AUDIT PLANNING AND RISK

AUDIT PLANNING AND RISK

CHAPTER OBJECTIVE

1. AUDIT STRATEGY
2. AUDIT PLAN
3. AUDIT RISK ASSESSMENT
4. UNDERSTANDING THE ENTITY

……………………………………………………………………………………………………………….
1. AUDIT STRATEGY

The audit strategy sets the scope, timing and direction of the audit. It allows the auditor to determine the following:
 The resources to deploy for specific audit areas (e.g. experience level, external experts);
 The amount of resources to allocate (e.g. number of team members);
 When the resources are to be deployed; and
 How the resources are managed, directed and supervised

2. AUDIT PLAN

Once the audit strategy has been established, the next stage is to develop a specific, detailed plan to address how the various matters identified in the overall strategy will be applied.
Audit plan is much more detailed than the overall strategy because it includes details of the nature, timing and extent of the specific audit procedures to be performed.
The audit plan should include specific descriptions of:
 The nature, timing and extent of risk assessment procedures;
 The nature, timing and extent of further audit procedures, including:
– What audit procedures are to be carried out
– Who should do them
– How much work should be done (sample sizes, etc.)
– When the work should be done (interim vs final)
 Any other procedures necessary to conform to ISA’s

3. AUDIT RISK ASSESSMENT

Audit risk is the risk that the auditor may give an inappropriate audit opinion on the financial statements. Audit risk has three components: inherent risk, control risk and detection risk.
Inherent risk
The susceptibility of an account balance or class of transactions to material misstatement, irrespective of related internal controls.
This risk element results from the nature of the enterprise under review, the industry in which it operates and the makeup of the items appearing in its financial statements. Inventory, for example is often more inherently risky than cash as there is greater scope for manipulation and error. A business in the construction industry or the fashion industry is more risky than a food retailer as it is more volatile.

Control risk
The risk that material misstatement could occur in an account balance or class of transactions which would not be prevented, detected and corrected by the accounting or internal control systems.
This risk will be affected by such factors as the control environment including, for example, the integrity of the staff operating the system, the extent of supervisory controls, and the strength of controls in particular account areas.
Detection risk
The risk that auditors’ procedures do not detect a material misstatement in an account balance or class of transactions.
This is the only component of overall audit risk which under the control of the auditor. A larger sample size will reduce the level of detection risk. In principle if the auditor accurately examines all transactions, detection risk is reduced to zero.

4. UNDERSTANDING THE ENTITY

In order to assess risk auditor must obtain an understanding of the client entity and environment.
 Industry, regulatory and other external factors
 Nature of the entity, including selection and application of accounting policies
 Objectives and strategies and relating business risks
 Measurement and review of the entity’s financial performance
 Internal control
Auditor performs the following procedures:
 Enquiries of management and others within the entity (e.g. about changes in staffing, company structure, products, competition);
 Analytical procedures;
 Observation (e.g. of systems and controls); and
 Inspection (e.g. key documents)

Source:

1. Phnom Penh HR (www.pp-hr.com)
2. Kaplan, FAU