An auditor who identifies aggressive earnings targets must connect those pressures to possible misstatements before selecting procedures. Broad concerns about management affect the engagement overall; premature sales recognition also creates identifiable risks within particular transactions and balances.
A misstatement is a difference between reported information and the amount, classification, presentation, or disclosure required by the applicable financial reporting framework. The risk assessment addresses intentional manipulation and unintentional error, including omissions from the financial statements.
For a nonissuer, a relevant assertion has an identified risk of material misstatement associated with that claim. A significant transaction class, account balance, or disclosure has at least one such assertion, determined before considering controls.
The auditor assesses inherent risk first, then considers controls intended for testing when assessing control risk at the relevant assertion level. Effective controls can support lower assessed control risk, but they do not make an inherently difficult valuation simple.
Audit risk is the risk of expressing an inappropriate audit opinion when the financial statements are materially misstated.
Common mistakes
- Control coverage confused with sales coverage. Ten daily reviews cover ten control occurrences, not ten invoices or all 600 invoice details.
- Wrong population direction. Selecting only recorded payables cannot identify a $42,000 liability omitted from that list.
- Period effects mixed. Adding Corvane's four absolute error amounts produces $120,000, which represents neither current-income nor closing-net-assets overstatement.
Bottom line
- Assess inherent risk before controls, then support any reduction in control risk with appropriate operating evidence.
- Distinguish pervasive financial statement level risks from specific risks affecting relevant assertions.
- Apply the governing regime's significant-risk definition and identify the revenue types, transactions, or assertions affected by presumed fraud risk.
- Control testing is necessary for planned reliance, when substantive evidence alone cannot suffice, and to meet separate integrated-audit objectives.
Exam shortcut
Read the engagement type and regime first. Then identify the requested decision: risk classification, control reliance, substantive procedure, or service-specific work. Translate each fact into a possible misstatement and assertion. Match the proposed procedure's evidence and selection direction to that claim. When one control fact changes, hold inherent risk and the population constant. Revisit reliance, then change the nature, timing, or extent of substantive work.
The full lesson (about 6,782 words, 45 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- II.E1
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.