedures will fail to detect a material
misstatement.
0:05:08.033,0:05:15.066
Let’s look at the audit risk model in terms of a
picture.
0:05:15.066,0:05:21.066
Inherent risk is represented by all the little drops
of rain you see marked as errors falling from the
sky.
0:05:21.066,0:05:24.066
The harder it rains, the more likely we are to get
wet.
0:05:24.066,0:05:27.033
Inherent risk is rain.
0:05:27.033,0:05:33.000
In some businesses, like say a rental property,
inherent risk is minimal because the business is
dirt simple.
0:05:33.000,0:05:36.066
However, in other businesses, say an insurance
business,
0:05:36.066,0:05:41.033
it’s a monsoon because of the complexities and
judgment implicit in the business model.
0:05:41.033,0:05:43.000
That stuff is inherent risk.
0:05:43.000,0:05:51.000
Think of the strength of the client’s internal
controls as an umbrella, designed to shield the
financial statements from the rain.
0:05:51.000,0:05:54.033
If the umbrella has holes, then the rain gets
through.
0:05:54.033,0:05:59.066
At which point, it all comes down to the choice
of raincoat that the auditors put on to keep dry.
0:05:59.066,0:06:06.066
If the auditors feel that there is a risk of a
torrential rain and the umbrella is of little
protection,
0:06:06.066,0:06:12.000
the they may choose a survival suit, which in
audit terms means they will take all precautions
necessary to stay dry.
0:06:12.000,0:06:19.000
On the other hand, if the rain is more a of mist,
and the umbrella is more like one of those giant
golf umbrella’s,
0:06:19.000,0:06:25.000
then the auditors can probably get away with a
simple wind breaker and still be adequately
covered.
0:06:25.000,0:06:32.000
Now, let’s work through the mechanics of how
the model works using a more literal description
of each of the four components.
0:06:32.000,0:06:37.033
To begin with, audit risk is set during the client
acceptance or continuance stage.
0:06:37.033,0:06:44.033
For our purposes, let’s assume that we want to
minimize our audit risk to 5% and that this is a
normal risk engagement.
0:06:44.033,0:06:47.033
Now as we move to the right hand side of the
equation,
0:06:47.033,0:06:53.033
there are certain elements that we assess, and
there are others that we have more direct control
over.
0:06:53.033,0:06:58.033
Inherent risk is one of those elements we
assess through our conversations with
management,
0:06:58.033,0:07:01.033
and our knowledge of the business.
0:07:01.033,0:07:08.000
Think of a high risk assessment as a high
percentage, say 100% chance that a material
misstatement could occur.
0:07:08.000,0:07:12.000
A low risk assessment might be say, 50% or
said another way,
0:07:12.000,0:07:19.000
a 50% chance that a material misstatement
might occur.
0:07:19.000,0:07:22.066
We plug this percentage into the model and
move onto the next element.
0:07:22.066,0:07:29.066
Control risk is also an element we assess
based on our understanding of the client’s
internal control,
0:07:29.066,0:07:33.033
as well as our evaluation of design and operating
effectiveness.
0:07:33.033,0:07:40.000
So, a client with weak internal controls may not
be able to prevent or detect a material
misstatement from happening,
0:07:40.000,0:07:48.033
in which case, we may assess control risk at
maximum, or in numeric terms 100%.
0:07:48.033,0:07:58.000
In other circumstances, we might determine that
internal controls can be relied on to prevent or
detect a material misstatement,
0:07:58.000,0:08:04.000
in which case we could assess control risk at
less than 100%, say 50% for argument sake.
0:08:04.000,0:08:08.000
Note that any time we say that control risk is
less than 100%,
0:08:08.000,0:08:13.066
we are going to have to gather evidence to
support that assessment by testing controls.
0:08:13.066,0:08:17.000
Thus, we can plug this percentage into the audit
risk model.
0:08:17.000,0:08:21.066
We can now solve for our planned detection risk.
0:08:21.066,0:08:27.033
In the case where we have a high inherent risk
and high control risk, both values at 100%,
0:08:27.033,0:08:32.000
you can see that detection risk would have to be
reduced to 5% to minimize our...
0:08:32.000,0:08:40.066
overall audit risk to our desired 5% target and
make this equation work.
0:08:40.066,0:08:44.033
In the case where we assessed inherent risk
and control risk as low,
0:08:44.033,0:08:48.033
in other words, both values at 50%,
0:08:48.033,0:08:55.033
you can do the algebra to determine that
detection risk would have to be 20% in order to
now make the equation work.
0:08:55.033,0:09:02.000
Detection risk represents the amount of
substantive audit work we perform.
0:09:02.000,0:09:08.000
Said another way, we gather audit evidence to
support the management assertions to reduce
this risk.
0:09:08.000,0:09:13.066
The more evidence we gather, the lower the risk
that we miss anything.
0:09:13.066,0:09:22.000
So the way you can interpret our two cases is
that in the situation where we had assessed
Inherent and control risk as high,
0:09:22.000,0:09:27.033
we will need to gather a lot more evidence than
in the case where we assessed these same
risks as low.
0:09:27.033,0:09:37.000
In fact, at least anecdotally, you could
conceptually think of it as four times more
evidence.
0:09:37.000,0:09:40.033
However, audits don’t work in a neat linear
fashion in that way.
0:09:40.033,0:09:43.066
This audit risk model can be applied on a global
basis,
0:09:43.066,0:09:49.000
that is for the whole of the client’s company to
define the global audit strategy.
0:09:49.000,0:09:57.000
However, it is much more practical to apply the
audit risk model on an account by account,
assertion by assertion basis.
0:09:57.000,0:10:00.000
And yes, that’s a lot of assessments you need
to make,
0:10:00.000,0:10:06.000
but most audit planning programs will walk you
through consider points to help you make this
determination expeditiously.
0:10:06.000,0:10:09.066
And one last point before we close off this
lesson.
0:10:09.066,0:10:19.000
Let’s say that during the course of the audit new
information becomes known that contradicts our
assessments of inherent risk and control risk.
0:10:19.000,0:10:25.066
If this happens, the auditor must return to the
audit risk model and recalculate detection risk
accordingly.
0:10:25.066,0:10:37.066
This will manifest itself by requiring additional
procedures, or larger samples as necessary, to
achieve the desired level of audit risk.
0:10:37.066,0:10:43.066
So the audit risk model is not just something
that is considered once during the audit.
0:10:43.066,0:10:47.033
The audit risk model is updated throughout the
course of the audit.
0:10:47.033,0:10:49.066
So that’s all for this lesson, until next time,
0:10:49.066,0:10:51.066
don’t stop until you get to the top and when you
get to the top, don’t stop.