Auditing, Risk and Assertions in Financial Statements

• Auditors provide independent assurance that financial statements are free from material misstatement.
• They enhance the reliability of financial reports for investors and creditors.

Business Risk

• Business risk is an entity's risk of failing to meet its objectives.
• Today’s information is more complex and in demand.
• This information is needed in a timely manner, and has far-reaching consequences.

Information Risk

• Information poses a risk; it is the probability that information circulated by a company will be false or misleading.
• Users demand independent third-party assessments to reduce risk.

Risk Assessment

• Risk assessment involves evaluating the risk of material misstatement in financial statements.
• It includes considering management assertions and evaluating evidence to ensure fair presentation.

Management's Financial Statement Assertions

• Existence or occurrence verifies that assets, liabilities, and transactions actually exist.
• Completeness confirms all balances and transactions are recorded in the financial statements.
• Valuation or allocation ensures transactions are recorded at the correct amount per GAAP
• Rights and obligations means the entity has a legal claim on assets and is responsible for liabilities.
• Presentation and disclosure ensures that the information is appropriately disclosed in statements and footnotes.

Auditing Definitions

• Financial Statement Auditing is systematically obtaining and evaluating evidence of assertions about economic actions/events.
• Attestation Engagements are when a practitioner accesses and reports on subject matter made by another party.
• Assurance Services are independent professional services improving information quality for decision-makers.

Professional Skepticism

• Professional skepticism is an auditor's questioning mindset toward management representations and gathered evidence.
• Inquiry alone is insufficient and requires corroborative evidence.
• Unusual financial trends should be investigated.
• It is import to verify document authenticity.
• This helps to recognize potential conflicts of interest between management and auditors.

Independence

• Independence in Fact means the auditor maintains an unbiased mental attitude.
• Independence in Appearance means avoiding situations that could lead outsiders to perceive a lack of objectivity.

Responsibilities Principle

• Competence and Capabilities means auditors must have relevant experience and expertise.
• Auditors must maintain both independence in fact and appearance.
• Due Care means auditors must perform with the same level of diligence and skill as a reasonable auditor in similar circumstances.
• Professional Skepticism and Judgment means having a questioning mindset and critical assessment of evidence.
• Judgment means applying training, knowledge, and experience to make informed audit decisions.

Audit Evidence

• Sufficiency refers to the quantity of evidence gathered.
• Appropriateness relates to the quality of evidence, including:
  • Relevance that addresses the assertion of interest.
  • Reliability where the auditor can trust the source of evidence.
  • Higher reliability involving direct knowledge and external documents.
  • Lower reliability involving internal documents or verbal confirmations.

Performance Principle

• Auditors must ensure audits are properly planned and executed to provide reasonable assurance.
• Risk Assessment means understanding the entity, its environment, and internal controls.
• Audit Evidence means evaluating sufficiency and appropriateness.

Reporting Principle

• Auditors express an opinion or indicate inability to express an opinion.
• Auditors assess financial statements against a recognized reporting framework (e.g. GAAP, IFRS)

Audit Procedures

• Physical Observation involves visually inspecting tangible assets.
• Confirmation involves obtaining evidence from a third party.
• Expectation is used in analytical procedures to develop expectations based on trends and data.
• Scanning is a high-level review to identify unusual patterns or anomalies.
• Recalculation checks the accuracy of financial data by performing independent mathematical calculations.

Acceptance and Continuance

• Evaluate acceptance or continuing with an existing client.
• Communicate with predecessor auditors with client approval.
• Discuss management integrity, disagreements, fraud risks, and the reason for auditor change.
• Auditors must be independent in fact and appearance.
• Violations can result in regulatory action or litigation.
• An engagement letter outlines responsibilities, scope, and limitations.

To Support the Audit Opinion

• Sufficient and appropriate evidence is gathered for the audit opinion.
• Procedures assess the risk of material misstatement.
• Control and substantive tests mitigate risks.
• The nature, timing, and extent of audit procedures must be documented.

Not Accepting a New Partner

• Independence issues arise because a new partner has client conflicts of interest.
• Lack of Competence because a partner does not have the expertise for complex engagements.
• Ethical concerns, or prior disciplinary actions, or questionable professional conduct.
• Avoid high-risk clients or industries.

Engagement Letter

• Engagement letter outlines the objectives; what the auditor is hired to do.
• It also include management responsibilities and access to records.
• Auditors ensure compliance with GAAS, and that sufficient evidence and opinions are obtained
• Limitations are that the engagement does not guarantee fraud detection.
• There is a reporting framework that specifies the financial statement evaluation standard such as GAAP, IFRS, or another framework.

Vouching vs Tracing

• Vouching tests occurrence/existence; starts from financial records and traces back to source docs.
• Tracing tests completeness; starts from source documents and traces forward to financial records.

Brainstorming

• Audit team brainstorming discussions is a required procedure.
• The Objectives is gaining understanding of previous experiences with the client.
• To recognize procedures with the client that might detect fraud.

Three Types of Risks

• Inherent Risk (IR) happens in the absence of internal controls, material errors or fraud could occur.
• Control Risk (CR) is when internal controls fail to prevent or detect a material misstatement.
• Detection Risk (DR) is when an auditor's substantive procedures fail to detect a material misstatement.
• Inherent Risk is affected by business, types of transactions, and the effectiveness and integrity of managers

What to Do With High Inherent Risk:

• Conduct extensive audit procedures.
• Increase professional skepticism.
• Pay attention to high-risk accounts and perform more substantive testing.
• Adjust the audit plan to reduce detection risk.

Formulas

• RMM=IR * CR
• AR= IR * CR * DR is where AR = Audit Risk. Example:
• If IR and CR are high, auditors must keep DR low to maintain overall audit risk.
• Audit Risk (AR) is the risk of expressing an inappropriate opinion on materially misstated financial statements.
• Inherent Risk (IR) concerns the susceptibility of an assertion to misstatement without considering internal controls.
• Control Risk (CR) is the risk that companies cannot control a material misstatement.
• Detection Risk (DR): audit procedures fail to detect a material misstatement.

Auditor Opinions

• Unqualified Opinion states no material weaknesses were found.
• Disclaimer of Opinion is when the audit team cannot perform all necessary procedures.
• An Adverse Opinion occurs if there are one or more material weaknesses.

Internal Controls

• Two Separate Reports can indicate fairness of financial statements and effectiveness of internal control.
• A Combined Report includes one opinion on the financial statements and one on internal control effectiveness.

Internal Control Evaluations

• Phase 1: Involves understanding the client's internal control system and documenting understanding.
• Phase 2: Involves assessing control risk and identifying internal control activities and cost/effectiveness.
• Phase 3: Involves testing the identified controls, with approaches like exception or audit sampling.

Separation of Duties

• Authorization involves approving transactions.
• Recording involves maintaining transaction records.
• Separated duties can reduce fraud risk and prevent errors.

Audit Committees

• Subcommittees of the board of directors should have 3-6 members.
• All members must be financially literate and at least one member must be a financial expert.

Auditors ensure financial statements are accurate. Business risk is the risk of failing to meet objectives. Information risk is the chance of false or misleading company information, reduced with third-party assessments.