bea2004 notes unit 3 - audit risk methodology

Rhgj201

Description

BEA 2004 AUDITING 2007 Background Notes Unit 3 Audit Methodology and the Audit Risk Model The auditor of a UK company is required to give an opinion as to whether the financial statements prepared by the company show a true and fair view. This process requires the gathering of evidence to support this opinion. Over the years there have been significant changes in the manner in which auditors and audit firms have approached this task. Substantive audit Historically the audit was balance sheet orientated and the auditor sought to obtain direct evidence by means of substantive tests designed to support the existence, ownership and valuation of the assets and liabilities in the balance sheet. Such evidence might be derived from observation, checking of title documents, seeking evidence from third parties (for example circularising debtors and creditors), evidence from internal documentation and record keeping etc. There would also be quite detailed checking and vouching of transactions (although in the nineteenth century the courts effectively endorsed a sample based approach to audit testing in London General Bank (1895) 2 Ch.673). The greater emphasis on vouching of transactions was in part related to the manual nature of accounting procedures and the relatively rudimentary forms of internal check and systems of control. It may also have reflected the fact the in many early audit engagements the auditor was also fulfilling a ...

Informations

• Publié par: Phyon
• Nombre de lectures: 9
• Langue: English

Extrait

1

BEA 2004

AUDITING

2007

Background Notes Unit 3

Audit Methodology and the Audit Risk Model

The auditor of a UK company is required to give an opinion as to whether the

financial statements prepared by the company show a true and fair view. This process

requires the gathering of evidence to support this opinion. Over the years there have

been significant changes in the manner in which auditors and audit firms have

approached this task.

Substantive audit

Historically the audit was balance sheet orientated and the auditor sought to obtain

direct evidence by means of substantive tests designed to support the existence,

ownership and valuation of the assets and liabilities in the balance sheet. Such

evidence might be derived from observation, checking of title documents, seeking

evidence from third parties (for example circularising debtors and creditors), evidence

from internal documentation and record keeping etc. There would also be quite

detailed checking and vouching of transactions (although in the nineteenth century the

courts effectively endorsed a sample based approach to audit testing in

London

General Bank (1895) 2 Ch.673

). The greater emphasis on vouching of transactions

was in part related to the manual nature of accounting procedures and the relatively

rudimentary forms of internal check and systems of control. It may also have reflected

the fact the in many early audit engagements the auditor was also fulfilling a quasi-

accounting or internal audit role with the particular objective of preventing and

detecting fraud.

2

Systems audit

The increase in company size and complexity throughout the twentieth century was

accompanied by the development of systems of internal control and internal check

within these companies. There was also a greater audit focus on reporting on the

profit and loss account itself (rather than considering the profit for the year merely as

a residual change in net assets). This led to the development from the 1960s onwards

of what became to be known as a systems based approach to audit in which a greater

degree of reliance was based upon the audit client’s own systems of check and control

to generate appropriate accounting numbers and a reduced emphasis given to direct

substantive testing and vouching. As formalised in the early UK auditing standards

and guidelines the auditor was required to undertake an initial appraisal of a clients

system of internal control for the purpose of determining the extent to which reliance

might be placed upon the system. If the auditor decided that reliance could be placed

on the system then it was necessary to test the system to ensure that it was in fact

operating in the expected manner. Following evaluation of the results of the systems

testing the auditor would then be in a position to determine the extent to which

substantive tests of detail were necessary.

Among the attractions of the systems testing approach to the audit firms were the

linkages to their developing consulting activities and the practical advantage of

evening out the workload by enabling significant amounts of audit work to be carried

out ahead of a client’s year-end. More problematic was that the linkage between

system reliability and the extent of the reduction in substantive testing was difficult to

establish. Furthermore, for many clients this type of audit was seen as relatively

expensive as compared with the traditional largely substantive approach. Higson

(1997) suggests that ‘though the 1970s were the high point of the systems-based

approach to auditing’ this approach was never suitable for smaller companies because

of their lack of appropriate systems.

Formalised Risk Models

The 1980s saw the widespread adoption by the larger firms of audit methodologies

based upon some form of an audit risk model and in the US SAS 39

Audit Sampling

3

issued in 1981 formalised a risk model separating the overall audit risk of failure to

detect material error into a number of components. The core of the model as was set

out in US standards and subsequently in SAS 300 in the UK is a simple multiplicative

probability model in which the overall risk of failure to detect a material error, Audit

Risk (AR), can be calculated as the product of the likelihood of an error occurring in

the financial statements irrespective of internal controls, Inherent Risk (IR), the

likelihood of such an error being prevented by the operation of the client’s internal

controls, Control Risk (CR), and the likelihood of substantive audit procedures,

whether tests of detail or analytical procedures, failing to detect a material error,

Detection Risk DR, i.e.

AR = IR x CR x DR

So if an auditor is seeking to be 95% confident that the financial statements do not

contain a material error i.e. AR = 0.05 and if inherent risk is assessed to be 60% and

control risk to be 20% then the appropriate level of allowable detection risk can be

calculated as follows

0.05 = 0.6 x 0.2 x DR

i.e. allowable detection risk is 0.42 (or 42%).

Although the audit risk model was for many years firmly entrenched in both auditing

standards and in the operating procedures of the major audit firms it was subject to

criticism on theoretical and practical grounds (see

inter alia

Gwilliam 1987 pp.190-

193). Particular problems relate to the setting of the appropriate level of audit risk

(itself inextricably connected with the level at which financial statement errors are

deemed to be material); the

interdependence of the components of the multiplicative

model in particular the difficulty of distinguishing between inherent risk and control

risk; problems of aggregation across separate financial statement items; the possibility

of non-sampling risk, i.e. that the audit program covers erroneous items but fails to

detect them as erroneous; and perhaps most importantly that the basis of the

quantification of the various risks is still highly subjective, in particular in relation to

inherent and control risk but also in the determination of detection risk. In certain

4

firms the audit risk model was introduced in conjunction with formalised statistical

procedures designed to calculate the likelihood of significant account balance errors

being undetected on the basis of testing samples of a certain size. This led to the

development of a distinction between those firms which embraced a more quantitative

and structured approach to auditing and those which adhered to a more flexible

judgement based approach.

1

However, these formalised statistical procedures were

difficult to operationalise in the audit environment and effectively fell into disuse by

the end of the 1980s as audit firms increasingly focused more on high level ‘key

controls’ and on analytical procedures designed to provide assurance as to the truth

and fairness of the account balances and the financial statements. In consequence in

recent years the structured/non-structured distinction has largely disappeared

2

although for some time individual firms still continued to seek to claim advantages in

audit technology and in delivering value to their audit clients.

3

The Business Risk Approach

The next significant paradigmatic development in terms of methodology was the

business risk approach which itself was based on revision and refinement of audit

procedures to incorporate a wider assessment of risk and, to an extent, a shift in focus

away from audit risk per se toward client risk and client risk management practices.

As has been noted previously, Jeppesen (1998) referred to this expansion of the scope

of audit as a ‘reinvention’ of audit and suggested that whereas ‘the old audit was

confined primarily to the financial statements, the new audit approaches attempt to

audit the auditee’s entire business and strategy.’ A research study by Lemon et al

(2000) identified the main structural components of the business risk audit approach

as follows.

1

See Cushing and Loebbecke (1986), Kinney (1986) and Turley and Cooper (1991) for discussion of actual and

perceived differences in audit methodology.

Bowrin (1998)

reviews the research literature focusing on structural

and organizational differences between accounting and audit firms.

2

Bowrin (1998, p.64) suggested that all the firms which comprised the then Big Five had moved to a semi-

structured approach to audit.

3

Examples of ‘branded’ audit approaches in the UK were Ernst & Young’s

Audit Innovation

, KPMG’s

Audit

2000

itself derived from the North American

Strategic Systems Audit

project. See

Accountancy

, June 1998, pp.84-

5 for a discussion of whether these differences in approach were genuine or whether they were primarily driven by

marketing considerations.

5

i)

A consideration of business risk in the general sense of the risk that the

entity will fail to achieve its objectives. This is not an end in itself but a

means (a source of audit evidence) enabling the work necessary to reach

an appropriate audit conclusion to be done more effectively.

ii)

A greater focus on acquiring knowledge of the client’s business and a

more structured approach to the gathering of relevant information, for

example, industrial, economic and competitor data.

iii)

A wider perception of the organisational framework away from the narrow

perspective of the picture represented in the financial statements.

iv)

A closer alignment with the management’s view of the entity and a closer

co-operation with management in the conduct of the audit and the setting

of audit objectives.

Lemon et al suggest that although the objective of the audit with respect to the giving

of an opinion on the financial statements remains that of ensuring that the risk of

material misstatement is at or below an acceptable level the adoption of a business

risk approach does have some implications for the application of the existing audit

risk model and for evidence gathering procedures. Here they identify differences

between the large firms in that some see consideration of business risk to effectively

replace the separate assessment of inherent risk and control risk whereas others still

make separate assessments of inherent risk and control risk – although these are

significantly influenced by consideration of the client’s business risk.

In terms of evidence gathering the business risk approach places yet more emphasis

on the testing of high level managerial controls and less on more detailed controls.

These high level controls include relevant aspects of the control environment and

corporate governance as well as controls over process. There is also greater emphasis

on the use of analytical procedures as a source of evidence, analytical procedures

being ‘consistent with the auditor’s desire to understand the entity’s business rather

than simply prove the financial statement figures’. In turn the nature of analytical

procedures has become more sophisticated with, it is claimed, the greater use of new

analytic software, broader based data sets and benchmarking.

6

Concluding reflections

Changes in audit methodologies reflect to an extent changes in technology, relative

costs, the nature of financial reporting, perceptions as to the auditor’s role etc. The

major audit firms take the position, some more forcefully than others, that the

accounting technology and internal control systems of their large clients are such that

there is little purpose or value in conducting the type of detailed transactions or

systems based audit that used to take place. Indeed some commentators have

suggested that in the not too distant future the traditional financial audit will be

effectively redundant as companies report financial data on-line and as in-built

controls eliminate the potential for error. In the meantime audit has reinvented and

repositioned itself for the purpose of fitting more comfortably into an added value role

within the overall assessment and management of risk for the benefit of the company

and its stakeholders. If financial audit is to continue within such a model the focus

will be on the possibility of business failure and possibly on the likelihood of major

management fraud enabled by corporate governance failure.

Others are uncomfortable with such a development. They point to the dangers

inherent in ever closer alignment between the auditor and company management and

the development of a relationship in which the auditor loses the last vestige of the role

of a quasi-judicial monitor of the accuracy of management financial reporting and

transmogrifies into little more than a consultant at the beck and call of management.

They also suggest that the continuing concerns as to the quality of financial reporting,

particularly in the US but to an extent in the UK too, do not suggest that this more

traditional role should be abandoned too lightly. In the USA the SEC has been clear in

its desire to see a continuance of audit testing within the methodology of audit as

complemented by analytical procedures and review of the control environment rather

than the procedures and review constituting the audit in themselves. Others more

critical point to the number of perceived corporate and audit failures in which the

issue was essentially one of either corporate governance or strategic risk (or both) and

suggest that in fact auditors are not very competent in such a role. Cases such as

BCCI, Maxwell, Lloyd’s, Barings and more recently Equitable (and perhaps Marconi

and Railtrack) and of course in North America, Enron, Tyco, Xerox, WorldCom etc

do not enhance confidence in the ability of auditors to actually add significant value in

7

a risk management role – and indeed their presence may be counter productive if

stakeholders etc ascribe to them a role which they do not in fact carry out.

8

References

Bowrin, A.R. 1998. Review and synthesis of audit structure literature.

Journal of Accounting

Literature

, pp. 40-71.

Cushing, B.E. and J.K. Loebbecke. 1986. Comparison of Audit Methodologies of Large

Accounting Firms: Accounting Research Study No.26. American Accounting Association.

Gwilliam, D. 1987. A Survey of Auditing Research. ICAEW/Prentice-Hall, 1987.

Higson, A.1997. ‘Developments in Audit Approaches from Audit Efficiency to Audit

Effectiveness’ pp.198-215 in Sherer M. and Turley S. Current Issues in Auditing 3rd edn.

Jeppesen, K.K. 1998. Reinventing auditing, redefining consulting and independence.

European Accounting Review

, September, pp. 517-539.

Kinney Jr., W.R. 1986. Audit technology and preference for auditing standards.

Journal of

Accounting and Economics

, March, pp. 73-89.

Lemon W., Tatum K. and S. Turley. 2000. Developments in the Audit Methodologies of

Large Accounting Firms ABG.

Turley, S. and M. Cooper. 1991. Auditing in the United Kingdom – A Study of the

Development in the Audit Methodologies of Large Accounting Firms. Prentice Hall.