Audit season is right around the corner for calendar-year entities. Here’s what your auditor is doing behind the scenes during the risk assessment process — and how you can help facilitate the planning process.
What Is Audit Risk?
Every audit starts with assessing “audit risk.” This refers to the likelihood that the auditor will issue an adverse opinion when the financial statements are actually in accordance with U.S. Generally Accepted Accounting Principles (GAAP) or (more likely) an unqualified opinion when the opinion should be either modified or adverse.
Auditors can’t test every transaction, recalculate every estimate, or examine every external document. Instead, they tailor their audit procedures and assign audit personnel to keep audit risk as low as possible.
The Role of an Auditor
The auditor’s role is to attest to your company’s financial statements. Specifically, your audit firm assures that your financial statements are “fairly presented in all material respects, compliant with GAAP, and free from material misstatement.”
Unqualified (or clean) audit opinions require detailed substantive procedures, such as confirming accounts receivable balances with customers and conducting test counts of inventory in the company’s warehouse. Generally, the more rigorous the auditor’s substantive procedures, the lower the likelihood of the audit team failing to detect a material misstatement.
Inherent Risk vs. Control Risk
Auditors evaluate two types of risk:
- Inherent risk. This is the risk that material departures could occur in the financial statements. Examples of inherent risk factors include complexity, volume of transactions, competence of the accounting personnel, company size, and use of estimates.
- Control risk. This is the risk that the entity’s internal controls won’t prevent or correct material misstatements in the financial statements.
Separate risk assessments are done at the financial statement level and then for each major account — such as cash, receivables, inventory, fixed assets, other assets, payables, accrued expenses, long-term debt, equity, and revenue and expenses. A high-risk account (say, inventory) might warrant more extensive audit procedures and be assigned to more experienced audit team members than one with lower risk (say, equity).
How Auditors Assess Risk
New risk assessments must be done yearly, even if the company has had the same auditor for many years. That’s because internal and external factors may change over time. For example, new government or accounting regulations may be implemented, and company personnel or accounting software may change, causing the company’s risk assessment to change. As a result, audit procedures may vary yearly or from one audit firm to the next.
The risk assessment process starts with an auditing checklist and, for existing audit clients, last year’s work papers. However, auditors must dig deeper to determine current risk levels. In addition to researching public sources of information, including your company’s website, your auditor may call you with a list of open-ended questions (inquiries) and request a walk-through to evaluate whether your internal controls are operating as designed. Timely responses can help auditors plan their procedures to minimize audit risk.
Your Role During the Audit Process
Audit fieldwork is only as effective as the risk assessment. Evidence obtained from further audit procedures may be ineffective if it’s not properly linked to the assessed risks. So, it’s important for you to help the audit team understand the risks your business is currently facing and the challenges you’ve experienced reporting financial performance, especially as companies implement updated accounting rules in the coming years.
Contact us to get help with your risk assessment process.