Understanding the Entity and Its Environment Including Its

Internal Control and Assessing the Risk of Material

Misstatement:

RISK
RESPONSE
Overall Responses

To reduce audit risk to an acceptable low level, auditor should:

1) Determine overall responses to assessed risks at the financial statement
level; and
2) Perform audit procedures to respond to assessed risks at the assertion
level.

Matters for the professional judgement of the auditor:

 Overall responses; and
 Nature, timing and extent of the audit procedures
Overall responses that may be considered:
• Emphasizing to the audit team the need to maintain professional
skepticism in gathering and evaluating audit evidence
• Assigning more experienced staff or those with special skills or
using experts
• Providing more supervision, or incorporating additional elements
of unpredictability in the selection of audit procedures to be
performed
• Meet general changes to the nature, timing, or extent of audit
procedures as an overall response
Responses at Assertion Level

 when Preliminary Control Risk is HIGH (maximum level):

- Audit approach relies primarily on substantive tests (no-
reliance approach).

 when Preliminary Control Risk is LESS THAN HIGH:

- tests of controls (with-reliance approach) are to be performed
when expected to be operating effectively during assessment of
risks
Nature of Tests of Control

Generally consist of one (or a combination) of four types of

evidence-gathering techniques:

1. Inquiry of client personnel

2. Observation of the application of policies and procedures
3. Inspection
4. Reperformance or recalculation
Inquiry of client personnel
- professional skepticism should be applied
- wherever possible, corroborate the resulting explanation

Observation and Inspection

- tests based on observation, inquiry and examination often provide sufficient
evidence about the operating effectiveness of a control

Reperformance/Recalculation
- when a control is believed to be so significant, reperformance of its
application is appropriate
Selected sample of population of all transactions when
examining documentation:
1. Control Deviations
Exceptions / Deviations / Occurrences - appropriate terms for differences
between what was expected and what has actually occurred when performing tests of
control.
2. Timing of Tests of Controls
a. Depends on auditor’s objectives
b. Determines the period of reliance on controls
3. Extent of Tests of Controls
 As the rate of expectation form a control increases, the auditor increases the
extent of testing the control.
 However, if the rate of expected deviation is too high, tests of controls for a
particular assertion may not be effective.
Reassessment of Control Risk

• If the risk of material misstatement is higher than originally

expected, auditor should:

1. re-assess level of control risk; and

2. reconsider the assurance needed from substantive tests.
Inverse relationship between assessment of control risk and
the extent of substantive testing

“assessed level of control risks” DECREASES = less effective tests

@ interim date with smaller sample size

“assessed level of control risks” INCREASES = more effective tests

@ year end with larger sample size
Effects of Reassessment of Control Risk on the Audit
Approach
Ways of affect of reassessment (after test of controls):

 Risk @ less than high or below maximum level – with-reliance

audit approach continues to be used in designing substantive
procedures

 Risk @ high level – no-reliance audit approach will be used in

designing substantive procedures
Documentation Requirements for the Assessment of
Control Risk
 Relies mainly on the control risk assessment

 If the assessment is at:

High or Maximum level - the understanding of internal
controls in the control risk assessment must be documented
Less than High or Below Maximum level - basis for the control
risk assessment must also be documented together with
the aforementioned items
Understanding the Entity and Its Environment Including Its
Internal Control and Assessing the Risk of Material
Misstatement:

RISK
RESPONSE