SAS 145 Audit Risk Assessment
Just a Bit More
Well, let’s add a bit more about SAS 145, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement. And let’s do it in a question-and-answer format. This SAS is enormous – it’s over 250 pages long. Those in public accounting must understand its implications since understanding the entity, environment, and financial statement risks is the heart and soul of financial audits. An understanding of the risk of misstatements is what drives the remainder of the audit engagement. So, with that being said, let’s begin.
- Is SAS 145 principle-based, and is the methodology neutral?
Yes. The standard is principle and does not prescribe a particular way to accomplish the objectives. Accordingly, much is open to the auditor’s experience and professional judgment.
- Are there some specific vital concepts that must be understood to wrap your head around SAS 145?
Yes. Here are the ones that you must understand. Some are familiar concepts from the previous standard, and some are new.
Assertions -These are representations made by the entity’s management (explicit or otherwise) about amounts and disclosures in their financial statements.
Inherent Risk -SAS 145 states that inherent risk is the susceptibility of an assertion to a material misstatement. Inherent risk is determined before consideration of the entity’s control risk. The standard lists some inherent risk factors to be considered.
Control Risk -The risk that a potential misstatement in an assertion won’t be timely prevented or detected and corrected by the internal control system.
Relevant Assertion – An assertion with an identified risk of material misstatement (also known as a RMM).
Risk of a Material Misstatement – A RMM exists when there is a reasonable possibility of a material misstatement occurring. A RMM combines a reasonable possibility of occurrence and a reasonable possibility that if a misstatement occurs, it will be material. Said another way, a RMM means it’s reasonably possible that a misstatement can happen, and if it does, it’s reasonably possible it will be material.
Significant Class of Transactions, Account Balance, or Disclosure -It’s an audit area with at least one relevant assertion and, therefore, a significant audit area.
Identified Risk – An identified risk is another name for a RMM – except the risk of a misstatement has been specifically identified. It’s a known RMM.
Spectrum of Inherent Risk – The spectrum of inherent risk is the extent to which inherent risk varies – i.e., inherently from low to high risk.
Significant Risk – A significant risk is an identified risk of material misstatement at the higher end of the spectrum of inherent risk. In other words, it is a RMM on steroids.
Identified Controls – Identified controls are controls for which SAS 145 requires the auditor to evaluate the design and determine the implementation using procedures beyond inquiry.
- As a result of risk assessment, should every audit program be tailored to address the identified risks?
Yes. The primary purpose of risk assessment is to design procedures to address the risk identified. An unmodified one-size-fits-all audit program is suspect. It gives the impression that little thought was given to the linkage of identified risks to procedures that address those risks. Accordingly, unmodified programs may be a peer review finding.
- Are all material accounts considered a RMM?
No. A risk of material misstatement exists when:
- There is a reasonable possibility of a misstatement occurring, and
- There is a reasonable possibility it would be material if it did occur.
In other words, RMM equals Occurrence + Magnitude. Therefore, an account can be material but not have a RMM when there is no reasonable possibility of a misstatement, or if there is a reasonable possibility of a misstatement, there is no reasonable possibility it would be material.
- What does reasonable possibility mean?
Reasonable possibility means there is more than a remote chance of happening. It is based on inherent risk only, without regard to internal controls. Inherent risk is king.
- How does “reasonable possibility” align within GAAP’s risk progression?
Reasonable possibility is a low threshold. It progresses as follows:
Remote -> Reasonable possibility > More Likely Than Not > Probable > Reasonably certain.
Therefore, the risk of a material misstatement is only slightly more than a remote risk. It’s a low threshold.
- So, inherent risk is king? What are some of the inherent risk factors to be considered?
- Size, volume, and composition of items
- Susceptibility of theft or fraud
- Complexity
- Subjectivity
- Uncertainty
- Changes in business environment, operations, and personnel.
- Why are relevant assertions important?
Remember, a relevant assertion has a RMM attached to it. A significant audit area has at least one relevant assertion and, therefore, at least one risk of a material misstatement. Why is this important? Because substantive procedures must be applied to this area. Limited procedures are insufficient.
- Must you assess inherent risk and control risk for each account and each assertion?
- No. However, you must assess inherent risk and control risk for each identified RMM at the assertion level.
- If, as a matter of policy, an auditor assesses all control risks at maximum risk under SAS 145, must the combined RMM have the same assessment as the inherent risk assessment?
Yes. It’s the math. If control risk is assessed at 100%, and inherent risk is assessed at 50%, then the combined risk, mathematically, must equal 50%. (1.0 x .5 = .5 or 50%.)
- What is so significant about a significant risk?
Remember, a significant risk is a risk on steroids. It is located at the upper end of the spectrum of inherent risk. Therefore, the auditor must:
- Evaluate the design of the control (often done with narratives) and
- Determine if the control has been implemented (often done by walk-throughs.)
