Risk Assessment A3

The second standard of fieldwork requires the auditor to obtain an understanding of the entity, including its internal controls, by performing risk assessment procedures.

1) Obtain an understanding of the entity including IC
2) Assess the risk of MM
3) Respond to the assessed level of risk by designing further audit procedures based on this assessment
4) Test IC to evaluate their operating effectiveness (sometimes)
5) Perform substantive tests
6) Evaluate the sufficiency and appropriateness of audit evidence

1) Inquiries of mgmt
2) Analytical procedures: to gain understanding by comparing
3) Observations and Inspection
4) Discussion among the audit team: significant risk factors, experienced members share, emphasize prof skept.

IC is a process designed to provide reasonable assurance about the achievement of the entity's objectives.

Information collected about risk serves as evidence to support the auditor's risk assessment, which is used to determine the NET of further audit procedures.

-nonroutine, unusual, or complex transaction
-fraud risk
-significant related party transaction

In making risk assessments, the auditor should ID those controls that are likely to prevent/detect and correct MM in specific relevant assertions. If the risk assessment is based on effective operation of those controls (low control risk), they must be tested by the auditor.

1) The disucssion of the audit team
2) Key elements of the understanding of the entity and its environment
3) The assessment of the risks of MM
4) The IDed risks and related controls evaluated by the auditor
*documentation may include: flowchart, IC questionnaire, narrative or decision table