Mitigating Audit Risk

As modern businesses strive to improve operational processes, internal analysis has become an increasingly relevant action. One of the most common forms of analysis is the audit. Fundamentally, an audit is an examination of financial (and other) information with the intention of identifying and disclosing operational status, issues and opportunities.

The complex nature of an audit can open up the possibility of inaccurate reporting, due to mistakes being made somewhere along the line. This concept is called Audit Risk. At its most basic level, audit risk is the likelihood that an unqualified audit opinion over the financial statements is erroneously issued due to the auditor not detecting material misstatement because of either error or fraud.

The concept is used by accountants and auditors to manage the holistic risk in an auditing process. The accuracy, and thus the entire purpose of an audit, can be defeated by errors in data or detection – this means it is critical to take preventative measures.

Audit risk is composed of three elements: inherent risk, control risk and detection risk.

Inherent Risk (IR) – this is the level of risk involved in the nature of the business or transaction. For instance, IR in an audit of a new financial services firm in an emerging market would be higher than in an audit of an established insurance firm in a developed market.

Control Risk (CR) – this is the risk that one or more misstatements exist in records as a result of an organisation’s internal control systems. If an entity has insufficient or ineffective procedures in place to detect fraud or errors, its control risk will be higher.

Detection Risk (DR) – this is the level of risk that an auditor will fail to detect a misstatement in the financial data. DR is reduced by auditors ensuring they utilise a sufficient amount of sample data for testing and correct methodology for doing so.

Audit Risk is actually a calculable metric, the formula for it is as follow: AR = IR * CR * DR

Mitigation

The AR formula shows that the reduction of any individual component will lower the overall audit risk. Crucial considerations for the proactive reduction of audit risk include:

• Defining segregation of duties – this is the most important internal measure an organisation can execute. Having more than one person’s input on a single task significantly cuts the likelihood of fraud or error occurring.
• Auditors must consistently utilise correct and calculated audit procedures, thereby minimising detection risk.

Failure to consider audit risk and its individual components leads to an increased likelihood of a misinformed audit opinion. This is likely to produce unwarranted recommendations – negative consequences can proliferate from there. It’s unlikely that an external auditor will have much influence to reduce the inherent and control risks. Their responsibility is to mitigate detection risk as much as possible by ensuring they consistently use large enough sample sizes, proper procedures and are meticulously thorough throughout their entire process.

For more information on audit risk, or for external audit enquiries, reach out to a member of the Morrows Audit Services team.