CPA Exam AUD: Audit Planning and Risk Assessment Explained

Audit Planning and Risk Assessment: A Complete CPA Exam Guide

Audit planning and risk assessment form the foundation of every audit engagement. On the CPA AUD exam, you can expect multiple questions testing your understanding of how auditors plan their work, assess risks, and design audit procedures accordingly. This topic is governed primarily by AU-C Section 300 (Planning an Audit) and AU-C Section 315 (Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement).

The Audit Risk Model

The audit risk model is central to audit planning. Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. The model is expressed as:

Audit Risk (AR) = Inherent Risk (IR) x Control Risk (CR) x Detection Risk (DR)

Inherent risk is the susceptibility of an assertion to a material misstatement, assuming no related controls. Some accounts are inherently riskier than others. For example, complex financial instruments carry higher inherent risk than prepaid insurance. Control risk is the risk that a material misstatement will not be prevented or detected on a timely basis by the entity's internal controls. Detection risk is the risk that the auditor's procedures will not detect a material misstatement that exists. This is the only component the auditor can directly control.

The auditor sets an acceptable level of audit risk (typically low) and then assesses inherent and control risk to determine the acceptable level of detection risk. When inherent and control risks are assessed as high, the auditor must reduce detection risk by performing more extensive substantive procedures.

Preliminary Engagement Activities

Before diving into detailed planning, auditors perform preliminary engagement activities. These include evaluating compliance with ethical requirements (including independence), establishing that the terms of the engagement are agreed upon, and determining whether to accept or continue the client relationship. The engagement letter formalizes the terms and should be agreed upon before the audit begins. It specifies the objective and scope of the audit, the responsibilities of both the auditor and management, and the applicable financial reporting framework.

Developing the Overall Audit Strategy

The overall audit strategy sets the scope, timing, and direction of the audit. Key considerations include the characteristics of the engagement (such as the financial reporting framework used), the reporting objectives (including any reporting deadlines), significant factors that determine the focus of the engagement team's efforts, and the results of preliminary engagement activities. The audit strategy also considers the nature, timing, and extent of resources necessary to perform the engagement, including whether specialists will be needed.

The Audit Plan

The audit plan is more detailed than the overall strategy. It includes a description of the nature, timing, and extent of planned risk assessment procedures, the nature, timing, and extent of planned further audit procedures at the assertion level, and other planned audit procedures required to comply with GAAS. The plan should be updated and changed as necessary during the course of the audit as the auditor obtains new information.

Understanding the Entity and Its Environment

Under AU-C 315, auditors must obtain an understanding of the entity and its environment, including its internal control, to identify and assess the risks of material misstatement. This understanding encompasses the entity's nature (its operations, ownership, governance, investments, and structure), the applicable financial reporting framework, the entity's objectives and strategies, and the measurement and review of financial performance. Industry conditions, regulatory factors, and other external factors also play a critical role in this assessment.

Risk Assessment Procedures

Risk assessment procedures are performed to obtain the understanding needed to identify risks of material misstatement. These procedures include inquiries of management and others within the entity, analytical procedures (such as comparing current-year data to prior years or industry benchmarks), and observation and inspection. These procedures alone do not provide sufficient appropriate audit evidence on which to base the audit opinion, but they inform the design of further audit procedures.

Identifying and Assessing Risks of Material Misstatement

After performing risk assessment procedures, the auditor identifies risks of material misstatement at both the financial statement level and the assertion level. Financial statement level risks are pervasive and may affect many assertions. For example, a weak control environment or going concern issues affect the financial statements broadly. Assertion level risks relate to specific classes of transactions, account balances, or disclosures. The auditor must also determine whether any identified risks are significant risks, which require special audit consideration.

Significant Risks

Significant risks are those that require special audit consideration. In identifying significant risks, the auditor considers the nature of the risk, the magnitude of the potential misstatement, the likelihood of the risk occurring, and whether the risk involves significant transactions with related parties, significant judgments, or significant transactions outside the normal course of business. Revenue recognition is presumed to be a fraud risk under AU-C 240 and is often treated as a significant risk. For significant risks, the auditor must obtain an understanding of the entity's controls relevant to that risk and perform substantive procedures specifically responsive to the assessed risk.

Materiality in Planning

Materiality is determined during planning and affects the nature, timing, and extent of audit procedures. The auditor establishes materiality for the financial statements as a whole and also determines performance materiality, which is set at an amount less than overall materiality to reduce the probability that uncorrected and undetected misstatements in aggregate exceed overall materiality. The determination of materiality requires professional judgment and is influenced by the auditor's perception of the financial information needs of users of the financial statements.

Exam Tips for Audit Planning and Risk Assessment

• Remember that detection risk has an inverse relationship with inherent and control risk. As assessed inherent and control risk increase, acceptable detection risk decreases.
• The overall audit strategy is broader and less detailed than the audit plan.
• Risk assessment procedures are not substantive procedures; they inform the design of substantive procedures.
• Significant risks always require substantive procedures; analytical procedures alone are not sufficient for significant risks.
• Materiality is based on professional judgment and can be revised during the audit if necessary.