Responding to Risks at the Financial Statement Level

1. Financial Statement Level vs. Assertion Level Risks: A Critical Distinction

Before we can design a response, we must be absolutely clear about the type of risk we are addressing. In auditing, risks are assessed at two levels:

1. Financial Statement Level: These are risks that relate pervasively to the financial statements as a whole and potentially affect many assertions. Think of them as "big picture" problems.
2. Assertion Level: These are risks that relate to specific classes of transactions, account balances, or disclosures. They are more isolated.

Your articleship experience likely gave you a feel for this, but mastering the distinction is vital for exam purposes. To build a strong conceptual foundation, let's watch a video that uses a simple, effective analogy to explain this difference.

As the video explained, a financial statement level risk is one where you can't just "switch the light off" when you move from auditing sales to auditing inventory. The risk permeates the entire set of financial statements. Common examples that give rise to such risks include:

• A weak control environment (the "tone at the top" we discussed in the last lesson).
• Concerns about management's integrity or competence (like the incompetent "Bob" as Financial Manager).
• Significant business risks that create pressure on management, such as going concern issues or a lack of working capital.

When you identify such a risk, your response cannot be a single, isolated procedure. You need to change the overall approach to the audit.

2. Designing Overall Responses as per SA 330

SA 330 requires the auditor to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level. These are not detailed tests but high-level, strategic adjustments to the audit plan.

Let's look at what the standard prescribes. The following reading clearly lists these responses.

To structure this within the framework you'll see in your ICAI materials, we can see these responses as part of the overall "Risk Response" phase of a risk-based audit.

3. Connecting Risk to Response: A Practical Example

Let's bring this all together. Imagine you've identified a significant risk at the financial statement level: Management lacks integrity and has a reputation for being aggressive in meeting profit targets. This is a classic "tone at the top" problem, affecting the entire control environment.

How would you apply the overall responses from the LINK reading?

• Emphasise professional scepticism: You would brief your audit team, telling them not to take any management explanation at face value. Every piece of evidence needs to be critically evaluated and corroborated. The risk of management override of controls is high.
• Assign more experienced staff: You would staff the audit with senior team members, perhaps including a forensic specialist. You would not assign a junior trainee to audit a high-risk area alone.
• Change supervision and review: As the engagement partner or manager, you would increase your level of supervision. You would review working papers more thoroughly and sooner than on a low-risk audit.
• Incorporate unpredictability: You would alter the nature, timing, and extent of your procedures. For example, you might show up unannounced for the year-end inventory count or decide to test a different sample of transactions than in the prior year. This prevents management from knowing what you're going to look at and "preparing" for it.
• Make changes to the overall audit strategy:
  • You might lower performance materiality. This means you are setting a lower threshold for what you consider a significant error, making your audit more sensitive.
  • You would plan to perform more substantive procedures (detailed testing) and place less reliance on the entity's internal controls, as you can't trust them.
  • You would perform more of your work at or near the period-end rather than relying on interim testing, to reduce the risk of manipulation in the intervening period.

Notice how these responses are strategic. They don't specify which invoice to check, but rather they change the entire mindset, staffing, and intensity of the audit.

4. Overall Responses vs. Further Audit Procedures

SA 330 covers two types of responses. It's important to know the difference:

1. Overall Responses: The strategic actions we've discussed today, which address pervasive risks at the financial statement level.
2. Further Audit Procedures: These are the detailed tests of controls and substantive procedures that you perform to address risks at the assertion level.

This brief video introduction to SA 330 helps to position these two types of responses.

Today, our focus has been entirely on the first category: overall responses. In our next lesson, we will dive deep into the second category: further audit procedures.

Conclusion

In this lesson, we have focused on the auditor's strategic reaction to significant, pervasive risks. We've seen that when a risk threatens the integrity of the financial statements as a whole, the response must also be holistic, affecting the entire audit approach.

Key Takeaways:

• Risks at the financial statement level are pervasive, often stemming from a weak control environment or issues with management's integrity. They cannot be isolated to a single account or assertion.
• In response, SA 330 requires the auditor to design and implement overall responses.
• These responses are strategic adjustments to the audit, including:
  • Increasing professional scepticism.
  • Assigning more experienced staff.
  • Enhancing supervision and review.
  • Incorporating unpredictability.
  • Modifying the overall audit strategy (e.g., changing materiality or the mix of tests).

Preview of the Next Lesson

We have now covered how to respond to risks at the financial statement level. But what about the more specific risks, like the risk of inventory obsolescence or the risk of incomplete revenue?

In our next lesson, we will address the second part of SA 330. We will learn how to design and perform further audit procedures (tests of controls and substantive procedures) at the assertion level in response to assessed risks. This will take us from high-level strategy to the detailed testing that forms the core of audit fieldwork.