What is a risk based audit and what is a risk based audit process

3 allThat is, when conducting audit work, first understand the internal and external environment of the audited object, and judge that it may make major mistakes.

Because the audit risk is affected by the inherent risk factors of the enterprise, such as the conduct and ability of the management personnel, the industry environment, the nature of the business, the accounting statement items that are prone to misstatement, the assets that are prone to loss or misappropriation, etc., and the risks caused by the internal control risk factors.

That is, the risk that there is a misstatement of the account balance or various transactions, and the internal control fails to prevent, detect or correct it, in addition, it is also affected by the failure of the CPA to implement the audit procedure to find the risk of misstatement of the account balance or various transactions, and the professional community quickly developed an audit risk model, that is: audit risk = material misstatement risk inspection risk.

The theory of the risk-based model is that sound internal controls reduce the probability of errors and fraud. The public also expects that enterprises should establish internal controls over top management concepts and business processes to prevent fraud. However, a large number of well-known cases of financial fraud have shown that fraud does not occur due to the inadequacy of the company's internal controls, but rather due to the failure of the internal controls to function as they should, due to the disregard or overstepping of the management.

With the complexity of the organizational form and economic business of the enterprise, the management of the audited entity is motivated by the profit of providing false accounting information. When an enterprise management commits fraud, it will take advantage of the power to formulate and operate the internal control system in its possession.

Deliberately cover up its signs of fraud. At this point, on the surface, its internal controls are still in place and functioning well, but in reality, the mutual checks required by internal controls are not only long gone, but may also mask the signs of fraud.

Basic process of risk-based audit:

Carry out preliminary business activities and determine the content of preliminary business activities.

Develop an overall audit strategy:

determine the scope of the audit;

Plan reporting objectives, timelines, and required communications;

Determine the direction of the audit;

Plan and deploy audit resources.

Develop a specific audit plan:

implementation of risk assessment procedures;

The risk assessment procedure refers to the audit procedure implemented by the CPA to understand the audited entity and its environment.

The risk assessment process emphasizes obtaining information from within the auditee to understand the auditee and its environment, identifying and assessing the risk of material misstatement in the financial statements.

The purpose of the risk assessment process implemented by a CPA is to identify and assess the risk of material misstatement of financial statements, including the risk of material misstatement at the financial statement level and the risk of material misstatement at the identification level.

implementation of further audit procedures;

"Further audit procedures" refers to the audit procedures implemented by the certified public accountants for the risk of material misstatement at the level of assessment of various types of transactions, account balances and disclosures, including:

1) Control test;

2) Substantive Procedure.

The two basic types of substantive procedures include detail testing and substantive analysis procedures.

Implement other audit procedures.

In risk-oriented auditing, risk and orientation mainly refer to the following:

The core idea of guiding the risk assessment of material misstatement and the entire audit process with a strategic and systematic view can be summarized as:

The audit risk is mainly the risk of material misstatement in the financial report of the enterprise, and the risk of misstatement is mainly the operational risk and fraud risk of the whole enterprise.

Difference between risk-based audit and traditional risk-based audit:

1. Different risk assessment orientation: Although the International Standards on Auditing stipulate that traditional risk-oriented audits should take inherent risks as the starting point, in practice, traditional risk-oriented audits are actually risk-controlled.

2. Different scope of risk assessment: Auditors often ignore the accurate assessment of inherent risks when using traditional risk-oriented audits in practice.

3. Different risk assessment procedures: Compared with traditional risk-oriented audits, modern risk-oriented audits increase the analysis of corporate strategies and business processes, as well as the assessment of operational risks.

Risk refers to the risk of material misstatement, and orientation refers to the strategic and systematic view. 62616964757a686964616fe4b893e5b19e31333433663063

Traditional model. Because the audit risk is affected by the inherent risk factors of the enterprise, such as the conduct and ability of the management personnel, the industry environment, the nature of the business, the accounting statement items that are prone to misstatement, the assets that are easy to suffer losses or misappropriation, etc., and the risks caused by the internal control risk factors, that is, the risk that there is a misstatement in the account balance or various transactions, and the internal control fails to prevent, detect or correct the risk.

In addition, due to the failure of CPAs to implement audit procedures to identify the risk of misstatement of account balances or various types of transactions, the profession quickly developed an audit risk model, i.e., audit risk = material misstatement risk Check risk.

The emergence of the audit risk model theoretically solves the arbitrariness of CPAs' use of sampling audits on the basis of the system, and also solves the problem of allocation of audit resources, requiring CPAs to allocate audit resources to the areas that are most likely to lead to material misstatement of accounting statements.

The improvement of "Operational Risk Basis Audit" and "Audit through the Prism of Strategic Systems" inherits the concept of tilting the allocation of audit resources to areas prone to misstatement, and improves the method of assessing the risk of material misstatement in financial statements, so that CPAs can more comprehensively and correctly assess the risk assessment results and achieve audit objectives more effectively.

These new ideas do not negate the traditional risk-oriented audit thinking and audit risk model, but only deepen and develop the risk-oriented audit thinking in the new audit environment.

<> risk leading audit refers to the audit conducted by a certified public accountant based on the audit risk model, which is a special term for auditing. The core idea of guiding the risk assessment of material misstatement and the entire audit process with a strategic view and a systematic view can be summarized as follows: the audit risk is mainly the risk of material misstatement in the financial report of the enterprise, and the risk of misstatement is mainly the business risk and the risk of fraud in the whole enterprise.

Since the audit risk is affected by the inherent risk factors of the enterprise, such as the conduct and ability of the management personnel, the industry environment, the nature of the business, the accounting statement items that are prone to misstatement, the assets that are prone to loss or misappropriation, etc., and the risks caused by the internal control risk factors, that is, the risk that there is misstatement in the account balance or various transactions, and the internal control fails to prevent, detect or correct the risk. Affected by the failure of CPAs to implement audit procedures to find the risk of misstatement in account balances or various transactions, the professional community has been slow to develop an audit risk model, that is: audit risk = material misstatement risk Inspection risk.

Risk-oriented describes the type and amount of risk that the company will accept. Risk orientation is often compared to risk tolerance, which refers to the maximum amount of risk that a company can absorb.

A recent trend among companies is to use board-approved risk orientation to guide management and to inform investors through annual documents. However, what exactly is risk orientation in practice? This involves 2 points.

1.A statement about the risks that the company is willing to take in order to achieve its business objectives. Detailed risk-oriented statements, often internal documents approved by the board.

However, there are also some that take a weaker form, such as appearing in a company's annual report.

2。Connect the sum of the above-mentioned highest-level statements with the company's day-to-day risk execution management mechanisms. These mechanisms include the details of the company's risk policy, the description of business-specific risks, and the framework of the limits of key risk areas. High foci.

Risk-oriented, practical statements also need to be endorsed by the sensible hierarchy and require an appropriate broader set of risk-related signals that are disseminated to all employees of the company.

In the banking industry, the concept of prudent and simplified risk orientation is the focus of managers. The diagram depicts how a leading global bank defines its risk orientation and implements it into its work.

The trend is to make the company's risk orientation clearer, and to define the different types of risk that have been accepted, as well as to develop the terminology that links the tools used to quantify risk.

So, is the risk profile the maximum total risk that a company can afford to face without going bankrupt? Or, is it the total amount of risk that Zhaoxiao Hand Engraving is facing at this time? Or is it the total amount of risk that the company is willing to take at any given time?

In the table, the answer is the latter. Here, the risk profile is below the company's total risk tolerance and above the total amount of risk that the company is now disclosed.