Risk Assessment & Audit Evidence

🟢 Lite — Quick Review (1h–1d)

Risk Assessment & Audit Evidence — Key Facts

• ISA 315 — Identifying and assessing risks of material misstatement through understanding the entity and its environment
• ISA 330 — The auditor’s responses to assessed risks
• Audit Risk Formula: AR = IR × CR × DR
• Risk Assessment: Inherent risk + Control risk → determine overall risk → design responses
• Audit Evidence: Information used to draw conclusions; must be sufficient and appropriate
• Sufficiency = quantity of evidence; Appropriateness = quality (relevance + reliability)

⚡ Exam Tip: The Audit Risk Formula is frequently tested. Remember: Detection Risk is inversely related to Inherent Risk and Control Risk. Higher IR/CR → lower DR → more audit evidence needed.

---

🟡 Standard — Regular Study (2d–2mo)

Risk Assessment & Audit Evidence — Detailed Content

ISA 315 — Risk Assessment:

The auditor must obtain an understanding of:

1. Entity’s Industry and Regulatory Environment

   • Industry conditions (competition, demand, regulation)
   • Legal and statutory requirements
   • Industry-specific accounting policies

2. Entity’s Nature

   • Business model and how it creates risk
   • Related parties and transactions
   • Objectives, strategies, and business risks
   • Financial performance measurement

3. Entity’s Accounting Systems

   • Recording, processing, summarizing financial information
   • Internal controls relevant to financial reporting

4. Entity’s Internal Controls (ISA 315/265)

   • Control environment
   • Entity’s risk assessment process
   • Information systems and communication
   • Control activities
   • Monitoring of controls

Inherent Risk Factors:

• Complexity of transactions
• Subjectivity of accounting estimates
• Susceptibility to fraud or error
• Volume and nature of transactions
• Non-routine transactions (unusual, judgmental)
• Related party transactions
• Start-up or going concern uncertainties

Control Risk:

• Risk that internal controls fail to prevent or detect misstatement
• May be high, medium, or low
• Assessed based on walk-through tests and tests of controls

Audit Risk Model:

AR = IR × CR × DR

Where:
AR = Audit Risk (set at low, typically 5% or lower)
IR = Inherent Risk (risk in the absence of controls)
CR = Control Risk (risk controls don't prevent/detect)
DR = Detection Risk (risk audit procedures miss misstatement)

Note: DR = AR / (IR × CR)

ISA 330 — Responses to Assessed Risks:

After assessing risks, the auditor designs and implements:

1. Overall Responses (at financial statement level):

• Emphasize professional skepticism
• Assign experienced team members
• Incorporate unpredictability in selection of procedures
• Supervise and review work

2. Specific Responses (at assertion level):

• Substantive procedures: Direct testing of transactions, account balances, disclosures
• Tests of controls: When relying on internal controls

Substantive Procedures include:

• Tests of details: Confirmations, vouching, tracing, analytical procedures
• Analytical procedures: Comparison, investigation of fluctuations and relationships

⚡ Exam Tip: The phrase “sufficient and appropriate evidence” is a DEFINITION and is often tested. Sufficiency is QUANTITY (more items = more evidence); Appropriateness is QUALITY (relevant AND reliable).

---

🔴 Extended — Deep Study (3mo+)

Comprehensive Risk Assessment & Audit Evidence Notes

Understanding the Entity — Risk Assessment Process:

Risk Assessment Procedures
        ↓
Obtain Understanding of Entity & Environment
        ↓
Identify Business Risks → Assess Impact on Financial Statements
        ↓
Identify & Assess RMM (Risks of Material Misstatement)
        ↓
Design Responses to Address RMM

Assertion-Based Auditing:

Every financial statement item is tested against these assertions:

At Transaction/Event level:

• Occurrence — Transactions recorded actually happened
• Completeness — All transactions recorded
• Accuracy — Amounts are correct
• Cut-off — Transactions in correct period
• Classification — Properly categorized

At Balance Sheet level:

• Existence — Assets/liabilities exist
• Rights & Obligations — Entity has rights to assets
• Completeness — All items recorded
• Valuation — Correctly measured
• Allocation — Correctly presented and disclosed

Audit Evidence — Detailed Analysis:

Types of Audit Evidence:

1. Physical examination — Inspection of assets
2. Confirmation — Written responses from third parties (receivables, bank, creditors)
3. Documentation — Inspection of records, invoices, contracts
4. Observation — Watching processes being performed
5. Inquiry — Asking questions (written/oral)
6. Analytical procedures — Ratio analysis, trend analysis, reasonableness testing

Reliability of Evidence Hierarchy:

Most Reliable	Least Reliable
External confirmations	Inquiry of management
Documents from third parties	Internal documents (without controls)
Auditor-generated evidence	Observation (single point in time)
Combination of evidence	Inquiry alone

Anti-fraud procedures (ISA 240 requires):

• Brainstorm where fraud might occur
• Identify fraud risks (revenue recognition, management override, estimates)
• Design responses (unpredictable procedures, increased scrutiny)
• Evaluate design of programs and controls
• Respond to results

Going Concern Considerations (ISA 570): When indicators exist (losses, loan covenants, dependency on single customer):

• Evaluate management’s assessment
• Review cash flow forecasts
• Consider mitigating factors
• Assess adequacy of disclosure in FS
• Consider need for emphasis of matter paragraph

Common Exam Mistakes:

Mistake	Correction
Calling all evidence “equally reliable”	External > Internal (with controls) > Internal (without controls)
Confusing inherent risk with control risk	IR exists without any controls; CR is about control failure
Not linking assertions to procedures	Each assertion requires specific test design
Overlooking going concern indicators	Always check for cumulative loss indicators

⚡ High-Yield Audit Risk Calculation:

If IR increases from 60% to 80% and CR remains 50%:

• Old DR = AR/(IR×CR) = 5%/(0.6×0.5) = 5%/30% = 16.67%
• New DR = 5%/(0.8×0.5) = 5%/40% = 12.5%

Conclusion: Higher IR → Lower DR → More evidence required

⚡ Exam Answer Framework for Risk Questions:

1. Identify inherent risk factors present
2. Assess whether controls are likely effective or ineffective
3. Calculate/assess overall audit risk
4. Determine detection risk (what’s left to cover)
5. Design substantive procedures proportionate to risk

---

Content adapted based on your selected roadmap duration. Switch tiers using the selector above.