The implications of the business risk approach to auditing

Planning

The
auditor needs to plan the audit (ISA 300) and needs to develop a through
understanding of the business; the planning process still needs an assessment
of audit risk (chapter 10). The effect on planning may include:

·
A consideration of the environment. Is the control environment strong-if
it is not

the business risk approach may not be appropriate.

·
Does the management manage risk effectively? Do they have in place
procedures which can identify and evaluate the business risk faced by the
organization? This should be evaluated at all levels of management.

·
Is the management information system adequate to provide the information
needed to manage the business effectively?

·
Do any risks threaten the going concern status of the company?

·
Do any of the risks have
implications for cash flow?

·
Is there a high risk of fraud-e.g. poor controls, management override,
egotistical ambition and arrogance in the chief executive?

·
Are there related parties with different agendas?

·
Is the business under threat of being taken over with the risk of
management misstating financial statement?

·
Is there a risk of litigation against the company?

·
Is there any risk of withdrawal of support by loan or trade creditors?

Audit Procedures

Although
detailed systems based audit checking work may be eliminated although because
the auditor is relying on the strength of the company’s own internet controls
this does not mean that the auditor does not have to carry out any detailed
checking work.

Key
features are:

·
The auditors must be sure that the internet control processes are
strong. This will require them to validate that assumption-perhaps by
considering the internal audit function and the effectiveness of corporate
governance within the organization. These tests need to be carried out and
documented.

·
Auditors cannot escape some level of substantive testing of balance sheet
items. Whilst they may consider issues such as fixed asset recording, debtors
and purchase ledger balances and possibly even stock to be within the internal
control system and therefore not subject to detailed testing such matters as
provision, contingent liabilities and analytical review cannot be overlooked.

·
The amount of testing carried out will depend on the risk of each items
in the balance sheet being likely to be seriously misstated and of the
financial statement as a whole not showing a true and fair view. This
assessment will be carried out in the context of the business risks identified
and evaluated by the auditors.

In
the end many of the audit risks come down to:

·
Possible misstatement due to inadequate of controls or weak corporate
governance. Recent company failures have been caused by overvaluation of stocks
or under provisions for bad debts or situations where senior management have
overridden control and procedures.

·
Working capital shortage leading to cash flow difficulties and technical
insolvency (inability to pay debts as they fall due), often due to too
expansion.

·
Inappropriate accounting policies. These can often lead to overstatement
of assets or understanding of liabilities. Compliance with accounting standard
is essential.

·
Deliberate suppression or concealment of liabilities.

·
Fraud by management

·
Activities of related parties

·
Computer system failures

·
Litigation and regulatory issues and attempt by management to subvert
disclosures.