Audit Risk

Definition of Audit Risk

Audit risk stands for the risk of an inappropriate opinion. When the financial statements are not reflecting a true and fair view, the auditor gives an unmodified, true and fair opinion.

Audit risk is a combination of three different kinds of risk:

• Inherent risk
• Control risk
• Detection risk

Inherent Risk

Inherent risk arises from the nature of the business, transactions, or elements of the financial statements. When these are complex, the accounting treatment becomes very difficult.

For example, when dealing with derivative instruments under IFRS 9 Financial Instruments, complex accounting treatments are required. These include cash flow hedges, fair value hedges, effective and ineffective portions of cash flow hedges, fair value through profit or loss, fair value through other comprehensive income, and amortised cost methods. There are also loss allowances for a twelve-month period, lifetime expected losses, credit risk, and other market factors. When a business deals with such transactions, the risk of expressing an inappropriate opinion is high because the accounting treatment is so complex that the auditor may not be sure whether to give a clean opinion or a modified opinion.

A transaction itself can also be complex. For instance, exporting goods to the United States results in dollars receivable, while importing goods from the United Kingdom results in pounds payable. If the customer in the United States is instructed to pay the supplier in the United Kingdom directly, foreign exchange fluctuation risks arise, complicating the accounting for foreign exchange gains and losses.

Certain elements of the financial statements may also carry complexity. For example, inventory could consist of fast-moving consumer goods where inventory levels fluctuate rapidly, or slow-moving items where loss allowances and provisions for losses must be determined.

Inherent means within itself. By the nature of the business, the transaction, or the accounting treatment, the area becomes inherently risky. For instance, auditing a diamond showroom carries much higher inherent risk than auditing a business selling water bottles. Because diamonds are extremely valuable, a small mistake can lead to a significant misstatement with serious consequences.

Control Risk

Control risk relates to the internal control systems of the organisation. Internal control means that work done by one person is automatically verified by another person as part of regular day-to-day operations. It encompasses protocols, hierarchies, and documentation systems.

For example, when withdrawing cash at a bank, a cashier may send the customer to the head cashier for approval before issuing the cash. Similarly, a student seeking leave from a college must obtain approvals through a defined hierarchy consisting of the subject teacher, class teacher, head of department, and principal.

An auditor evaluates two aspects of internal control systems:

• Efficiency, which refers to the design on paper, the potential of the control system, and whether it is foolproof and addresses all possible scenarios through proper documentation.
• Effectiveness, which refers to the actual application and whether employees and organizational resources are genuinely following the controls in practice.

Detection Risk and Materiality

Detection risk is the risk that the auditor fails to detect a material misstatement in the financial statements.

An auditor is primarily concerned with material aspects of the financial statements. Although audit procedures are performed on immaterial items, only material items influence decision-making, require reporting, and must be disclosed.

A material item, transaction, or event is one that can impact the economic decision-making of a user. If that information is known, the user's decision would change.

Misstatements: Fraud and Error

A misstatement can arise in several forms:

• A wrong amount or valuation error, such as entering ten thousand dollars into the system instead of one thousand dollars.
• A wrong accounting treatment, such as treating capital expenditure as revenue expenditure.
• A wrong classification, such as classifying a non-current asset as a current asset.
• Inadequate or incorrect disclosures.

Misstatements occur due to two primary reasons:

• Fraud, which is an intentional wrongdoing or deliberate concealment of reality.
• Error, which is an unintentional mistake caused by a lack of awareness regarding accounting treatments or valuation rules.

The risk arising from fraud is much higher than that arising from error. Because fraud is intentional, undetected fraud is likely to be repeated and create a cascading effect over time, growing from a small amount in one year to much larger amounts in subsequent years.

The Audit Risk Model

Audit risk is the product of the three risks: Inherent Risk multiplied by Control Risk multiplied by Detection Risk. It is not the sum of these risks.

If a business has very high inherent risk, but management has established highly efficient and effective internal controls, control risk is reduced near to zero. In that case, the overall audit risk is substantially reduced because the internal controls prevent and detect misstatements.

If both inherent risk and control risk are high, an auditor should generally not accept the engagement. However, if the engagement is accepted, the auditor can keep overall audit risk low by driving detection risk close to zero. To achieve this, the auditor must verify every single voucher, inspect every financial record, and evaluate every management assertion.

An assertion is any piece of information provided or disclosed by management. While verifying every assertion would reduce detection risk to near zero, testing every single transaction is practically impossible.

Detection risk consists of two components:

• Sampling risk, which is the risk that the auditor's conclusion based on a sample differs from the conclusion that would be reached if the entire population were tested. For example, if an auditor examines two hundred vouchers out of one thousand, material misstatements might exist within the remaining eight hundred vouchers.
• Non-sampling risk, which is the risk that the auditor fails to detect a misstatement even though the transaction was included in the sample tested.

Teeming and Lading

Teeming and lading is an example of a situation involving non-sampling risk.

Assume sales are made on credit:

• On 1 January 2019, a sale of ten thousand dollars to Mr. X.
• On 15 January 2019, a sale of twelve thousand dollars to Mr. Y.
• On 25 January 2019, a sale of fifteen thousand dollars to Mr. Z.

On 20 January 2019, Mr. X pays ten thousand dollars in cash. If the cashier and accountant are the same person, or if there is no segregation of duties, the individual can pocket the ten thousand dollars without recording the receipt.

On 25 January 2019, Mr. Y pays twelve thousand dollars. The accountant records ten thousand dollars as received from Mr. X, clearing Mr. X's balance, and keeps the remaining two thousand dollars. At this stage, twelve thousand dollars is missing from the business.

On 30 January 2019, Mr. Z pays fifteen thousand dollars. The accountant records twelve thousand dollars against Mr. Y's account and keeps the remaining three thousand dollars. Fifteen thousand dollars is now missing.

On 5 February 2019, the accountant records the receipt of fifteen thousand dollars from Mr. Z.

During this entire period, business cash was misappropriated for personal use. Teeming and lading can occur when one individual controls both cash handling and recordkeeping, or when two employees collude despite segregation of duties. An auditor checking the records might not identify this fraud from internal documentation alone unless external confirmations are obtained directly from customers showing the actual dates payments were made.

Summary of Audit Risk

Audit risk represents the risk that the auditor expresses an inappropriate, unmodified opinion when financial statements are materially misstated.

Audit risk is a function of:

• Inherent risk, which depends on the nature of the business, transactions, and complexity of accounting treatments.
• Control risk, which reflects inefficiencies or lack of effectiveness in internal control systems.
• Detection risk, which reflects the risk that the auditor fails to identify a material misstatement, whether caused by fraud or error, due to sampling risk or non-sampling risk.