Risk-Based Audit Approach: Key Concepts

• Henly S. Pahilagao, CPA, PHD created an overview of risk-based audit process, auditing and assurance principles

Engagement Overview

• Includes preengagement procedures, audit planning, internal control consideration, substantive procedures, and issue report

Risk-Based Audit Approach

• Begins with assessing the types of likelihood of misstatements in account balance
• Adjusts the amount and type of audit work, to the likelihood of material misstatements occurring in account balances

Auditor Tasks

• Identifying the client's strategy and the process for developing that strategy
• Examining the core business process and resource management
• Identifying for each of the key processes the objectives, inputs, activities, outputs, systems and transactions
• Assessing the risks that the processes will not meet the goals and controls related to those risks

Risk Defined

• Expresses uncertainty about events and/or their outcomes with a material effect on the organization

Four Critical Components of Risk

• Audit Risk is the risk that an auditor may give an unqualified opinion on financial statements that are materially misstated
• Engagement Risk is the economic risk that a CPA firm is exposed to simply because it is associated with a particular client including loss of reputation, inability of the client to pay the auditor, or financial loss because management is not honest and inhibits the audit process
• Financial Reporting Risk relates directly to the recording of transactions and the presentation of financial data in an organization's financial statements
• Business Risk affects the operations and potential outcomes of organizational activities

Risk-Based Audit Process: Phase I-Risk Assessment

• Performance of preliminary engagement activities to decide whether to accept/continue an audit engagement
• Planning the audit to develop an overall audit strategy and audit plan
• Performance of risk assessment procedures to identify/assess risk of material misstatement through understanding the entity

Risk-Based Audit Process: Phase II-Risk Response

• Design overall responses and further audit procedures to the assessed risk of material misstatement
• Implement responses to assessed risk of material misstatement to reduce audit risk to an acceptably low level

Risk-Based Audit Process: Phase III-Reporting

• Report the audit evidence obtained to determine what additional audit work (if any) is required
• Form an opinion based on audit findings and prepare the auditor's report

Conducting an Audit

• Includes pre-engagement based on Philippine Standards on Auditing (PSA) 210 and 220

Pre-engagement Procedures

• Evaluate compliance with ethical requirements based on (PSA 220)
• Evaluate continuance of relationship with existing clients based on (PSA 220)
• Establish the terms of the engagement based on (PSA 210)

Pre-engagement Arrangements

• Encompasses client selection and retention
• Also communication between predecessor and successor auditors
• Requires engagement letters
• The use of staff assignment
• Time budget is also required

Client Selection and Retention Considerations

• An auditor should maintain the necessary independence and ability to perform the engagement
• There are no issues with management integrity that may affect the auditor's willingness to continue the engagement
• There is no misunderstanding with the client as to the terms of the engagement

CPA Firm Assessment

• Must be competent to perform the engagement and has the capabilities including time and resources to do so
• Able to comply with the relevant ethical requirements
• Must consider the integrity of the client and does not have information that would lead to conclude that the client lacks integrity

Preconditions to Audit

• The financial reporting framework to be applied in the financial statements must be acceptable
• Both parties should agree that management acknowledges and understands its responsibility
  • To prepare financial statements in accordance with applicable financial reporting framework including where relevant to their fair presentation
  • To have internal control as management determines is necessary to enable the preparation of financial statements that are free from material misstatements whether due to fraud or error
  • The auditor should be provided with access to all information of which management is aware that is relevant to the preparation of financial statements such as records, documentation and other matters
  • Management must grant additional information that the auditor may request for the purpose of the audit
  • Give unrestricted access to persons within the entity from whom the auditor determines it necessary to obtain audit evidence

Terms of Audit Engagements

• Pertains to Philippine Standard on Auditing 210

Engagement Purpose

• Establishes standards and provide guidance on, agreeing the terms of the engagement with the client, and the auditor's response to a request by a client to change the terms of an engagement to one that provides a lower level of assurance

Engagement Terms

• The auditor and the client should agree on the terms of the engagement
• The agreed terms would need to be recorded in an audit engagement letter or other suitable form of contract

Contents of Engagement Letter/Contract

• The objective of the audit of financial statements
• Management's responsibility for the financial statements
• Management's responsibility for establishing and maintaining effective internal control
• The scope of the audit
• The form of any reports or other communication of results of the engagement
• There is unavoidable risk that even some material misstatement may remain undiscovered
• Unrestricted access to whatever records, documentation and other information requested in connection with the audit

Included Information

• Arrangements regarding the planning and performance of the audit
• Expectation of receiving from management written confirmation concerning representations made in connection with the audit
• Obtaining confirmation of the terms of the engagement by acknowledging receipt of the engagement letter
• A description of any other letters or reports the auditor expects to issue to the client
• The basis of fees and billings arrangements

Relevant Additions

• Arrangements concerning the involvement of other auditors and experts in some aspects of the audit
• Arrangements concerning the involvement of internal auditors and other client staff
• Arrangements to be made with the predecessor auditor, if any, in the case of an initial audit
• Can specify any restriction of the auditor's liability when such possibility exists
• A reference to any further agreements between the auditor and the client

Separate Letter to Components Reflects

• Factors that influence the decision
• Who appoints the auditor of the component
• Whether a separate auditor's report is to be issued on the component
• Includes legal requirements
• The extent of any work performed by other auditors

Recurring Audits

• Factors that may make it appropriate to send a new letter
• Any indication that the client misunderstands the objective and scope of the audit
• Changed or special terms of the engagement
• Recent changes of senior management or those charged with governance
• A significant change in ownership
• Significant change in nature or size of the client's business
• Legal or regulatory requirements

Changes in Engagement

• Consider the reasonableness of basis for requesting a change
• Be wary of any legal or contractual implications of the change
• Audit should not agree to a change of engagement where there is no reasonable justification for doing so

When Changes are Impermissible

• When change relates to information that is incorrect, incomplete or otherwise unsatisfactory, such as when the auditor cannot obtain sufficient appropriate audit evidence regarding receivables and the client asks for the engagement to be changed to a review engagement

When Changes can be Made

• Change in circumstances that affects the entity's requirements
• A misunderstanding concerning the nature of service originally requested

Reaching New Terms Agreement

• If the terms of the engagement are changed, the auditor and the client should agree on it
• The issued report would be that appropriate for the revised terms of engagement

Avoiding Confusion Post-Change in Engagement

• No reference should be made to the original engagement; or any procedures that may have been performed in the original engagement, except where the engagement is changed to an engagement to undertake agreed-upon procedures and thus reference to the procedures performed is a normal part of the report

Disagreement Post-Change Request

• If unable to come to an agreement the auditor should continue with original engagement
• In absence of continuation, the auditor should withdraw and consider whether there is any obligation, either contractual or otherwise, to report to other parties, such as those charged with governance or shareholders, the circumstances necessitating the withdrawal

Explore the risk-based audit approach, covering risk assessment, client strategy identification, and risk response. Identify potential conflicts of interest during the pre-engagement phase. Learn about audit risk and its relation to financial statement presentation.