Audit, Internal Control and Risk Management
Core concepts
Audit provides independent assurance that financial statements are free from material misstatement. Candidates must understand the audit risk model (inherent, control, and detection risk), materiality, audit evidence, and the auditor's opinion types: unmodified, qualified, adverse, and disclaimer. Internal control rests on the COSO-style components: control environment, risk assessment, control activities, information and communication, and monitoring. Risk management involves identifying, assessing, and treating risks through avoidance, reduction, transfer, or acceptance.
Common traps
A frequent trap is confusing the responsibilities of management (prepare statements and maintain controls) with those of the auditor (express an opinion). Another is thinking more audit testing eliminates inherent risk; it only reduces detection risk. Watch the distinction between internal audit (part of the entity, reports to the board) and external audit (independent). Also, a qualified opinion is not the same as an adverse opinion: qualification is material but not pervasive; adverse is both material and pervasive.
Worked rule of thumb
Audit risk equals inherent risk times control risk times detection risk. If inherent risk is high (0.8) and control risk is moderate (0.5), and the auditor accepts overall risk of 0.05, detection risk must be 0.05 / (0.8 x 0.5) = 0.125, so more substantive testing is needed. Rule of thumb: when client risk rises, auditors must lower detection risk by doing more or better work.