The Relationship Between Audit Assertions and Risk Assessment

Photo by Sasun Bughdaryan on Unsplash

Not all accounts in financial statements carry the same level of risk. Cash, inventory, and receivables have different characteristics, requiring auditors to adjust their testing methods accordingly.

Here it is audit assertions and risk assessment are closely related to audit strategy. Consider the following discussion to understand how auditors determine risk and select appropriate and effective audit procedures.

Understanding the Basic Concepts of Audit Assertions and Audit Risk Models

Before determining audit procedures, auditors need to understand the claims inherent in the financial information. These claims are known as management assertions.

Assertions form the basis for determining test objectives. The auditor then considers the risks that the information may contain material misstatements.

Audit Assertions Are: Definition and Main Classification

Audit assertions are representations or statements made by management in the financial statements. Auditors use these assertions as a basis when designing tests.

Some of the key assertions relevant to an audit include:

• Existence or occurrence (existence or occurrence): ensure that assets, liabilities, transactions, or events actually exist or occur.
• Equipment (completeness): ensure that information that should be recorded is not missed.
• Rights and obligations (rights and obligations): ensure the entity has the right to an asset or obligation to a liability.
• Accuracy, assessment, and allocation (accuracy, valuation and allocation): ensure that the amounts and related information are recorded accurately.
• Presentation and disclosure (presentation and disclosure): ensure information is classified and disclosed appropriately.

A single account can relate to multiple assertions. This requires auditors to determine the risks and appropriate procedures for each assertion.

Introduction to the Main Components in Audit Risk Model

Audit Risk Model helps auditors understand the relationship between audit risk and the risk components assessed during the audit.

Three commonly used risk components are:

• Inherent Risk (IR): the risk of material misstatement before considering related controls.
• Control Risk (CR): the risk of controls failing to prevent or detect material misstatements on a timely basis.
• Detection Risk (DR): the risk that the auditor's procedures will fail to detect existing material misstatements.

These three components help the auditor determine the audit response. The higher the assessed risk, the more appropriately the audit procedures need to be directed to that area.

Evaluation of Inherent Risk and Control Risk at the Assertion Level

Audit assertions and risk assessments need to be analyzed not only at the financial statement level. Auditors also consider risks at the assertion level to understand potential sources of misstatement that could affect the accuracy of financial information.

This approach helps determine the nature, timing, and extent of audit procedures required.

Inherent Risk Assessment based on Account Characteristics

Inherent risk may differ from one account to another. The characteristics of the transaction, the complexity of the estimate, and the level of uncertainty may affect its assessment.

For example, accounts involving significant estimates may require greater attention than routine transactions with simple characteristics.

Auditors may consider the following factors:

• Transaction complexity.
• The level of subjectivity of the estimate.
• Changes in business conditions.
• Unusual transaction potential.
• The size of the balance or transaction volume.
• The vulnerability of assets to loss or misuse.

This assessment helps the auditor determine which assertions have a higher probability of misstatement.

Control Risk Analysis of Internal Office Effectiveness

Control risk relates to the possibility that internal controls may fail to prevent or detect material misstatements on a timely basis.

Auditors need to understand the design and implementation of controls relevant to a particular assertion. If necessary, the operational effectiveness of the controls can also be tested.

Some aspects that can be considered include:

• Separation of duties between employees.
• Transaction authorization.
• Periodic reconciliation.
• Restricting access to assets and systems.
• Documentation and review of transactions.
• Monitoring of deviations.

Control weaknesses can affect risk assessments. The auditor can then adjust substantive procedures to obtain sufficient appropriate evidence.

Application of Risk Assessment to the Assertion of the Existence of Cash Accounts

Cash provides a convenient example for practically demonstrating the relationship between audit assertions and risk assessment. Its liquid nature gives this account its own risk characteristics, requiring special attention from the auditor.

Auditors don't just examine recorded amounts. They also examine the existence of cash balances and the entity's rights to those balances.

High Inherent Risk in Cash Existence Assertion (Theft Vulnerability)

Cash is relatively easy to move and use, making it vulnerable to loss or misuse.

These conditions may increase the auditor's attention to the existence assertion. Some potential risks include:

• Unauthorized cash withdrawal.
• Incorrect transaction recording.
• The difference between records and physical cash.
• Inadequate bank reconciliation.
• Cash transactions without supporting documents.

These risks do not automatically indicate fraud. Auditors still need to obtain sufficient and appropriate evidence to assess the true nature of the situation.

Adjusting the Strictness of Audit Procedures Based on Risk Assessment Results

The simultaneous application of audit assertions and risk assessments influences how auditors design audit procedures. Higher risks may require stronger and more targeted audit responses to ensure the reliability of financial information.

In the assertion of cash existence, the auditor may consider the following procedures:

1. Physical cash check: match cash existence with available records.
2. Bank confirmation: obtain external evidence regarding account balances or information.
3. Reconciliation check: trace the differences between company records and bank statements.
4. Transaction testing: examine supporting evidence and record certain transactions.
5. Procedure cut-off: assess whether transactions are recorded in the correct period.

The choice of procedures depends on the entity's circumstances and the results of the risk assessment. The auditor continues to use professional judgment in determining the combination of tests.

Strategies for Designing Effective and Efficient Audit Procedures

Unsplash

Audit procedure should not be created the same for every account and assertion. Audit assertions and risk assessments must be linked to each other to determine appropriate audit responses and allocate audit resources optimally.

A risk-based approach helps the audit team focus resources on areas with a greater potential for material misstatement.

Some principles that can be used when designing procedures are:

• Associate each procedure with the assertion you want to test.
• Match the nature of the procedure to the risk characteristics.
• Consider the quality and relevance of audit evidence.
• Determine the time of the examination based on the conditions and risks.
• Expand testing when assessment results indicate a need.
• Document the basis for the considerations and test results.

Efficiency doesn't mean indiscriminately reducing testing. The goal is to obtain sufficient and appropriate evidence through relevant procedures.

Digital platforms can also help manage working paper, documentation, findings, and follow-up in a more structured manner.

Conclusion

Audit assertions and risk assessments are closely related in determining the direction of the audit. Inherent risk and control risk help auditors allocate time and resources to areas that require the most attention.

Audithink helps audit teams manage working papers, documentation, findings, and follow-up in one platform. Schedule an Audithink demo to see how it applies to your organization.

FAQ