An Introduction to

Risk Based Auditing

ST UA RT H A RT LEY FCA
FOCUSROI I NC
SHARTLEY@FOCUSROI.COM

Copyright FocusROI 2014

 The Audit Objective (ISA/CAS 200)

 To obtain reasonable assurance about whether the

financial statements as a whole are free from
material misstatement, whether due to fraud or error,

thereby enabling
 the auditor to express an opinion on whether the
financial statements are prepared, in all material
respects, in accordance with an applicable financial
reporting framework;
The Audit Process - in 3 steps
Risk assessment – What can go wrong?
◦ Perform risk assessment procedures to identify and assess the risks
of material misstatement in the financial statements.

Risk Response – Did it go wrong?

◦ Perform further procedures to respond to the assessed risks
and determine if material misstatements have occurred.

Reporting. – Opinion
◦ What is the appropriate wording of the audit opinion
based on the work performed?
Basic Audit Requirements ISA/CAS 200

1. Comply with relevant ethical requirements,

2. Plan and perform an audit with professional skepticism

3. Exercise professional judgment in planning and performing an

audit

4. Obtain sufficient appropriate audit evidence to reduce audit risk

to an acceptably low level

5. Comply with all CASs relevant to the audit

 Risk Assessment
What are the RMM in the F/S ?

1. Perform 4-6. Perform RAPs: 7. Conclude:

preliminary Pervasive Assessed risks
activities Risks Controls at F/S level

Entity-Specific
Risks Controls

Transactional Assessed risks at

Risks Controls assertion level

Risk Response
An audit Did material misstatements occur?

in 14 8. Design appropriate
audit responses:
9. Finalize audit plans

Steps Assessed risks

at F/S level

Assessed risks at Further audit Communicate audit plan to

assertion level procedures
management/TCWG

Reporting
Evaluating/communicating ?ndings, and forming an opinion

12. Communicate 13. Complete the audit file 14. Form an opinion
(findings, misstatements and (file and F/S reviews, final An Rev, (appropriately word
significant control deficiencies) subsequent events and approvals) and date auditor’s report)
Scope of Risk/Control Assessment
Entity Objective:
Financial Statements
that are not materially
misstated

(entity level)
Inherent Risks

Pervasive
Pervasive

Governance

Controls
Leadership/management
Transactional

Transactional
Information Systems

Revenue Purchasing Payroll Other

Processes Processes Processes Processes

Transactions
Pervasive vs Transactional

Transactional
Risks/Controls

Risk Management
Competence
Tone at Top

Governance

Information
Pervasive
Risks/Controls

The foundation
Scope of Risk/Control Assessment –
Consider using the 3 risk/control Categories

Entity
Pervasive Transactional
Specific

C-PEM Form C-PEM Form C-PEM Form

520/522 530 540 - 560
 Identifying and Assessing Risk
Action Step Scope

1. Understand Entity and project Requirements

Document
Entity Specific
2. Identify Financial Reporting Risks

Results
Pervasive
Transactional
Entity Specific
3. Assess Control Design Pervasive
Inquire what controls address each risk Transactional
Entity Specific
4. Assess Control Implementation Pervasive
Do the identified controls actually exist Transactional

5. Test Control
Assess RMMEffectiveness Entity Specific
Identify the key controls to test and Pervasive
material/significant control deficiencies Transactional

Copyright FocusROI 2013 9

Categories of Pervasive Transactions
Risk and Control

Entity
Specific

Pervasive Transactional
risks/controls (account balance)
risks/controls
Use of Professional
Judgment to assess RMM

Assertion
Risk Assessments F/S Level
Level
 Assessed Risks...
At Financial At
Statement Level Assertion Level

Design/implement appropriate responses to risks

Overall Further Audit

Risk Responses Procedures
Response Address:
- Professionalskepticism Substantive Tests of
- Level of staff assigned procedures control
- Extent of staff supervision
- Accounting policies used
- Unpredictableprocedures Tests of Substantive
- More further procedures detail analytical

Result

Sufficient appropriate audit evidence

to reduce audit risk
to an acceptably low level
 Reporting

12. Communicate 13. Complete the audit file 14. Form an opinion
(findings, misstatements and (file and F/S reviews, final An Rev, (appropriately word
significant control deficiencies) subsequent events and approvals) and date auditor’s report)
CPEM 2014
A practical approach to auditing

 The Canadian Professional

Engagement Manual
◦ Published by CPA Canada
◦ http://www.castore.ca/product/canadian-professional-engagement-manual-
members/5
 FocusROI Services

 In house and web based Training

 Quality Control Monitoring
 Small group Coaching
www.focusroi.com

416 594 0005

info@focusroi.com
Please contact us
for further
information
info@focusROI.com
416 594 0005