Risk Assessment and Internal Control
Domain 3 examines how risk of material misstatement (inherent risk combined with control risk) is assessed and how that assessment drives the auditor's responses.
Understanding the entity
SA 315 (Revised) requires understanding of the entity and its environment, the applicable financial reporting framework, and the system of internal control. Internal control has five components: control environment, risk assessment process, information system and communication, control activities, and monitoring. The auditor identifies risks at financial statement level and at assertion level, and flags significant risks requiring special attention, often involving judgement, complex transactions, related parties or fraud.
Response under SA 330
Responses can be overall, such as using more experienced staff or greater unpredictability, or specific, such as tests of controls and substantive procedures. Tests of controls are used only when the auditor intends to rely on operating effectiveness and are never sufficient alone for a significant risk. Whatever the assessed control risk, substantive procedures must be performed for each material class of transactions, balance and disclosure. Control risk cannot be set at minimum without testing.
Inherent limits of controls
Controls can be bypassed by collusion, management override or human error; segregation of duties may be impractical in a small entity, where the auditor relies more on substantive work.
Worked example
A trading company books revenue on dispatch, and the auditor notices the sales manager can also approve credit limits. Reasoning: this is a segregation-of-duties deficiency, so control risk should not be reduced; instead the auditor performs substantive cut-off tests around the year end and checks credit approvals for post-year-end returns.
Traps
- Assuming no exceptions in one sample proves controls operate effectively.
- Ignoring the presumed fraud risk in revenue recognition under SA 240.
- Documenting controls without evaluating their design and implementation.
- Treating internal control as the auditor's responsibility rather than management's.