The Methods And Tactics Behind Risk And Control Self Assessment

Because the exercise generates crucial information on operational risks and internal controls, internal auditors and managers can use RCSA findings to judge the quality of control. A relevant assertion is a financial statement assertion that has a reasonable possibility of containing a misstatement or misstatements that would cause the financial statements to be materially misstated. The determination of whether an assertion is a relevant assertion is based on inherent risk, without regard to the effect of controls. When the auditor has performed a review of interim financial information in accordance with AS 4105, Reviews of Interim Financial Information, the auditor should evaluate whether information obtained during the review is relevant to identifying risks of material misstatement in the year-end audit. Evaluating the company’s selection and application of significant accounting principles. The auditor should evaluate whether the company’s selection and application of significant accounting principles, particularly those related to subjective measurements and complex transactions,3/ are indicative of bias that could lead to material misstatement of the financial statements.

• The auditor might determine the likely sources of potential misstatements by asking himself or herself “what could go wrong?” within a given significant account or disclosure.
• 8/ For purposes of this standard, the term “audit of financial statements” refers to the financial statement portion of the integrated audit and to the audit of financial statements only.
• A test of one transaction–often performed in walkthroughs–generally is not considered “sufficient appropriate audit evidence” to assess control risk at less than high.
• They don’t, however, tell us if the controls are consistently working.
• For example, if the audit involves more than one location, there could be multiple discussions with team members in differing locations.

We could, for example, test fewer additions to plant, property and equipment. And your opinion on that audit will be that the financial statements are not presented in accordance with GAAP (GAAP requires that the numbers on the financial statement are accurate and complete!). Now that we have covered the definition of inherent risk and control risk, it is time to bring them together to make a choice about where we are going to spend our precious audit time. These periodical assessments should then be reported alongside your overall RCSA results – all of which must be incorporated into your organisation’s quarterly operational risk reports. High level feedback should also be submitted to senior management and the board of directors. The control identification process must include an assessment to discover whether the existing controls are working as intended. All attributes for the controls need to be documented, and a self-rating system should help stakeholders to bring these attributes together and determine the overall quality of a control environment.

Extent Of Substantive Procedures

He is the author of The Little Book of Local Government Fraud Prevention and Preparation of Financial Statements & Compilation Engagements. He frequently speaks at continuing education events.

If you combine a low to moderate inherent risk with a high control risk, you can assess RMM at low to moderate. This low to moderate RMM comports with a basic audit approach. Continuing with our plant, property and equipment example from above, you can–with the low to moderate RMM–test fewer asset purchases. We have been told that “you can’t default to maximum risk.” While we can’t default to maximum (the old pre-risk-assessment standards term), we can–and in many audits should–assess control risk at high . At times, auditors errantly assess control risk at less than high. Because the assessment is not supported by a test of controls. It is therefore a function of the effectiveness of an audit procedure and of its application by the auditor.

Again, you’ll want to document your understanding of your client’s internal control, including the control environment. Then document the steps you took to understand it, any changes over the previous period, and all identified risks. Section 315 states, “obtaining audit evidence about the implementation of a manual control at a point in time does not provide audit evidence about the operating effectiveness of the control at other times during the period under audit.” Understanding a client’s internal control gives auditors insight into the testing needed to assess management’s assertions. Risk assessment procedures, such as walkthroughs, generally are not sufficient to support a low to moderate control risk assessment. A walkthrough allows us to see if appropriate controls are in place. They don’t, however, tell us if the controls are consistently working.

27When comparison of those expectations with relationships derived from recorded amounts yields unusual or unexpected results, the auditor should take into account those results in identifying the risks of material misstatement. For integrated audits, the evidence regarding the effectiveness of the controls obtained during the audit of internal control. Using Audit Evidence Obtained during an Interim Period. When the auditor obtains evidence about the operating effectiveness of controls as of or through an interim date, he or she should determine what additional evidence is necessary concerning the operation of the controls for the remaining period of reliance. The nature of the tests of controls that will provide appropriate evidence depends, to a large degree, on the nature of the control to be tested, including whether the operation of the control results in documentary evidence of its operation. Documentary evidence of the operation of some controls, such as management’s philosophy and operating style, might not exist. Procedures the auditor performs to test operating effectiveness include a mix of inquiry of appropriate personnel, observation of the company’s operations, inspection of relevant documentation, and re-performance of the control.

Whether the risk involves significant unusual transactions. If forecasts are important to the estimate, the length of the forecast period and degree of uncertainty regarding trends affecting the forecast. Changes from the prior period in account and disclosure characteristics. Whether the company has entered into any significant unusual transactions. Paragraphs .66.–67A of AU sec. 316, Consideration of Fraud in a Financial Statement Audit, and paragraphs .04 and .06 of AU sec. 411, The Meaning of Present Fairly in Conformity With Generally Accepted Accounting Principles.

Obtaining An Understanding Of The Company And Its Environment

The AICPA points out that an entity can minimize, but not get rid of, control risk by using controls. Organisations rarely have the necessary resources to implement CRSA and our experienced professionals can facilitate the exchange of leading practices and assist you to develop and implement cost-effective control and risk management systems. Provides a framework for businesses to review, assess and design control frameworks. The company’s processes and controls16Cfor using the work of specialists. Financial reporting standards and laws and regulations that are new to the company, including when and how the company will adopt such requirements. 16/ The auditor also may use a benchmarking strategy, when appropriate, for automated application controls in subsequent years’ audits.

For a step-by-step guide to help you apply it to your engagements, download our free Audit Risk Assessment Tool, listen to the latest podcast episode from the Small Firm Philosophies series on risk assessment, and check out other resources on the AICPA risk assessment resources page. An organization’s risk assessment is an iterative process and should be reviewed and updated when changes occur or new risks emerge.

Relationship Of Understanding Of Internal Control To Tests Of Controls

In the audit of financial statements, the auditor should perform substantive procedures, including tests of details, that are specifically responsive to the assessed fraud risks. If the auditor selects certain controls intended to address the assessed fraud risks for testing in accordance with paragraphs 16–17 of this standard, the auditor should perform tests of those controls.

Further, control activities relevant to the audit include those control activities that the auditor judges necessary to understand in order to assess the risks of material misstatements at the assertion level. The evidence provided by the auditor’s tests of the effectiveness of controls depends upon the mix of the nature, timing, and extent of the auditor’s procedures. Further, for an individual control, different combinations of the nature, timing, and extent of testing might provide sufficient evidence in relation to the degree of reliance in an audit of financial statements. Examples of such modifications include extending or repeating at the period end the procedures performed at the interim date. 3AS 2401, Consideration of Fraud in a Financial Statement Audit, discusses fraud, its characteristics, and the types of misstatements due to fraud that are relevant to the audit, i.e., misstatements arising from fraudulent financial reporting and misstatements arising from asset misappropriation. Also, AS 2410,Related Parties, requires the auditor to perform procedures to obtain an understanding of the company’s relationships and transactions with its related parties that might reasonably be expected to affect the risks of material misstatement of the financial statements. The auditor might determine the likely sources of potential misstatements by asking himself or herself “what could go wrong?” within a given significant account or disclosure.

Controls should be monitored and remediation plans should be put in place for findings. Our first article focused on the reasons to love internal controls. Our second article focused on the control environment, which is the first of five core components of The Committee of Sponsoring Organizations of the Treadway Commission framework that many organizations follow when developing and implementing internal controls that are right-sized to them. In this article, we’ll focus on the second of the five components. Some auditors believe that the only controls they need to consider are control activities, like performing bank reconciliations. Regarding the issue of a low inherent risk and a high control risk yielding a moderate risk of material misstatement, I think you are correct. I do see in Thomas Reuters guidance that they show the RMM at moderate when one is high and the other is low.

Testing Design Effectiveness

Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained, because auditors did not properly obtain an understanding of relevant controls. B2 Controls in a manual system might include procedures such as approvals and reviews of transactions, and reconciliations and follow-up of reconciling items. Measures the company uses to monitor its operations that highlight unexpected results or trends that prompt management to investigate their cause and take corrective action, including correction of misstatements.

A Risk Control Matrix shows how internal controls address each of your program’s risks. I started this post by saying we sometimes errantly assess control risk. By this, I mean we sometimes assess control risk at low to moderate without a sufficient test of controls.

Evaluate whether the identified risks relate pervasively to the financial statements as a whole and potentially affect many assertions. The auditor should test the operating effectiveness of a control selected for testing by determining whether the control is operating as designed and whether the person performing the control possesses the necessary authority and competence to perform the control effectively. Obtain more persuasive audit evidence from substantive procedures due to the identification of pervasive weaknesses in the company’s control environment. To meet the objective in the preceding paragraph, the auditor must design and implement audit responses that address the risks of material misstatement that are identified and assessed in accordance with Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement.

Testing Controls In An Audit Of Financial Statements

For example, the auditor may perform walkthroughs in connection with understanding the flow of transactions in the information system relevant to financial reporting, evaluating the design of controls relevant to the audit, and determining whether those controls have been implemented. In performing a walkthrough, the auditor follows a transaction from origination through the company’s processes, including information systems, until it is reflected in the company’s financial records, using the same documents and IT that company personnel use. Walkthrough procedures usually include a combination of inquiry, observation, inspection of relevant documentation, and re-performance of controls.

Monitoring Of Controls

And, in all audits, we must gain an understanding of the entity’s controls. That understanding provides the basis for the control risk assessment. My post should have been clearer about the gaining of the understanding prior to assessing risk. By identifying and proactively addressing risks and opportunities, the institution protects and creates value for its shareholders, employees and customers. Detection risk is a fancy term for “auditor response.” It is the only part of the risk assessment process over which the auditor has control. The inherent risk and the control risk are in the auditee’s hands, and once the auditor knows what the client is up to, the auditor has to decide how to respond to what the client is doing. Bearing that in mind, the benefits of RCS assessments are relatively self-evident.

Industry, Regulatory, And Other External Factors

However, internal control, no matter how well designed and operated, can only reduce, but not eliminate, risks of material misstatement in the financial statements, because of the inherent limitations of internal control. These include, for example, the possibility of human errors or mistakes, or of controls being circumvented by collusion or inappropriate management override. GAAS provide the conditions under which the auditor is required to, or may choose to, test the operating effectiveness of controls in determining the nature, timing, and extent of substantive procedures to be performed. Evidence about the Effectiveness of Controls in the Audit of Financial Statements. In designing and performing tests of controls for the audit of financial statements, the evidence necessary to support the auditor’s control risk assessment depends on the degree of reliance the auditor plans to place on the effectiveness of a control.

Peer Review results indicate that some auditors believe they can default control risk assessments to “maximum” without any consideration of their client’s controls. Many will be shocked to learn that the answer is “no.” I enjoy your posts and insight into our standards. However, I have to take exception to a couple of items in your recent “Assessing Audit Control Risk at High . In the article you do mention that we cannot default to maximum as many auditors felt they could do. You state we “can assess control risk at any level we desire”, I don’t believe that is the case.