Overview
Financial audit is a comprehensive check of the economic and financial condition of an organization, verification of the reliability of information in the financial statements of the organization, as well as analysis and assessment of the prospects for its development, which can be carried out both by specialists of the organization itself (internal audit) and by third-party audit companies ( independent audit) that are requested by management at their own will or at the request of the IRS and other authorities.
In modern market conditions, risk assessment is becoming an integral attribute of almost any activity. The audit did not become an exception. Audit risk is a chance that the auditing company or individual will present a final opinion that is actually incorrect because material misstatements in the financial records were not detected.
The auditor risk model is a methodology that auditors use to try and identify the audit strategy that they need to follow. If the auditor is issuing an unmodified opinion, it is crucial that there are no significant errors or other issues that were missed for one reason or another. The auditor should use their professional judgment to assess audit risk and develop audit procedures necessary to reduce that risk to an acceptably low level.
The auditor is required to study these risks in the course of work, assess them and document the results of the assessment. To be on the safe side, auditors include the maximum allowable amounts (or norms) of materiality and risk in the audit agreement. After the client has signed such a document, the auditor is no longer responsible for failure to detect an error within the established boundaries of the general audit risk, defined as the likelihood of forming an incorrect opinion and drawing an incorrect conclusion based on the results of the audit.
Components
The formula for determining the total amount of audit risk can be represented as a result of all types of risks multiplied together:
AR = NR * KR * RN,
where AR is the total amount of audit risk.
- The presence of inherent risk is due to both the characteristics of the audited business and conditions that cannot be verified using internal controls. This risk is inherent in the accounting system and manifests itself through the quality of accounting information. For instance, the more complex a transaction is or if the numbers are based more on judgment rather than clear facts, the higher the inherent risk. Controls within the organization are typically set to minimize inherent risk by limiting the chance of money and other assets being stolen and setting clear rules and policies on accounting processes in the company.
- Control risk refers to the chance that the systems of control placed by the management and other responsible individuals does not detect significant errors. If any type of transaction in the company carries a risk that it will lead to wrong accounting data, then there should be a system in place that manages such risks. If there is a bad inventory system, for instance, it might not take much effort to steal inventory. Other transactions might simply be more prone to error, so the company can try to automate them or add more control measurements, such as separation of duties.
- The risk of non-detection arises from the always existing probability of non-detection of significant errors missed by the internal control system during the audit process. The risk of non-detection, in turn, is subdivided into analytical risk arising from the risk of missing errors in analytical procedures and sampling risk. Simply put, this is a risk that the auditor fails to do their job properly.
The emphasis can also be shifted to calculating the value of the risk of non-detection and the corresponding amount of audit evidence required. This is a more efficient way. In this case, the audit risk model is changed around to calculate the non-detection risk.
For each risk component, the auditor makes a subjective evaluation that a misstatement will happen, and only the risk of non-detection depends entirely on the auditor. The auditor is obliged, on the basis of an assessment of the inherent risk and control risk, to determine the acceptable risk of non-detection in the auditor’s work and create an audit strategy and plan with a goal of its minimization.
Factors that affect audit risk
There are obviously numerous factors that can affect the level of audit risk. Just like the components of this model, these risks can be divided into those that arise within the accounting system of the business and those that are connected with the auditor or auditing entity.
Some of the most common ones are the volume of financial and economic activities, the degree of computerization of accounting processes, and the number of non-standard operations for the given company. Other factors worth considering are the reliability of the client’s internal control system, how often personnel in the management positions changes, and the personal characteristics of business owners and managers. The professional training of the audit specialists, the general approach to audit, and the regulatory and legal system changes can also play a role in the overall risk level.
