Wiley Practitioner's Guide to GAAS 2020. Joanne M. Flood

      TECHNICAL ALERT

      Through the AICPA’s initiative on Enhancing Audit Quality (EAQ), data surfaced that indicated firms often fail to perform appropriate risk assessments and link those risk assessments to their audit procedures in compliance with AU-C Section 315 and AU-C Section 330. As a result, the AICPA Peer Review Board has developed stronger, more precise guidance. The Peer Review Board in its September 2018 Alert, as clarified in October 2018, announced an updated focus on risk assessment documentation and a new section in the Peer Review Manual, Evaluation of Non-Compliance with the Risk Assessment Standards. This new guidance is effective for peer reviews scheduled from October 2018 through September 2021.¹

The Alert emphasizes that reviewers should be alert to these areas of common non-compliance:

      Failure to Gain an Understanding of Internal Control

      According to the AICPA, 40% of identified issues related to failure to gain an understanding of internal control. Auditors must understand internal control in order to identify related risks and design proper responses. Auditors are reminded to:

      Auditors are cautioned that it is incorrect to think that AU-C 315.14 does not apply to an engagement where the client has no controls. Similarly, auditors are reminded that even when they do not plan to rely on internal control, defaulting to setting control risk at the maximum level is not permitted.

      Improperly Assessing Control Risk

      Improperly assessing control risk as less than high without appropriately testing controls accounted for 13% of the violations. Auditors are reminded not to reduce control risk to less than high without appropriately testing the relevant controls. Reducing control risk to less than maximum can only be done if the auditors have tested controls and are comfortable relying on their operating effectiveness.

      Insufficient Risk Assessment

      This risk comprises 14% of identified issues related to risk assessment. Failure to assess risk can result in over-auditing or worse, a failure to obtain sufficient appropriate audit evidence. The alert reminds auditors that:

      Failure to Link Procedures Performed to the Risk Assessment

      Of the most common risk assessment violations, 24% related to not linking risk assessment to auditors’ responses. The Alert reminds auditors to be responsive to the financial statement and relevant assertion level risks and that the linkage is at the assertion, not account, level. The AICPA discovered that auditors are not designing procedures with regard to the results of their risk assessment. Therefore, the risk is not reduced to an appropriate level, and the standards are not complied with.