Responding to assessed risks

Accounting Ahead | Original study resource | accountingahead.com.au

Responding to assessed risks

MODULE 2 | 2.8 | STUDENT COMPANION

The aim is sufficient appropriate evidence about the assessed risks, through responses designed for them.

Risks at the financial statement level get overall responses; risks at the assertion level get further

audit procedures: tests of controls where the auditor relies on controls or substantive work can't do the job

alone, and substantive procedures for every material item, always. Significant risks need specifically

responsive substantive procedures, and any controls relied on must be tested this year.

Two levels of risk, two kinds of response

Level of risk Response Example at Voltana

Financial statement level: affects

many assertions at once

Overall responses, chosen by the

engagement partner

The new system and the pressure on

revenue: an experienced senior on revenue,

specialists, more year-end work

Assertion level: a particular class

of transactions, balance or

disclosure

Further audit procedures, with

nature, timing and extent fitted to

the risk

Revenue cut-off: testing sales either side of

30 June

Overall responses to financial statement level risks

1

Scepticism

Emphasise to the team

the need for professional

scepticism

2

The right people

More experienced staff,

specialised skills, or

experts

3

Supervision

Closer direction and

review of the team's work

4

Unpredictability

Procedures the client

won't expect

5

Nature, timing,

extent

More work at year end,

less at an interim date;

more substantive

evidence

At Voltana

Risks at the financial statement level

The new system, and the pressure on revenue

The partner's overall responses

The most experienced senior assigned to revenue

An IT specialist and an engineer involved

More year-end testing than in past years

ADVANCED AUDIT AND ASSURANCE | M2 | 2.8 | STUDENT COMPANION

1

Accounting Ahead | Original study resource | accountingahead.com.au

Tests of controls and substantive procedures

Tests of controls

Evaluate whether controls operated effectively throughout

the period

Required when the risk assessment expects controls to work,

so the auditor intends to rely on them

Required when substantive procedures alone can't give

enough evidence, as in highly automated processes with no

paper trail

Substantive procedures

Look directly for material misstatements: tests of details and

substantive analytical procedures

Always required for every material balance, class of

transactions or disclosure, whatever the risk assessment

On every audit: agree the statements to the underlying

records, and examine the material journal entries and

adjustments made in preparing them

Good controls reduce substantive work; they never remove it

Risk assessment is a judgement that might be wrong, and controls have limits, such as override and collusion

If a control works perfectly, can substantive work stop? No. The risk assessment is a judgement that might

be wrong, and controls have inherent limits, including override and collusion, so every material item still needs

some substantive evidence. Good controls reduce the amount; they never remove it. Two substantive

procedures are required on every audit regardless: agreeing the financial statements to the underlying records,

and examining the material journal entries and adjustments made while preparing them.

Significant risks: the special rules

At Voltana, revenue cut-off and occurrence (with the presumed fraud risk and the June spike) and the warranty

provision (with its wide range) are both significant risks.

Rule Why

Substantive procedures that respond specifically to the

risk

General procedures may miss the way this particular

misstatement would happen

If relying on substantive procedures alone, they must

include tests of details

Analytical procedures alone rarely give enough evidence

for the riskiest items

Controls relied on over a significant risk must be tested in

the current period

Evidence from earlier audits isn't enough

ADVANCED AUDIT AND ASSURANCE | M2 | 2.8 | STUDENT COMPANION

2

Accounting Ahead | Original study resource | accountingahead.com.au

Timing and extent

Choice What the standard expects

Testing at an interim date Efficient, but the remaining period to year end must then be covered by further

substantive procedures, either combined with tests of controls for that period or on their

own if they are enough. Tests of controls alone can't cover the gap

Higher risk Prefer testing at or near the year end

Extent Increases with risk: larger samples, or analytics over the whole population

Dual-purpose tests One procedure on the same document does both jobs: checking an invoice for

evidence of approval (a test of control) and agreeing its amount (a test for

misstatement)

Smaller entities. With few formal controls and little segregation of duties, testing controls is rarely efficient or

even possible, so the auditor usually takes a predominantly substantive approach: strong substantive analytics

where reliable data exists, and detailed testing of the material balances. The owner-manager's involvement can

strengthen some controls but raises the risk of override, which journal entry testing and a careful review of

unusual transactions address.

Voltana's risk-response plan

Risk Identified in Planned response

Revenue occurrence and

cut-off

Significant risk

2.6.1, 2.7.3 Match a sample of June sales to signed installation completion forms and customer acceptance;

examine every manual revenue entry posted near year end; test sales recorded in the two weeks

either side of 30 June; review credit notes and reversals issued after year end

Warranty provision

Significant risk

2.6.2 Develop the team's own range with the engineer; examine claims paid after year end; review last

year's estimate against what happened

Inventory 2.7.2 Attend the stocktakes; test the costing; compare carrying amounts with prices achieved after year

end, especially for older models

New system 2.5.2 Reconcile the migrated balances; test access and change controls in the new environment

Related parties 2.6.2 Inspect the lease and its approval; obtain the valuation evidence; check the disclosures

Going concern 2.6.3 Evaluate management's cash flow forecast and the bank's position on refinancing

Management override

Significant risk

2.6.1 Test journal entries; review estimates for bias; evaluate any unusual transactions

Every line traces back to a risk identified in this module

ADVANCED AUDIT AND ASSURANCE | M2 | 2.8 | STUDENT COMPANION

3

Accounting Ahead | Original study resource | accountingahead.com.au

Practice questions

MODULE 2 | 2.8 | TRY THESE BEFORE THE WORKED ANSWERS

Question 1 - A finance team that turned over

Corrowong Irrigation Ltd (imagined), a listed maker of irrigation systems for farms, lost its chief financial officer,

financial controller and both senior accountants between March and May, after a dispute with the new chief

executive. Contractors and two new hires closed the June accounts. Last year's audit relied on controls run by

the people who have left. Choose the overall responses you would make, and explain why.

ADVANCED AUDIT AND ASSURANCE | M2 | 2.8 | STUDENT COMPANION

4

Accounting Ahead | Original study resource | accountingahead.com.au

Question 2 - Are tests of controls required?

Situation Required? Why?

(a) A bank processes millions of card transactions

automatically, with no paper record, and the auditor can't

get enough evidence from substantive procedures alone

(b) A small retailer's owner does almost everything; a

fully substantive approach on the material balances will

give enough evidence

(c) To reduce sample sizes, the auditor's risk assessment

assumes the purchase authorisation control works

(d) Controls over a significant risk (valuing complex

derivatives) were tested last year and haven't changed;

the auditor wants to rely on them again

Question 3 - A significant risk in software revenue

Quillfeather Software Ltd (imagined) sells three-year contracts: a software licence delivered at the start, plus

three years of support and updates. Each year is invoiced in advance. Licence revenue is recognised on delivery

and support over time. Sales staff earn commission on total contract value, and several large contracts were

signed in the last week of June. Revenue is a significant risk: design the response.

Risk or assertion Procedure Why it responds to the risk

ADVANCED AUDIT AND ASSURANCE | M2 | 2.8 | STUDENT COMPANION

5

Accounting Ahead | Original study resource | accountingahead.com.au

Worked answers

MODULE 2 | 2.8 | WORKED ANSWERS - ATTEMPT THE QUESTIONS FIRST

Question 1 - Corrowong Irrigation (sample answer)

Emphasise scepticism. New people, an unfamiliar close and a boardroom dispute: errors are more likely, and

the departures themselves need explaining. Ask why they left and whether they disagreed with any accounting.

Assign experienced staff and more supervision. Put an experienced senior on the year-end close, journals

and estimates; more manager and partner review; specialists if system knowledge left with the staff.

Change the nature, timing and extent. Last year's reliance on controls no longer holds, so plan a mainly

substantive approach, more work at year end, larger samples, more external evidence, and a full review of

reconciliations and judgements prepared by the contractors.

Add unpredictability and discuss the plan with those charged with governance.

Question 2 - Tests of controls

Required? Why

(a) Yes Substantive procedures alone can't provide sufficient appropriate evidence

(b) No No reliance on controls is planned, and substantive procedures are enough

(c) Yes The risk assessment expects the control to work, so reliance must be supported

(d) Yes, this year Controls over a significant risk must be tested in the current period

Question 3 - Quillfeather Software (suggested)

Because revenue is a significant risk, the response must include tests of details; analytics alone won't do. If the

team relies on contract approval controls, it must test them this year, and it examines manual revenue journals

near year end.

Risk or assertion Procedure Why it responds

Occurrence and cut-off of

June contracts

For every large June contract, inspect the signed

contract and evidence the licence was delivered

by 30 June (activation or download logs);

confirm terms directly with customers

Commission and the late signings

create pressure to record licences

early or invent sales

Side agreements and

reversals

Ask sales staff and management about side

letters; review credit notes, cancellations and

refunds after year end

Hidden rights to cancel change when,

or whether, revenue can be

recognised

Accuracy of the split

between licence and

support

Test the stand-alone selling prices used and

recalculate the allocation for a sample

Shifting price to the licence brings

revenue forward

Deferred revenue Recalculate the support revenue earned and

deferred, and agree invoices billed in advance to

the deferred balance

Annual invoicing in advance must not

become revenue early

ADVANCED AUDIT AND ASSURANCE | M2 | 2.8 | WORKED ANSWERS

6