CHAPTER 4
RISK ASSESSMENT

Answers to Review Questions

1. Audit risk is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated. Engagement risk is the risk that the auditor is exposed to financial loss or damage to his or her professional reputation from litigation, adverse publicity, or other events arising in connection with financial statements audited and reported on. In simple terms, audit risk is the risk that an auditor will issue an unqualified opinion on materially misstated financial statements, while engagement risk relates to the auditor's exposure to financial loss and damage to his or her professional reputation.

2. Inherent risk and control risk differ from detection risk in that inherent risk and control risk exist independent of the audit; that is, the levels of inherent risk and control risk are functions of the client and its environment. The auditor has little control over these risks. The auditor can control detection risk through the scope (nature, timing, and extent) of the audit procedures performed. Thus, detection risk has an inverse relationship with inherent risk and control risk.

3. Standard setters developed the audit risk model as a planning and evaluation tool. Therefore, the model is only as good as the judgments and assessments used as inputs. Following are some limitations. First, since the auditor assesses inherent risk and control risk, such assessments may be higher or lower than the actual inherent risk and control risk that exist for the client. Second, the audit risk model does not consider the possibility of nonsampling risk (auditor error in assessing risk, choosing audit procedures, and evaluating results).

4. Sampling risk refers to the fact that, in many instances, the auditor does not examine 100 percent of the class of transactions or account balance. Since only a subset of the population is examined, it is possible that the sample drawn is not representative of the population and a wrong conclusion may be made on the fairness of the account balance. Professional judgment errors (nonsampling risk) occur because an auditor may use an inappropriate audit procedure, fail to detect a misstatement when applying an appropriate audit procedure, or misinterpret an audit result.

5. In understanding the entity and its environment, the auditor gathers knowledge about: (1) the nature of the entity; (2) industry, regulatory, and other external factors; (3) objectives strategies, and business risks; (4) entity performance measures; and (5) internal control.

6. Some examples of conditions and events that may indicate the existence of business risks are: • Significant changes in the entity such as large acquisitions, reorganizations, or other unusual events. • Significant changes in the industry in which the entity operates. • Significant new products or services or significant new lines of business. • New locations. • Significant changes in the IT environment. • Operations in areas with unstable economies. • High degree of complex regulation.

7. A company that operates in the coal mining industry faces numerous business risks. The following are selected business risks disclosed by Arch Coal, Inc. – the second largest coal producer in the United States.

General Risks:

• Coal prices are subject to change and a substantial or extended decline in prices could materially and adversely affect our profitability and the value of our coal reserves. • Our coal mining operations are subject to operating risks that are beyond our control, which could result in materially increased operating expenses and decreased production levels and could materially and adversely affect our profitability. • Competition within the coal industry could put downward pressure on coal prices and, as a result, materially and adversely affect our revenues and profitability. • Decreases in demand for electricity resulting from economic, weather changes or other conditions could adversely affect coal prices and materially and adversely affect our results of operations. • The use of alternative energy sources for power generation could reduce coal consumption by U.S. electric power generators, which could result in lower prices for our coal. Declines in the prices at which we sell our coal could reduce our revenues and materially and adversely affect our business and results of operations. • Disruptions in the quantities of coal produced by our contract mine operators or purchased from other third parties could temporarily impair our ability to fill customer orders or increase our operating costs. • Our profitability depends upon the long-term coal supply agreements we have with our customers. Changes in purchasing patterns in the coal industry could make it difficult for us to extend our existing long-term coal supply agreements or to enter into new agreements in the future.

Risks Related to Environmental, Other Regulations and Legislation:

• Extensive environmental regulations, including existing and potential future regulatory requirements relating to air emissions, affect our customers and could • reduce the demand for coal as a fuel source and cause coal prices and sales of our coal to materially decline. • Our failure to obtain and renew permits necessary for our mining operations could negatively affect our business. • Federal or state regulatory agencies have the authority to order certain of our mines to be temporarily or permanently closed under certain circumstances, which could materially and adversely affect our ability to meet our customers’ demands. • Extensive environmental regulations impose significant costs on our mining operations, and future regulations could materially increase those costs or limit our ability to produce and sell coal.

8. Known misstatements are factual misstatements about which there is no doubt. For example, an auditor may test a sales invoice and determine that the prices applied to the products ordered are incorrect. Once the products are correctly priced, the amount of misstatement is known. In such cases, the auditor knows the exact amount of the misstatement.

Likely misstatements are misstatements that • Arise from differences between the auditor’s judgments concerning accounting estimates and management’s estimates that the auditor considers unreasonable or inappropriate. • The auditor considers likely to exist based on a projection of misstatements identified in an audit sample.

9. Misstatements can result from errors or fraud. The term errors refers to unintentional misstatements of amounts or disclosures in financial statements. The term fraud refers to an intentional act by one or more among management, those charged with governance, employees, or third parties, involving the use of deception to obtain an unjust or illegal advantage. Thus, the primary distinction between errors and fraud is whether the misstatement was intentional or unintentional. Unfortunately, it is often difficult to determine intent. For example, the auditor detects a misstatement in an account that requires an estimate, such as bad debt expense; it may be difficult to determine whether the misstatement was intentional. 10.

Examples of misstatements due to errors or fraud include: • An inaccuracy in gathering or processing data from which financial statements are prepared. • A difference between the amount of a reported financial statement account and the amount that would have been reported under GAAP. • The omission of a financial statement element, account, or item. • An incorrect accounting estimate arising from an oversight or misinterpretation of facts.

11. The auditor performs the following steps to identify the risks of material misstatement due to fraud: • Discussion among the audit team members regarding the risks of material misstatement due to fraud. • Inquire of management and others about their views on the risks of fraud and how it is addressed. • Consider any unusual or unexpected relationships that have been identified in performing analytical procedures in planning the audit. • Understand the client’s period-end closing process and investigate unexpected period-end adjustments.

12. There are numerous risk factors that can cause an individual to misappropriate assets, such as cash (see Table 4-7). By requiring that an individual take a vacation, another individual will perform that person’s duties. If some type of misappropriation is taking place, there is a strong probability that the misappropriation will be detected. Such a policy is particularly helpful in a small business that does not have sufficient personnel to provide total segregation of duties or where there is poor oversight by personnel responsible for the asset.

13. If Jackal determines that a number of the risks of material misstatements are pervasive to the overall financial statement, he should reconsider the overall audit approach and respond to such pervasive by • Emphasizing to the audit team the need to maintain professional skepticism in gathering and evaluating audit evidence. • Assigning more experienced staff or those with specialized skills or using specialists. • Providing more supervision. • Incorporating additional elements of unpredictability in the selection of audit procedures to be performed.

Answers to Multiple-Choice Questions

|4-13 |d | |4-18 |c |
|4-14 |a | |4-19 |c |
|4-15 |c | |4-20 |b |
|4-16 |a | |4-21 |a |
|4-17 |c | |4-22 |a |

Solutions to Problems

23. a. Audit risk is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated.

b. Inherent risk is the susceptibility of an assertion about a class of transactions, account balance, or disclosure to a misstatement could be material, either individually or when aggregated with other misstatements, before consideration of any related controls. Control risk is the risk that a misstatement could occur in an assertion about a class of transactions, account balance, or disclosure that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control. Detection risk is the risk that the procedures performed by the auditor to reduce audit risk to an acceptably low level will not detect a misstatement that exists that could be material, either individually or when aggregated with other misstatements.

c. Inherent risk and control risk differ from detection risk in that they exist independently of the audit of financial statements, whereas detection risk relates to the auditor's procedures and can be changed at the auditor's discretion. Detection risk has an inverse relationship to inherent and control risk.

26. a. A public offering would increase the auditor’s exposure to third party litigation and would, therefore, reduce acceptable audit risk relative to a private company audit client. b. Bankruptcy increases the auditor’s reputation and litigation risk and would, therefore, reduce acceptable audit risk relative to a private company audit client. c. Significant changes to accounting information systems would typically increase control risk, but would have no effect on the acceptable audit risk relative to a private company audit client.

28. a. Two factors are particularly important in assessing the risk of material misstatement for Johnson, Inc. First, one individual, who also has majority control of the stock, dominates the decision making in the company. This factor should lead to a higher assessment for the risk of material misstatement because there is no review of important decisions and actions may be taken that are not in the best interest of the company or its stockholders. Second, Johnson, Inc. is expanding rapidly throughout the southeast. Such expansion may result in material misstatements since decision-making may become decentralized without adequate internal control. The increase in the risk of material misstatement due to these two factors will result in a lower determination of detection risk and an increase in the scope of the auditor's work.

b. The factors affecting the assessment of the risk of material misstatement for MaxiWrite Corporation all relate to industry characteristics. First, the industry is very competitive, which can lead to price-cutting and its related effects on revenues. Second, the industry is affected by changes in technology, and MaxiWrite is not one of the industry leaders in technology. Its products usually are not competitive with the industry leaders in terms of performance. Third, the company is not as profitable or financially strong as the major companies in the industry. The industry factors result in an increased assessment of the risk of material misstatement for MaxiWrite Corporation, leading to a lower determination of detection risk and more substantive tests.

c. The risk of material misstatement should be increased for the First National Bank of Pond City for the following reasons. First, the audit firm has been the bank's auditors for only two years. Second, there have been contentious accounting issues related to loan loss reserves and the value of collateral. Third, prior audits have indicated the presence of misstatements in the loan loss reserve. Based on these risk factors, detection risk should be set lower and increased substantive tests performed.

29. a. An auditor is responsible for obtaining reasonable assurance that the financial statements as a whole are free from material misstatements, whether caused by error or fraud.

b. Three conditions are generally present when material misstatements due to fraud occur: 1. Management or other employees have an incentive or are under pressure that provides a reason to commit fraud. 2. Circumstances exist that provide an opportunity for a fraud to be carried out. 3. Those involved are able to rationalize committing a fraudulent act. Some individuals possess an attitude, character, or set of ethical values that allow them to knowingly and intentionally commit a dishonest act.

c. The objectives of the brainstorming meeting are to: • Share insights about the entity and its environment and the entity’s business risks. • Provide an opportunity for the team members to discuss how and where the entity might be susceptible to fraud. • Emphasize the importance of maintaining professional skepticism throughout the audit regarding the potential for material misstatement due to fraud.

d. The documentation should include: • The risks identified, an evaluation of management’s response to such risks, and the auditor’s assessment of the risk of error or fraud after considering the entity’s response. • The nature, timing, and extent of the procedures performed in response to the risks of material misstatement due to fraud and the results of that work. • Fraud risks or other conditions that caused the auditor to believe that additional audit procedures or other responses were required to address such risks or other conditions. • The nature of communications about error or fraud made to management, the audit committee, and others.