Planning and Developing a Financial Statement Audit
Audit Risk Model
Steps in the Audit Process
1. Client acceptance and retention
2. Planning and understanding the client
Understand client strategies and business processes (strategic and process analyses)
Risk Assessments
Planning analytics
3. Plan tests of financial statement assertions
4. Perform tests of financial statement assertions
Tests of control operating effectiveness and substantive tests
5. Wrapping up the audit
6. Audit reporting
2
Why is Risk Management So Critical to Auditors?
Fundamental to Client Acceptance:
Auditors only accept clients that have effectively managed risks unless willing to share in the costs associated with poor client risk management
Fundamental to Resource Allocation:
Auditors perform more tests related to aspects of the client presenting the highest risk exposure to the fair presentation of the financial statements
客户接受的基础：审计师只接受有效管理风险的客户，除非愿意分担与客户风险管理不良相关的成本
资源分配的基础：审计师执行更多与客户方面相关的测试，这些客户对财务报表的公允列报具有最高风险
3
Audit Risk Model
AR = IR × CR × DR
AR: Audit Risk
IR: Inherent Risk
CR: Control Risk
DR: Detection Risk
RMM: Risk of Material Misstatement
RMM
Inherent Risk: the risk of a MATERIAL misstatement assuming no internal controls.
Control Risk: the risk of the internal control failing to detect a MATERIAL misstatement.
Detection Risk: the risk of the audit procedures failing to detect a MATERIAL misstatement
Audit Risk Model
内在风险:假设没有内部控制，重大错报的风险。
控制风险:内部控制未能发现重大错报的风险。
发现风险:审计程序未能发现重大错报的风险
5
Audit Risk (AR)
Risk the auditor expresses an inappropriate opinion
The auditor determines what level of AR is acceptable for a given client
Distribution of ownership
Business risk to audit firm
Client size
Litigation environment
AR = IR × CR × DR
RMM
审核员确定给定客户可接受的AR级别
所有权分配
审计公司的业务风险
客户规模
诉讼环境
6
What is Appropriate Audit Risk?
Due Professional Care: Methods for Minimizing Audit Risk
There is a trade-off: Maximum such that opinion can be issued without much risk that financial statements are materially misstated.
AR Evidence
Relationship between audit risk and the need for evidence is inverse
Risk of Material Misstatement (RMM)
Not directly influenced by auditor
Assessed by the auditors
Risk that financial statements are materially misstated prior to audit
AR = IR × CR × DR
RMM
不直接受审计师的影响
由审计员评估
在审计之前财务报表存在重大错报的风险
8
Inherent Risk (IR)
Susceptibility of an assertion to material misstatement (individually or in aggregate)
Assumes no related internal controls
Important factors
Client’s business
Management’s integrity
Client competence
Rush to produce financial statements
Pressure to hit key metrics
Number and nature of related parties
Routineness of transactions
AR = IR × CR × DR
RMM
声明对重大错报的敏感性（单独或合计）
假设没有相关的内部控制
重要因素
客户的业务
管理层的诚信
客户能力
急于编制财务报表
达到关键指标的压力
关联方的数量和性质
交易的常规性
9
Control Risk (CR)
Risk that internal control won’t prevent or detect and correct a material misstatement (individually or in aggregate)
Assessment based on understanding of client and testing of internal control
Auditor may choose to assess control risk at maximum and forgo testing for private clients
Important factors
Control environment (tone at the top)
Board of directors and audit committee
Internal audit
Effectiveness of accounting system
Strength of internal control system
AR = IR × CR × DR
RMM
内部控制不会阻止或发现和纠正重大错报的风险（单独或汇总）
基于对客户的理解和内部控制测试的评估
审计员可以选择最大限度地评估控制风险，并为私人客户进行放弃测试
重要因素
控制环境（顶部音调）
董事会和审计委员会
内部审计
会计制度的有效性
内部控制系统的优势
10
Detection Risk (DR)
Risk that auditor fails to detect a material misstatement (individually or in aggregate)
Directly influenced by the auditor
Auditors reduce DR by increasing the quantity and quality of their testing
Two primary components
Substantive analytical procedures
Tests of details
Auditors control AR through DR
AR = IR × CR × DR
RMM
实质性分析程序
测试细节
11
12
Auditors use this relationship during the planning phase to determine the nature, extent, and timing of evidence to gather for audit testing. Thus, auditors look at this relationship as follows:
Evidence
__AR__ = DR
IR x CR
Amounts can be expressed in Relative Terms (H, M, L)
Inverse
Audit Risk Model
审计师在规划阶段使用这种关系来确定收集审计测试的证据的性质，范围和时间。 因此，审计师将这种关系看作如下
13
Relationship between inherent risk and need for evidence is ________ .
Relationship between control risk and need for evidence is ________.
Interaction of Inherent and Control Risks: RMM
direct
IR Evidence
direct
CR Evidence
Components of the Traditional Risk Model
Ramifications of Detection Risk Assessments
Relationship to Need for Evidence is _________
Low Detection Risk (High IR x CR and Sufficiently Low AR):
Tests of the Account Balance and/or Transactions generated by Business Process Necessary
High Detection Risk (Low IR x CR and Sufficiently High AR)
Test of Process Controls and Analytical Evidence Sufficient
inverse
DR Evidence
Reduce (achieved) detection risk by
Business Risk Auditing:
The Ultimate Goal:
Achieved Audit Risk_____Acceptable Audit Risk
Increasing substantive audit procedures
Detection Risk is Lowest for Accounts Impacted by Processes with High Residual Business Process Risk
Audit Risk Model
增加实质审计程序
对于具有高剩余业务流程风险的流程影响的帐户，检测风险最低
16
Applying the ARM
| Planned AR | IR | CR | RMM | Aggregate testing | DR | |
| Example 1 | ||||||
| Low | High | High | ||||
| Amount of testing |
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
LOW
Low for control percejudt
17
Applying the ARM
| Planned AR | IR | CR | RMM | Aggregate testing | DR | |
| Example 2 | ||||||
| Low | High | Low | ||||
| Amount of testing |
MOD
HIGH
HIGH
LOW
MOD
MOD-HIGH
LOW-MOD
Applying the ARM
| Planned AR | IR | CR | RMM | Aggregate testing | DR | |
| Example 3 | ||||||
| High | Low | High | ||||
| Amount of testing |
MOD
LOW
LOW
HIGH
MOD
LOW -MOD
MOD - HIGH
19
Sampling Risk vs. Non-Sampling Risk
Non-sampling Risk
Analyses of past alleged audit failures indicate that such non-sampling risk factors … are among the most significant audit risk factors and sources of auditor liability.
Montgomery’s Auditing, 10th Edition [1985]
*
07/16/96
*
##
抽样风险与非抽样风险对过去涉嫌审计失败的分析表明，此类非抽样风险因素......是最重要的审计风险因素和审计师责任来源。
Sampling vs. Non-Sampling Risk
Detection risk (DR) is a function of sampling risk (SR) and non-sampling risk (NSR).
SR arises from the possibility that the auditor’s conclusion would change if audit procedures were applied to the entire population.
NSR arises from factors that cause the auditor to reach an erroneous conclusion for any reason other than the size of the sample (ISAs).
Judgment errors (e.g., biases)
*
07/16/96
*
##
检测风险（DR）是抽样风险（SR）和非抽样风险（NSR）的函数。
如果审计程序适用于整个人口，审计师的结论可能会发生变化，从而产生SR。
NSR源于导致审核员因样本量（ISA）以外的任何原因而得出错误结论的因素。
判断错误（例如，偏见）
Sources of Non-sampling Risk
Auditors’ belief formation and revision may be faulty, resulting in inaccurate assessment(s) of any component of the audit risk model.
Misinterpretation or misapplication of accounting principles and auditing standards.
Failure to obtain an understanding of the entity and its environment sufficient for assessing the components of audit risk.
Failure to obtain sufficient, appropriate audit evidence when responding to preliminary assessments初步评估 of such components.
*
07/16/96
*
##
审计师的信念形成和修订可能有误，导致审计风险模型的任何组成部分的评估不准确。
会计原则和审计标准的误解或误用。
未能充分了解实体及其环境，足以评估审计风险的组成部分。
在回应对这些组成部分的初步评估时未能获得充分，适当的审计证据。
Guidance on Non-sampling Risk
U.S. authoritative guidance does not explicitly represent it in the ARM, instead suggests that risk can be reduced to a negligible level 降低到可忽略的风险through appropriate planning, supervision and quality control mechanisms.
NSR could be a source of detection risk that produces distorted assessments of RMM and DR.
*
07/16/96
*
##
美国权威指南没有在ARM中明确表示，而是建议通过适当的规划，监督和质量控制机制将风险降低到可以忽略的程度。
NSR可能是检测风险的来源，导致对RMM和DR的扭曲评估。
(1) Recursive Risk Assessment: SSA auditors manage NSR by viewing the entire audit as a recursive process of evidence-driven, belief-based assessment.
That is, auditors should continually update their risk assessments as they gather evidence.
(2) Self-criticism: Auditors should be skeptical of their own judgment and decision making ability and consider the potential fallibility of their judgments.
Reducing NSR
*
07/16/96
*
##
（1）递归风险评估：SSA审核员通过将整个审核视为以证据为基础，基于信念的评估的递归过程来管理NSR。
也就是说，审核员在收集证据时应不断更新风险评估。
（2）自我批评：审计师应该对自己的判断和决策能力持怀疑态度，并考虑他们判断的潜在可能性。
(3) Non-Financial KPI’s: Auditors should consider KPI’s that the client uses to run its business but not typically used in financial reporting.
Google example: cost per click, click through rates, search usage, etc.
These KPI’s help the auditor form expectations for financial statement assertions AND are less prone to management manipulation.
Divergence of these KPI’s with F/S performance is highly associated with fraud
(Brazel et al.2006)
（3）非财务关键绩效指标：审计师应考虑客户用于经营业务的关键绩效指标，但通常不用于财务报告。
Google示例：每次点击费用，点击率，搜索使用情况等。
这些KPI有助于审计师形成对财务报表断言的期望，并且不太容易受到管理层的操纵。
这些KPI与F / S表现的分歧与欺诈密切相关
26