Risk Assessment and Internal Control — Practice

Question 1

Explain the audit risk model, defining each component, and state which single component the auditor can directly control and why.

Accepted Answer

Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated, and it is a function of the risk of material misstatement multiplied by detection risk. Risk of material misstatement exists independently of the audit, being a function of the entity and its environment rather than of anything the auditor does, and it consists of two sub-components: inherent risk, the susceptibility of an assertion to a material misstatement before consideration of any related controls, reflecting that some balances and transactions are inherently more prone to error or manipulation than others regardless of how good the entity's controls are; and control risk, the risk that a misstatement will not be prevented, or detected and corrected on a timely basis, by the entity's internal control. Detection risk is the risk that the auditor's own procedures will fail to detect a misstatement that exists and could be material. Detection risk is the only component the auditor can directly control, because inherent risk and control risk are properties of the entity itself, fixed by its business, environment and control systems regardless of what the auditor subsequently does, whereas detection risk is a direct function of the nature, timing and extent of the audit procedures the auditor chooses to perform: more extensive, more reliable, more carefully targeted procedures reduce detection risk, while less extensive or less well-targeted procedures leave it higher. The auditor's entire strategy for managing audit risk to an acceptably low level therefore consists of assessing the risk of material misstatement, which cannot itself be changed, and then calibrating detection risk, through the design of procedures, to compensate appropriately.

Question 2

An auditor assesses the risk of material misstatement for a client's revenue recognition as high, given recent changes in the client's business model. Explain what this means for the detection risk the auditor should target, and describe two specific ways this would change the auditor's procedures compared to an area assessed as low risk.

Accepted Answer

Where the risk of material misstatement for revenue recognition is assessed as high, the auditor must set detection risk at a correspondingly lower level in order to keep overall audit risk at an acceptably low level, since audit risk is the product of the two, and a high risk of material misstatement combined with a high, unchanged detection risk would leave overall audit risk unacceptably elevated. In practical terms, targeting lower detection risk means the auditor must obtain more persuasive audit evidence than would be needed for a low-risk area. Two specific ways this changes procedures: first, the extent of testing is likely to increase, meaning larger sample sizes or a greater proportion of the population tested for revenue transactions, since a larger sample provides more persuasive evidence and reduces the chance that a genuine misstatement is missed purely by not being included in the sample. Second, the timing of procedures is likely to shift towards, or closer to, the year end rather than being performed at an interim date well before the balance sheet date, since evidence obtained closer to the period end is more reliable for that period's actual balances and reduces the risk that conditions changed materially between an earlier interim test date and the actual year end in a way that would not be caught by relying on the earlier interim work alone. Both changes reflect the same underlying principle: a higher assessed risk requires the auditor to compensate by making the audit procedures themselves more powerful and more closely targeted at the period actually being reported on.

Question 3

List the areas SA 315 requires the auditor to understand about the entity and its environment, and explain why this understanding must be built before, rather than alongside or after, designing specific audit procedures.

Accepted Answer

SA 315 requires the auditor to obtain an understanding of the entity's organisational structure, ownership and governance and its business model; industry, regulatory and other external factors including the applicable financial reporting framework; the entity's selection and application of accounting policies; the entity's objectives, strategies and related business risks that may result in a risk of material misstatement; the measurement and review of the entity's financial performance; and the entity's internal control. This understanding must be built before designing specific audit procedures because the whole purpose of understanding the entity is to enable the auditor to identify and assess the risks of material misstatement in the first place, and audit procedures are meant to be responsive to those assessed risks; designing procedures before understanding the entity would mean designing a response to risks that have not yet actually been identified, which inverts the logical sequence the whole risk-based audit approach depends on. An auditor who skipped straight to a generic, undifferentiated set of procedures without first understanding this specific entity's business model, industry pressures and accounting policy choices would have no principled basis for deciding where to concentrate audit effort, and would risk applying the same generic level of testing to a genuinely high-risk area and a genuinely low-risk area alike, defeating the purpose of risk-based auditing, which exists precisely to direct scarce audit resources towards the areas where material misstatement is more likely, and that direction is only possible once the entity-level understanding required by SA 315 has actually been obtained.

Question 4

State the factors an auditor considers in determining whether an identified risk is a significant risk, and apply them to a scenario: a manufacturing client enters into a one-off, highly complex derivative transaction with an offshore related party near year end.

Accepted Answer

Factors the auditor considers in determining whether an identified risk is significant include whether the risk is a risk of fraud, whether the risk is related to significant recent economic, accounting or other developments and therefore requires specific attention, the complexity of transactions, whether the risk involves significant transactions with related parties, the degree of subjectivity in the measurement of financial information related to the risk, particularly measurements involving a wide range of measurement uncertainty, and whether the risk involves significant transactions that are outside the normal course of business for the entity, or that otherwise appear to be unusual. Applying these factors to the scenario, the transaction is highly likely to be assessed as a significant risk, since it satisfies several of the named factors simultaneously: it is a derivative transaction, which by nature typically involves a high degree of subjectivity and measurement uncertainty in its valuation; it involves a related party, specifically flagged as a factor increasing significance because related party transactions may not be conducted on arm's length terms and can be used to manipulate reported results; it is described as highly complex, satisfying the complexity factor directly; it occurs near year end, which is often associated with an increased risk of transactions structured or timed to achieve a particular reported outcome; and it is described as one-off, meaning it is outside the normal course of business for a manufacturing client, satisfying the unusual-transaction factor as well. The combination of multiple significant-risk indicators in a single transaction should prompt the auditor to give this specific matter special audit consideration, including procedures specifically designed to address the elevated risk it presents, rather than treating it as an ordinary transaction subject only to standard testing.

Question 5

State the five components of internal control under the COSO framework, and explain why the control environment is described as the foundation for the other four rather than merely one component among five equals.

Accepted Answer

The five components are the control environment, the entity's own risk assessment process, the information system relevant to financial reporting and communication, control activities, and monitoring of controls. The control environment comprises the set of standards, processes and structures that provide the basis for carrying out internal control across the organisation, including the entity's ethical values, management's commitment to competence, participation by those charged with governance, and the assignment of authority and responsibility. It is described as the foundation for the other four components, rather than merely one component among five equals, because the effectiveness of every other component depends substantially on the tone and culture the control environment establishes: control activities, however well designed on paper, such as a segregation-of-duties policy or an authorisation matrix, will only be genuinely effective if the organisational culture actually supports adherence to them rather than tolerating or implicitly encouraging their circumvention; the entity's own risk assessment process depends on management genuinely valuing the identification of risk rather than treating it as a box-ticking exercise; the information system and communication component depends on a culture that values accurate, timely reporting rather than one that pressures staff towards favourable figures; and monitoring depends on genuine commitment to acting on findings rather than a culture that discourages raising concerns. A weak control environment, characterised for instance by management indifference to ethical values or a willingness to override controls when convenient, tends to undermine even well-designed specific control activities, which is why an auditor assesses the control environment first and treats it as informing the assessment of every other component rather than evaluating all five as independent, unrelated checklist items.

Question 6

Explain the concept of segregation of duties, naming the three functions it typically separates, and illustrate with an example how its absence could allow both a fraud and its concealment by the same person.

Accepted Answer

Segregation of duties is a control activity that separates the functions of authorisation, custody of assets, and record-keeping among different individuals, so that no single person is able both to perpetrate an error or fraud and to conceal it through control of the related records or assets. The underlying logic is that most frauds and errors require both an action, such as making an unauthorised payment or removing an asset, and a subsequent step to prevent that action from being detected, typically by controlling or falsifying the records that would otherwise reveal it; if these two capabilities are held by different people, neither can act alone without the other's involvement or without the discrepancy being exposed by the person holding the other function. An example illustrating the risk of its absence: suppose a single employee is responsible both for approving supplier payments, that is authorisation, and for maintaining the accounts payable ledger, that is record-keeping, with no separate custody function relevant here since the payment itself is the asset movement. That employee could approve a payment to a fictitious supplier they control, and then adjust the accounts payable records to disguise the payment as a legitimate expense to a genuine supplier, concealing the fraud because the same person controls both the act, authorising the payment, and the record that would otherwise reveal an unusual or unauthorised transaction. Had authorisation and record-keeping been held by different people, the record-keeper, having no role in approving the payment, would have no obvious reason or opportunity to disguise it, and any discrepancy between an unauthorised payment and the properly maintained records would be more likely to surface, since concealment would require collusion between the two individuals rather than the unilateral action of one.

Question 7

State the inherent limitations of internal control, and explain why these limitations mean an auditor can never rely on controls alone, however strong the entity's control system appears to be.

Accepted Answer

Internal control, however well designed, can provide only reasonable, not absolute, assurance that an entity's objectives will be achieved, because of several inherent limitations. First, the possibility of human error or mistakes, whether through simple carelessness, a lapse in judgement, or a misunderstanding of instructions, means even a conscientious individual operating a well-designed control can occasionally fail to apply it correctly. Second, the possibility of controls being circumvented through collusion between two or more people, which defeats the very purpose of segregation of duties, since that control specifically assumes the separated individuals will not act together, an assumption collusion breaches directly; and the possibility of management override of controls, where those with sufficient authority simply choose to bypass an otherwise effective control, which is a particularly significant limitation because senior management is often the very party whose actions the control system is meant to constrain in the interest of shareholders and other stakeholders. Third, the fact that controls are generally designed to respond to routine, recurring transactions, and may be less effective, or entirely absent, for unusual, non-routine, or one-off transactions that fall outside the pattern the control was designed around. These limitations mean an auditor can never rely on controls alone, however strong the entity's control system appears on paper or in testing, because no amount of testing that controls are well designed and operating effectively as observed can rule out the possibility of an isolated human error, an act of collusion, a management override, or an unusual transaction slipping through a control never designed to catch it; this is precisely why substantive procedures are always required for every material class of transaction, balance and disclosure regardless of how favourably control risk has been assessed, since control reliance can reduce but never eliminate the need for direct substantive evidence.

Question 8

Distinguish tests of controls from substantive procedures, and explain why an auditor might choose to perform tests of controls even though substantive procedures will be performed regardless.

Accepted Answer

Tests of controls are audit procedures designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level; they test whether a control that the entity has designed is actually operating as intended in practice. Substantive procedures, comprising tests of details and substantive analytical procedures, are audit procedures designed to detect material misstatements directly at the assertion level, examining the actual transactions, balances and disclosures themselves rather than the controls surrounding them, and they are always performed for each material class of transactions, balance and disclosure regardless of the assessed level of control risk, since control risk assessment alone can never reduce the risk of material misstatement to zero. Given that substantive procedures will always be performed in some measure regardless, an auditor might nonetheless choose to also perform tests of controls where the auditor's overall audit approach includes an expectation that controls are operating effectively, allowing the auditor to reduce the extent of substantive procedures that would otherwise be needed, or where substantive procedures alone would not provide sufficient appropriate audit evidence at the assertion level, which can occur particularly in highly automated, high-volume transaction environments where individual transactions leave little or no visible manual audit trail outside the system's own controls, making direct substantive testing of individual transactions impractical or insufficient without also relying on and testing the controls embedded in the system that processes them. In such environments, testing the relevant automated controls, such as system-enforced authorisation limits or automated three-way matching of purchase orders, receipts and invoices, may be not merely efficient but genuinely necessary to obtain sufficient appropriate evidence at all.

Question 9

List the risk assessment procedures SA 315 identifies for obtaining an understanding of the entity, and explain why relying on only one of these procedures, such as inquiry alone, would typically be insufficient.

Accepted Answer

SA 315 identifies risk assessment procedures including inquiries of management and of others within the entity who, in the auditor's judgement, may have information likely to assist in identifying risks of material misstatement due to fraud or error; analytical procedures, involving evaluations of financial information through analysis of plausible relationships among both financial and non-financial data; observation and inspection, supporting inquiries of management and others and providing information about the entity and its environment through direct observation of activities and inspection of documents, records and internal control manuals; and, where the entity has an internal audit function, inquiries of appropriate individuals within it. Relying on inquiry alone would typically be insufficient because inquiry, while a valuable and necessary source of information, particularly for understanding management's own views, intentions and explanations, is inherently limited by the fact that it depends on the knowledge, candour and objectivity of the person being asked; management or staff may not be fully aware of relevant risks themselves, may unintentionally provide incomplete or inaccurate information, or in some cases may deliberately withhold or misrepresent information, particularly where fraud is a concern. Analytical procedures and observation and inspection provide independent corroboration or contradiction of what has been learned through inquiry, drawing on evidence, such as actual financial trends or the auditor's own direct observation of how a process is genuinely carried out, that does not depend solely on what the entity's own personnel choose to say; a properly performed risk assessment accordingly combines several of these procedures together rather than relying on any single one in isolation, precisely to guard against the specific limitations each individual procedure carries on its own.

Question 10

A client's cash handling process has no segregation of duties between the person collecting cash receipts and the person recording them in the ledger, a weakness the auditor has identified in prior years but which management has never remediated. Explain how this affects the auditor's assessment of control risk, the resulting detection risk the auditor should target, and the specific change in the nature of procedures this would drive for the cash balance.

Accepted Answer

This weakness directly increases the auditor's assessment of control risk specifically for the cash-related assertions, since the absence of segregation between cash collection and record-keeping is exactly the kind of control deficiency that increases the risk that a misstatement, whether an innocent error or a deliberate misappropriation of cash concealed through the records, would not be prevented, or detected and corrected on a timely basis, by the entity's own internal control; and the fact that this specific weakness has persisted across multiple years without remediation, despite having been previously identified, further reinforces a high control risk assessment for this area, since it suggests management either does not prioritise or has not been able to address a known, significant deficiency. With control risk assessed as high for cash, and inherent risk for cash generally already recognised as elevated given cash's inherent susceptibility to misappropriation, the combined risk of material misstatement for cash is high, meaning detection risk must be set correspondingly low to keep overall audit risk for this balance at an acceptable level. This drives specific, identifiable changes in the nature of procedures for the cash balance: the auditor would place little or no reliance on the entity's own controls over cash, since testing controls that are known to be deficient would not support any reduction in substantive work; the auditor would instead plan more extensive substantive procedures, likely including a higher level of direct verification such as cash counts performed by the auditor personally, more extensive testing of bank reconciliations, and confirmation of bank balances directly with the bank rather than relying on client-prepared summaries; and the timing of these procedures would likely be set closer to, or at, the year-end date itself rather than at an earlier interim date, since a known, persistent control weakness of this kind increases the risk that conditions or figures could change materially between an interim test and the actual balance sheet date without being caught by controls the entity has already demonstrated it is not effectively operating.

Question 11

Distinguish a risk assessed at the financial statement level from one assessed at the assertion level, giving one example of each, and explain why a financial statement level risk cannot simply be addressed by testing one specific balance more thoroughly.

Accepted Answer

A risk assessed at the financial statement level is a pervasive risk that relates to the financial statements as a whole and potentially affects many assertions, rather than being confined to one specific class of transactions or balance; an example is a weak or compromised control environment, such as evidence that senior management has a demonstrated willingness to override controls when it suits them, which is not confined to any single account but casts doubt on the reliability of financial reporting generally across the entity. A risk assessed at the assertion level relates to a specific class of transactions, account balance, or disclosure, and to specific assertions within it, such as the risk that inventory is overvalued because of a specific, identified issue with the client's costing methodology, which is confined to inventory valuation and does not necessarily suggest anything is wrong elsewhere in the financial statements. A financial statement level risk cannot simply be addressed by testing one specific balance more thoroughly because its pervasive character means it potentially affects the reliability of evidence and management representations across the entire audit, not merely within one account; the auditor's response to a financial statement level risk typically involves overall responses affecting the general conduct of the audit, such as assigning more experienced staff, incorporating additional unpredictability into the choice of procedures across multiple areas, increasing the overall degree of professional scepticism applied throughout the engagement, and being more cautious about relying on management representations generally, rather than a targeted increase in testing confined to a single balance, which would leave the pervasive underlying concern unaddressed everywhere else it might also be relevant.

Question 12

Explain what the entity's own risk assessment process, as one of the five COSO components, actually consists of, and how the auditor's evaluation of it differs from the auditor's own separate risk assessment under SA 315.

Accepted Answer

The entity's own risk assessment process, as one of the five COSO components of internal control, is the entity's own internal process for identifying and analysing risks relevant to the achievement of its financial reporting objectives, and for deciding how to manage those identified risks; it reflects management's own systematic effort to recognise, for instance, that a new product line introduces a new revenue recognition complexity, or that a new IT system introduces a new risk of data integrity errors, and to design a response to those self-identified risks. The auditor's own separate risk assessment under SA 315 is a distinct exercise, conducted independently by the auditor for the specific purpose of identifying and assessing risks of material misstatement in the financial statements the auditor is examining, and it is not simply a matter of accepting the entity's own risk assessment at face value. Rather, the entity's risk assessment process is itself one of the things the auditor evaluates as part of understanding internal control: the auditor considers whether the entity has established a process for identifying business risks relevant to financial reporting, estimating their significance, assessing the likelihood of their occurrence, and deciding on actions to manage them, and forms a judgement about whether that process is suitably designed and implemented for the entity's particular circumstances. If the entity's own process is well designed and properly operating, this may provide the auditor with useful information contributing to the auditor's own risk assessment, but the auditor's assessment remains independent and cannot simply defer to management's own conclusions about what risks matter and how significant they are, since management's perspective is not a substitute for the auditor's own independent professional judgement.

Question 13

An auditor notices, through preliminary analytical review, that a client's gross margin has increased significantly compared to the prior year with no obvious explanation from management inquiry. Explain how this observation feeds into risk assessment, and what it might specifically signal.

Accepted Answer

This observation is a direct application of analytical procedures as a risk assessment tool under SA 315, which requires evaluations of financial information through analysis of plausible relationships among financial and, where relevant, non-financial data, and an unexplained significant change in a key relationship such as gross margin is precisely the kind of unusual fluctuation these procedures are designed to surface. An unexplained, significant increase in gross margin compared to the prior year, without a clear, corroborated business reason such as a genuine change in pricing, product mix, or cost structure that management can substantiate, should raise the auditor's professional scepticism and prompt further inquiry, since it may signal several possible underlying issues warranting closer audit attention. It could indicate that revenue has been overstated, for instance through premature or fictitious revenue recognition, which would inflate the margin without a corresponding, genuine increase in underlying profitability. It could equally indicate that cost of goods sold has been understated, for instance through an error or manipulation in inventory valuation or in the cutoff of purchases and expenses around the year end. It could also, less concerningly, reflect a genuine business change that management has simply not yet fully explained to the auditor, and further inquiry may reveal an entirely legitimate cause. The auditor's response is not to assume the worst outcome automatically, but to treat the unexplained fluctuation as a risk indicator requiring specific further investigation, likely including more detailed inquiry, obtaining corroborating evidence for whatever explanation management ultimately offers, and considering whether this signals a need for more extensive substantive procedures specifically around revenue recognition and cost of goods sold cutoff for this client.

Question 14

Name three categories of control activity besides segregation of duties, and give one example of each in a purchasing process.

Accepted Answer

Beyond segregation of duties, control activities include authorisation, performance reviews, information processing controls, and physical controls, of which three are illustrated here. Authorisation controls require that transactions be approved by an appropriate level of management before they are executed; in a purchasing process, an example is a requirement that any purchase order above a specified rupee threshold must be approved by a departmental head or above, rather than any employee being able to commit the company to a purchase of any size unilaterally. Performance review controls involve comparisons of actual performance against budgets, forecasts, or prior period figures, with investigation of significant variances; in a purchasing process, an example is a monthly review comparing actual departmental purchasing spend against the budgeted figure, with any material variance requiring an explanation from the relevant manager before further spending is approved. Information processing controls, whether general controls over the IT environment or application controls specific to a system, help ensure the completeness, accuracy and validity of transactions; in a purchasing process, an example is a system-enforced three-way match, automatically comparing the purchase order, the goods receipt note, and the supplier invoice, and preventing payment from being processed unless all three agree, catching discrepancies such as being invoiced for goods never actually received or for a quantity or price differing from what was originally ordered.

Question 15

A client has recently migrated its purchasing and payables process to a highly automated ERP system with minimal manual intervention. Explain how this change should affect the auditor's risk assessment and choice between tests of controls and substantive procedures for this cycle.

Accepted Answer

A recent migration to a highly automated ERP system with minimal manual intervention has two distinct implications for risk assessment that pull in somewhat different directions and both need to be addressed. First, on inherent risk specific to the transition itself, a recent system migration is, in its first year particularly, a period of elevated risk: data conversion errors, configuration mistakes in how the new system is set up to process and authorise transactions, and staff unfamiliarity with the new system's controls and workflows are all genuine risks that would not exist, or would exist to a much lesser degree, in a stable, long-established system; this points towards treating the purchasing and payables cycle as an area of heightened risk for this specific year, warranting more extensive audit attention than might otherwise be applied to a routine, unchanged cycle. Second, on the choice between tests of controls and substantive procedures, a highly automated environment with minimal manual intervention often means that individual transactions leave little or no substantive manual audit trail outside of what the system itself records, and the volume of transactions processed automatically may be very large, making direct substantive testing of a meaningful sample of individual transactions both impractical and potentially insufficient on its own to provide adequate assurance; this points towards the auditor needing to test the relevant automated controls embedded in the system, such as the three-way matching control, system-enforced authorisation limits, and access controls restricting who can create or approve purchase transactions, in order to obtain sufficient appropriate evidence, since substantive procedures alone may not adequately address risks in an environment this automated. Combining both considerations, the auditor's overall response should include both an elevated level of scrutiny reflecting the transition-year risk, and specifically a combination of testing the newly implemented automated controls, including how the system was configured and whether that configuration is operating as intended, together with a targeted substantive procedures response addressing the specific data conversion and migration risk that testing of ongoing operating controls alone would not capture, since a control operating correctly today does not confirm that data carried over from the old system during the conversion itself was accurately and completely migrated in the first place.

Practice — Risk Assessment and Internal Control

Sign in to save attempts to your dashboard and track your accuracy over time

Find a verified tutor

Join a live course

Browse coaching centres

About

Categories

Support

Documentation

Get Study Tips & Updates

Download Our App

Download for iOS

Download for Android

Popular Cities