PERFORMANCE OF RISK
ASSESSMENT
PROCEDURES
Auditing and Assurance Engagement Concepts and Application
Prepared by: Nixsun Diaz Casuncad
Performance of Risk Assessment
Procedures
A. Identification of Inherent Risks and Significant Risks
B. Understanding the Design/Implementation of Relevant Internal
Controls
C. Concluding the Risk Assessment Phase
Identification of Inherent Risks and
Significant Risks
Steps that may be followed:
1. Gather basic information about the entity.
- Obtain basic understanding or frame of reference for designing the risk
assessment procedures to be performed
- Obtain and document relevant basic information about the entity, its
objectives, culture, operations, key personnel and the internal organization
and control
- Documentation could include: (a) client-prepared information like strategic
plan and documented policies and procedures; (b) external data like industry
reports; (c) relevant correspondence like consultants’ report; and (d) clients’
key procedures.
Identification of Inherent Risks and
Significant Risks
Steps that may be followed:
2. Design performance and document risk assessment procedures.
- Risk assessment procedures are performed so that: (a) the sources of risks of
material misstatements are identified; (b) as appropriate understanding of the
entity is obtained; and (c) the necessary supporting audit evidence is obtained.
Identification of Inherent Risks and
Significant Risks
Steps that may be followed:
3. Relate the risks identified to material FS areas.
- For each risk factor identified, identify the specific misstatements that
could occur in the FS as a result effect of persuasive risks help in assessing
risks at the FS level.
Identification of Inherent Risks and
Significant Risks
Risk identification is the first and most important step in evaluating
internal control. This requires identification of the risks which need
to be mitigated by internal control.
Understanding the Design/Implementation of
Relevant Internal Controls
The auditor is required to obtain an understanding of the following:
A. Control Environment - The control environment comprises the overall
attitude, awareness and actions of directors and management regarding
the internal control system and its importance in the entity.
B. Risk Assessment of the Entity
C. Information System
D. Control Activities – The policies, procedures, techniques and
mechanisms that help ensure that management’s response to reduce risks
identified during the risk assessment process is carried out.
E. Monitoring
Understanding the Design/Implementation of
Relevant Internal Controls
Control Design
This step involves inquiry (inquiry consists of seeking information of
knowledgeable persons inside or outside the entity) about controls and
evaluation of controls that management has put in place to address
the risks that have been identified during Risk Identification.
Control Implementation
This step is to determine whether the control exist and are in use by
the entity through inquiry and testing.
Understanding the Design/Implementation of
Relevant Internal Controls
Control Design
This step involves inquiry about controls and evaluation of controls
that management has put in place to address the risks that have been
identified during Risk Identification.
Control Implementation
This step is to determine whether the control exist and are in use by
the entity through inquiry and testing.
Control Documentation
Concluding the Risk Assessment Phase
Fundamental questions auditors must address to determine the
optimal amount of audit work:
1. How much assurance can be obtained regarding audit risk when
internal control is present and working?
2. If control activities within major processes are working properly
throughout the year, what is the residual risk that remains that an
account balance can still be misstated?
3. What is the risk that the auditor’s evaluation of internal controls
might be incorrect?
Concluding the Risk Assessment Phase
Fundamental questions auditors must address to determine the
optimal amount of audit work:
4. Which account balances contain more than an acceptable
amount of risk that a material misstatement could occur?
5. How would a misstatement in a material account balance most
likely occur?
6. What are the most effective substantive tests of account balances
to determine whether there is a misstatement in the account
balance?