Responding to Assessed Risks

Why this topic matters

Once risks are assessed, the auditor designs further audit procedures that respond to them. Auditing and Attestation (AUD) Area III (Performing Further Procedures and Obtaining Evidence, 30–40%) tests how the nature, timing, and extent of procedures change with risk, when tests of controls are required, and the rules for interim testing and rotating control tests.

Overall responses (financial statement level)

• Emphasize professional skepticism.
• Assign more experienced staff or specialists, and increase supervision.
• Incorporate elements of unpredictability in the selection of procedures.
• Change the general nature, timing, or extent of procedures — for example, performing more procedures at period end.

A weak control environment usually pushes the auditor toward a substantive approach with more year-end testing.

Further audit procedures (assertion level)

Approaches

Approach	When used
Substantive approach	Controls are weak, not relevant, or testing them isn't efficient
Combined approach (tests of controls + substantive procedures)	Controls appear effective and testing them allows less substantive work
Controls must be tested	Substantive procedures alone cannot provide sufficient evidence (highly automated processing), or the auditor intends to rely on controls

Adjusting to higher risk

Dimension	Response to higher assessed risk
Nature	More reliable, more relevant procedures — external confirmation and physical inspection rather than inquiry and internal documents
Timing	At or near the period end rather than at an interim date; unannounced procedures
Extent	Larger samples, more locations, more precise analytical expectations

Increasing extent alone is effective only if the procedure itself is relevant to the risk.

Tests of controls

Tests of controls evaluate whether controls operated effectively throughout the period of reliance: how they were applied, their consistency, and by whom. Procedures include inquiry (never enough alone), observation, inspection of documents showing performance, and reperformance.

• The more the auditor relies on a control, the more persuasive the evidence needed.
• Tests of indirect controls (such as the review of exception reports) may be needed to support a direct control.
• Automated application controls: test once, supported by effective information technology (IT) general controls over program changes.

Interim testing of controls

If controls are tested at an interim date, the auditor obtains evidence about significant changes after the interim period and determines what additional evidence is needed for the remaining period — considering the significance of the risk, the controls tested, the length of the remaining period, and the control environment.

Using evidence from previous audits (rotation)

• If a control has changed, test it in the current audit.
• If a control has not changed, the auditor may rely on prior-audit evidence but must test it at least once in every third audit, and test some controls each audit.
• Controls that mitigate a significant risk must be tested in the current period if relied upon.
• Establishing that a control hasn't changed requires inquiry combined with observation or inspection.

Evaluating deviations

If deviations are found, the auditor makes specific inquiries to understand them and their potential consequences, and determines whether the tests provide an appropriate basis for reliance, whether additional tests are needed, or whether the risks must be addressed substantively. A deviation found in a control that the auditor expected to be effective is a signal to revisit the risk assessment.

Substantive procedures

Substantive procedures detect material misstatements at the assertion level. There are two types:

• Tests of details — of classes of transactions, account balances, and disclosures (vouching, tracing, confirmation, recalculation).
• Substantive analytical procedures — best for large volumes of predictable transactions.

Requirements regardless of risk

• Design and perform substantive procedures for each relevant assertion of each material class of transactions, account balance, and disclosure — because assessments are judgmental and controls have inherent limitations.
• Procedures related to the financial statement closing process: agree or reconcile the financial statements to the underlying records, and examine material journal entries and other adjustments.
• For significant risks addressed only by substantive procedures, include tests of details.
• Consider external confirmation procedures where appropriate.

Interim substantive testing

If substantive procedures are performed at an interim date, the auditor must cover the remaining period with further substantive procedures, or substantive procedures combined with tests of controls, that provide a reasonable basis for extending the interim conclusions to year-end. The higher the risk, the less appropriate interim testing becomes.

Dual-purpose tests

A single procedure can test a control and detect monetary misstatement at once — for example, examining invoices for approval (a control) while also checking the amounts (substantive). Each purpose is evaluated separately.

Evaluating sufficiency

At the end, the auditor evaluates whether risk assessments remain appropriate and whether sufficient appropriate evidence has been obtained. If not, obtain more evidence or modify the opinion.

How it is tested

• Choose the response to a higher risk (nature, timing, extent).
• Apply the rotation rule for prior-year control evidence.
• Identify procedures required in every audit.
• Decide what to do about the remaining period after interim testing.