4020 Risk Assessment

Jul-2020

Risk is defined here as the likelihood of an event influencing the achievement of an objective. Risk assessment is a continuous, dynamic process of gathering, updating, and analyzing information throughout the audit.

What CSAE 3001 Means for Conducting the Audit

In a direct assurance engagement, the audit team decides on the nature and scope of the underlying subject matter to be reported on. This decision is based on an understanding of the subject matter, including risks and relevant internal controls (OAG Audit 4010 Understanding the subject matter in planning an audit; OAG Audit 4025 Internal controls). In understanding the subject matter, the audit team is required by standards to identify and assess, in the planning phase, the risk that the underlying subject matter contains significant deviations (i.e., negative audit findings) with applicable criteria. The audit team uses this information to form the basis of its approach to conducting the audit and obtaining reasonable assurance to support its conclusion. Furthermore, the audit team is required by standards to reduce the engagement risk to an acceptably low level to achieve reasonable assurance (which is standard practice for OAG audits).

Although significant risks are initially considered in the planning phase of the audit, they may be identified at any stage of the audit.

Audit standards require that the team stay alert to changing circumstances and reconsider the impact of new and conflicting information on its risk assessments and modify its response accordingly.

The assessment of risks is a matter of professional judgment, rather than a matter capable of precise measurement (see OAG Audit 1042 Applying professional judgement). Maintaining professional skepticism (see OAG Audit 1041 Applying professional skepticism) throughout the engagement is also necessary if the audit team is, for example, to reduce the risks of

• overlooking unusual circumstances;

• overgeneralizing when drawing conclusions from observations; and

• using inappropriate assumptions in determining the nature, timing, and extent of the procedures, and evaluating the results thereof.

Also, to properly document the nature and extent of the audit work performed, auditors need to demonstrate how evidence gathered through risk assessment and the work performed on internal control links to the scope and approach of the audit. To facilitate this process and document its decisions, the audit team completes the relevant audit procedures along with the following tools:

• Engagement Risk Assessment Template (ERAT)
• Functional Risk Identification Template (FRIT)
• Risks and Controls Assessment Template (RCAT)
• Audit Logic Matrix (ALM)

For more information, refer to the Guide on risk-based planning and scoping for direct engagements listed below under Audit Guidance.

Assessing Subject Matter Risks

In planning, the audit team identifies and assesses the significant risks that may affect the achievement of an entity’s objectives as they relate to the subject matter being audited.

The audit team identifies and assesses these risks in order to identify areas where there is a higher risk of significant deviation in the audit (i.e., negative audit findings).

Because risk is an event influencing the achievement of an objective, the first step in identifying subject matter risks is to understand and identify the entity’s objective(s) as they pertain to the subject matter of the audit and then think about what could go wrong that could prevent the achievement of those objectives.

To identify and assess subject matter risks, two templates have been developed to assist audit teams:

• Functional Risk Identification Template (FRIT)
• Risk and Control Assessment Template (RCAT)

The Office has identified several key functional areas (for example, human resources or information technology) that may be susceptible to risk and jeopardize the achievement of the entity’s objectives. The risks associated with these functional areas are to be considered by all audit teams. Other risks pertinent to the subject matter under audit must also be identified and assessed. Taken together, any functional risks identified and any specific subject matter risks identified will allow the audit team to understand what may prevent the achievement of the entity’s objectives and therefore help to focus the audit work.

Functional Risk Identification Template. The audit team considers the relevance of key functional areas based on its preliminary understanding of subject matter objectives, and identifies and assesses these risks by completing the Functional Risk Identification Template. This process triggers the team to consider consulting with relevant internal specialists (see OAG Audit 3081 Consultations). Consultation serves two purposes. It allows the audit team to discuss the significant risks identified with the Internal Specialists and how these risks may affect the approach and scope of the audit. It also signals to the internal specialists that the audit team may need to obtain additional guidance and assistance during the audit, given the risk identified.

While most consultations are optional, based on the professional judgment of the engagement leader, the audit team must consult with the Internal Specialist for the Environment and Sustainable Development and obtain sign-off in the audit file. The Internal Specialist, Environment and Sustainable Development, may also require the team to complete a further assessment. If consultation takes place with other internal specialists, the audit team should document the results of the consultation.

Risk and Controls Assessment Template. The audit team uses the Risk and Controls Assessment Template to identify any risks pertinent to the subject matter of the audit and also brings forward any functional risks identified on the FRIT. Taken together, these risks are now considered the subject matter risks. The audit team then assesses all risks identified, and based on the assessment, determines and documents its preliminary scoping decisions.

The audit team may assess the importance of, and risks associated with, the entity’s activities by considering factors such as:

1. Economic, social, and environmental impact—Programs, activities, or processes affecting a large segment of the population or vulnerable populations, or which impact environmental sustainability, may be considered to be more important to the entity. The significance of the subject matter can also be assessed by the high economic, health, security, or safety implications; the size of the relevant entity or program; the number of entities scoped into the engagement; and the Office’s past experience reporting on the subject matter.

2. Relevance to stakeholders—The interest shown by the legislature or other governing bodies, by management of the entity or by the public may indicate the importance of the activity to stakeholders. Factors such as the sensitivity and visibility of the subject matter (e.g., the accountability relationship of the entity, the importance of its mandate, the degree the entity or program is visible in the public eye and recent parliamentary interest in the subject matter) should also be considered.

3. Diversity, consistency and clarity of the entity's objectives and goals—Diverse or inconsistent objectives increase the risk that the entity’s activities or programs are not operating with due regard to one or more of the principles of economy, efficiency, effectiveness and environment and sustainable development. Entity objectives and goals that are not clearly defined may increase the risk that they will not be achieved because they are not understood by employees.

4. Complexity of operations—An increase in the complexity of an entity's operations, through increased variety and type of programs, functions and activities may increase the risk that the entity does not achieve its objectives and goals or that they are not achieved efficiently, economically or with due regard to the environment or sustainability. The nature of the entity’s operations, such as the existence of complex and specialized transactions or issues that are highly technical and require significant professional judgment to evaluate; and multiple entities with shared and overlapping responsibilities, may increase the risk.

5. Complexity and quality of management information and control systems—Complex systems may be more difficult to develop, enhance and maintain. When adequate management information systems are not maintained, proper control may not be exercised.

6. Impact of environmental or organizational change—Changes in an entity’s environment or organization can impact the continuity of operations and the understanding of priorities and processes by employees. This may increase the risk that the entity’s goals and objectives will not be achieved. Environmental changes include new government priorities, significant budget amendments and changes to enabling legislation. Organizational changes include changes in leadership, reorganization, new initiatives and staff turnover.

7. Financial magnitude and nature of transactions—Large dollar amounts, high transaction volumes and transaction complexity and flow may create increased risks to the entity.

8. Management response to previously identified deficiencies – Areas where management has not made adequate improvements to address important issues raised in prior performance audits or other studies may be more important and higher risk.

9. Organizational structure—Centralization and decentralization of key activities such as budgeting, payroll, disbursements, human resources management and facilities management each create their own operational risks. Similarly, program delivery through agents carries different risks than those associated with direct program delivery.

10. Program delivery method—Programs in the public sector may be delivered by policy instruments such as expenditure, regulation and revenue-raising; may provide goods or services directly or may redistribute income; and may be delivered directly or by using agents. The amount of associated risk may vary depending on the delivery method.

The audit team assesses identified risks as either normal, elevated, or high. The default level is normal unless a risk is considered to be higher. In assessing the risks, the team should consider the likelihood (or probability) of the risk occurring and the impact (or significance) if it were to occur. Assessing risk requires professional judgment. The following matrix presents factors to help the audit team determine the likelihood and impact when assessing the subject matter risk. The audit team then uses the assessment to rank the risks identified. The audit team documents and summarizes briefly its rationale for the risk rating of each risk. How each risk stands in relation to the other risks is often a key consideration.

In identifying and assessing risk, the audit team also needs to understand the internal controls relevant to the subject matter. This understanding helps the auditor identify factors that may reduce the risk and provides a basis for designing procedures. OAG Audit 4025 Internal Controls discusses the requirements related to the assessment of internal controls in the planning phase.

Managing Engagement Risk

Engagement risk. Engagement risk is the risk that the auditor expresses an inappropriate conclusion in the audit report. It is the risk that the auditor identifies a significant deviation (i.e., a negative audit finding) when one does not exist, or the risk that the auditor does not identify a significant deviation when one does exist.

Audit standards describe engagement risk as being made up of three components, although the extent of these and their importance will vary with the circumstances of the audit.

• Inherent risk: risk related to the susceptibly of the subject matter and its environment before the consideration of controls; for example, susceptibility to the current economic or political environment.

• Control risk: risk that a significant weakness exists related to the subject matter that will not be prevented, detected, or corrected on a timely basis by the entity management’s internal controls. This risk is a function of the design and effectiveness of the internal controls relevant to the subject matter. The auditor does not directly influence this risk.

• Detection risk: risk that audit procedures will not result in sufficient appropriate audit evidence that is interpreted appropriately by the auditor (e.g. using inappropriate auditing procedures, misapplying procedures, and misinterpreting audit results). It is a function of the effectiveness of the auditors’ procedures.

The audit team does not directly influence the first two components (inherent and control risk), but seeks to understand them when assessing the subject matter risks. This helps the team properly inform its assessment of detection risk and develop audit procedures to minimize it.

Managing engagement risk. Engagement risk is unavoidable because auditors cannot obtain absolute assurance that their audit conclusion is appropriate without examining 100 percent of all relevant information or activities relevant to the subject matter and the audit objective. However, audit teams plan and perform the audit so that engagement risk will be limited to an acceptably low level that is, in their professional judgment, appropriate for expressing an opinion against the audit objectives and managing the risk of an inappropriate conclusion.

Factors affecting engagement risk include

• management integrity;

• the availability of enough quality information;

• complexity of the subject matter, as well as the specific audit approach and testing strategies proposed (e.g., complicated modelling, quantitative analysis);

• audit team (people);

• the Office’s past experience and relationship with the entity(ies) (e.g., recent history of difficult or contentious engagement issues, including disagreements with management, negative conclusions in previous reports, reservations in previous opinions and reports, or access issues);

• team availability, capacity, and competence (e.g., the composition of the engagement team, such as a newly appointed audit principal, significant turnover in the engagement team, or the team’s limited experience with the objectives or subject matter, and/or competence in required assurance skills and techniques);

• timeframes, schedules, and resources (e.g., shorter timeframes, smaller budgets, lack of dollars for contracting external expertise, production conflicts; extensive travel can increase audit risk);

• the extent of professional judgment and expertise required by the engagement team in order to assess risks of significant deviations in the subject matter;

• sensitivity, visibility, or significance of the subject matter; and

• any other specified risk factors, such as known and potential threats to the Office’s independence.

Engagement Risk Assessment Template. At the start of the audit, the engagement leader is responsible for identifying and assessing engagement risk and identifying any specific mitigation strategies required. The Engagement Risk Assessment Template is used to document this assessment. Engagement risks are assessed as normal, elevated, or high. The default level is normal until a risk is assessed as higher. In assessing the risk, the engagement leader considers the likelihood (or probability) of the risk occurring and the impact (or significance) on his/her ability to provide a reasonable assurance conclusion. Assessing risk requires professional judgment. The rationale for the risk ratings should be documented.

Mitigating the risk of an incorrect conclusion. The Office’s standard quality control and procedures for planning, executing, and reporting an audit are designed to ensure that auditors gather sufficient appropriate evidence and, hence, reduce the likelihood of inappropriate conclusions.

Reducing engagement risk to an acceptable level is achieved by proper planning to develop an appropriate audit approach (see OAG Audit 4042 Audit scope and approach). It is also managed by ensuring adequate supervision and reviewing audit work, as well as implementing various quality control processes.

Mitigation strategies are tailored to the engagement circumstances and may include

• involving various experts either internal or external to the Office (see OAG Audit 2070 Use of experts);

• enhancing the involvement of senior management (i.e., the assistant auditor general and/or the Auditor General. See also OAG Audit 2040 Discussions with the Auditor General);

• convening advisory committees (see OAG Audit 2050 Advisory Committee meetings); and/or;

• implementing other strategies such as specialized training, enhanced team supervision and review, or specific entity relation protocols.

If the risk of an inappropriate conclusion is assessed as higher than normal, the engagement leader may also recommend appointing a quality reviewer (see OAG Audit 1081 Selection of engagement quality control reviews and appointment of quality reviewers).

Some controls may offset the need for others. For example, if the audit team is experienced and the audit subject matter is well defined, there may be no need for external advisors at the planning phase.

The audit team considers the impact of engagement risk in making their audit scope and approach decisions as well as in developing the nature and extent of the audit procedures required. The audit team describes how audit work is designed to address the engagement risks in the audit logic matrix (ALM). In the ALM, the audit team sets out the audit design including evidence-gathering techniques, the information and sources required along with associated limitations. Consideration of the limitations is done to help the audit team ensure it gathers sufficient appropriate evidence to minimize the risk of forming an incorrect conclusion. The quantity of evidence needed is affected by the risks of the underlying subject matter containing a significant deviation and the engagement risk. The higher the risks, the more evidence is likely to be required. The quantity of evidence is also affected by the quality of such evidence (the higher the quality, the less may be required). The ALM is discussed in OAG Audit 4044 Developing the audit strategy: audit logic matrix. Evidence-gathering methods are discussed in OAG Audit 4045 Evidence-gathering methods.

Revision of Risk Assessment

The audit team monitors the risks affecting the subject matter and the engagement throughout the audit. The audit team is required to re-assess the risks if there is a significant change in circumstances that could alter the original assessment. The engagement risk assessment and team’s mitigation strategies are updated at the end of the planning stage to support the engagement leader’s assertion at the examination approval stage (OAG Audit 4080 Examination approval) that significant engagement risks have been assessed and updated, and that  ways to mitigate them have been identified, implemented, and documented. Engagement risk is also considered as the audit team forms its audit conclusion and evaluates the sufficiency and appropriateness of audit evidence in support of its report. This assessment specifically informs the content and publication approval of the report (see OAG Audit 8017 Report content approval and date of the report).

Next Steps

The audit team uses the risk assessment to identify and assesses relevant key controls that mitigate the risks identified (OAG Audit 4025 Internal controls) which then helps the audit team inform its scope and approach decisions (OAG Audit 4042 Audit scope and approach).