Auditing – Study Notes Chapter 7 Risk Assessment

CHAPTER 7
RISK ASSESSMENT
ICAP Study Text
LO # LEARNING OBJECTIVE Para References

LO 1 INTRODUCTION TO RISK ASSESSMENT

LO 2 CONCEPT OF ASSERTIONS
Section 2 & 3
LO 3 TYPES OF RISKS (& AUDIT RISK MODEL) [Ch. # 3]
LO 4 RISK ASSESSMENT FROM GIVEN INFORMATION
LO 5 BUSINESS RISKS AND RELATED AUDIT RISKS
AUDIT APPROACH IN NOT-FOR-PROFIT ORGANIZATIONS Section 5
LO 6
(NFPO) [Ch. # 3]

Page | 53
 Auditing – Study Notes Chapter 7 Risk Assessment

LO 1: INTRODUCTION TO RISK ASSESSMENT:

Understanding the Entity and Its Environment
The auditor begins risk assessment by analyzing the entity and the environment in which it operates. This
includes:
• Industry, regulatory, and other external factors that influence the entity’s operations.
• Organizational structure, ownership, governance, and business model, including the extent to which
information technology is used.
• Performance measurement methods used internally by management and externally by stakeholders
to evaluate the entity’s results.

Understanding the Applicable Financial Reporting Framework

The financial reporting framework (AFRF) sets the rules for preparing the financial statements. The auditor
evaluates:
• The entity’s accounting policies and the reasons for any changes.
• Whether these policies comply with the AFRF.

Understanding Inherent Risk Factors

The auditor assesses how inherent risk factors affect each assertion.

This happens at 2 levels:

• Financial statement level: Risks that affect the financial statements as a whole, such as
management override of controls.
• Assertion level: Risks that relate to specific objectives, such as Completeness (i.e. whether all
liabilities are recorded) or Existence (i.e. whether reported assets actually exist).

Understanding the Entity’s System of Internal Control

The auditor evaluates whether these controls are properly designed and effectively implemented.

Documenting the Understanding and Risk Assessment

The auditor must document key aspects of the risk assessment process. Documentation includes:
• Significant discussions among the engagement team and the decisions reached.
• Key elements of the auditor’s understanding, including sources of information and procedures
performed.
• Evaluation of control design and whether controls are implemented.
• Identified and assessed risks at both financial statement and assertion levels.

EXAM CHEAT-SHEET
Scenario-Based Question Short Answer
Galaxy Pharma’s board and key operations are controlled by
Lack of independence and segregation of duties; risk of fraud
family members. What governance matters should auditors
or bias in decision-making.
consider?
Galaxy Pharma operates under strict pharmaceutical laws
Risk of fines or penalties for non-compliance; need to verify
and Good Manufacturing Practice requirements. What
compliance and disclosures.
regulatory matters should auditors consider?

Page | 54
 Auditing – Study Notes Chapter 7 Risk Assessment

Sky Adventure offers paragliding, scuba diving, and other Compliance with Laws, Provisions for
sports. After a weather accident causing injuries, it upgraded fines/penalties/damanges, Impairment of old equipment,
equipment using bank loans. What matters should auditors Capitalization of new equipment, recording of interest and
consider? loan.
.

LO 2: CONCEPT OF ASSERTIONS:
Financial statements contain 2 types of areas:
1. Account Balances – items shown in the balance sheet.
2. Classes of Transactions and Events – items shown in the income statement.

Each area may contain misstatements. These possible misstatements are explained through assertions.

What Are Assertions?

Assertions are representations by management that are embodied in the financial statements.

Auditors use assertions in 2 ways:

• To identify the types of potential misstatements.
• To design audit procedures that provide evidence about those misstatements.

Thus, assertions act as a bridge between financial statement items and audit procedures.

Types of Assertions
There are two categories of assertions, relating to balance sheet and relating to income statement.

1. Assertions About Account Balances (Balance Sheet Focus)

When auditing account balances at period-end, the auditor verifies the following:
1. Existence – Recorded assets, liabilities, and equity actually exist.
2. Rights and Obligations – The entity holds or controls the rights to assets, and the liabilities are the
obligations of the entity.
3. Accuracy, Valuation, and Allocation – Assets, liabilities, and equity are included at appropriate
amounts. Necessary adjustments for valuation or allocation are properly made.
4. Completeness – All assets, liabilities, and equity that should be recorded are included. There are no
unrecorded items.
5. Classification – Items are recorded in the proper accounts.
6. Presentation – Items are aggregated or disaggregated appropriately, clearly described, and
disclosures follow the applicable financial reporting framework (AFRF).

2. Assertions About Classes of Transactions and Events (Income Statement Focus)

When auditing transactions and events during the period, the auditor focuses on:
1. Occurrence – Recorded transactions and events actually occurred and relate to the entity. This
prevents overstatement.
2. Accuracy – Amounts and data relating to transactions are properly recorded.
3. Cut-off – Transactions and events are recorded in the correct accounting period.
4. Completeness – All transactions and events that should be recorded are included. This prevents
understatement of income or expenses.
5. Classification – Transactions and events are recorded in the proper accounts.
6. Presentation – Transactions and events are aggregated or disaggregated appropriately, clearly
described, and disclosures follow the AFRF.

Page | 55
 Auditing – Study Notes Chapter 7 Risk Assessment

Linking Assertions to Audit Procedures

For each financial statement area, auditor assesses which assertions in that area have higher risk of
misstatements. Then auditors select procedures that provide evidence about the relevant assertions e.g.
• For revenue, the focus is on occurrence, accuracy, and cut-off.
• For inventory, the focus is on existence, completeness, and valuation.

By connecting risk with assertions, and then performing procedures on those assertions, auditors reduce
audit risk and ensure their opinion on the financial statements is reliable.

EXAM CHEAT-SHEET
Scenario-Based Question Short Answer
If demand for Drug A falls, which line item and assertions may
Valuation of Inventory.
be misstated?
If R&D costs are capitalized incorrectly, which line item and
Classification of Intangibles
assertion may be misstated?

70% of customers pay in cash, especially on weekends, with

Existence of Cash.
deposits delayed to next day. What risk arises?

If Zenith Pharma breaches regulations, which line item and

Completeness of Provisions and liabilities for penalties.
assertion may be misstated?
If exchange losses are not recorded properly, which line item
Accuracy of Exchange Gain/Loss.
may be misstated?
If Drug A’s equipment loses value, which line item may be
Valuation of Property, plant, and equipment .
misstated?
.

LO 3: TYPES OF RISKS (& AUDIT RISK MODEL):

Business Risk and its Link to Audit Risk
Business Risk is the risk that events, conditions, or actions will harm an entity’s ability to achieve objectives
and strategies. Examples include: poor management decisions, new competitors, regulatory changes, or loss
of key customers.

Most business risks eventually affect the financial statements. When they do, they also become audit risks.
For this reason, auditors must understand business risks before assessing audit risk.

Audit Risk Model and Its Components:

Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are
materially misstated.

To manage this, auditors use the Audit Risk Model:

Audit Risk (AR) = Inherent Risk (IR) × Control Risk (CR) × Detection Risk (DR)

This formula shows that overall audit risk depends on the interaction of its 3 components.

Page | 56
Auditing – Study Notes Chapter 7 Risk Assessment

Inherent Risk (IR)

Definition: The susceptibility of an account balance, transaction, or disclosure to material misstatement
before considering any controls.

Examples:
• Theft of precious and portable inventory
• Misstatement in depreciation, or provisions

Significant Risk: A significant risk is an identified risk of material misstatements for which the assessment of
inherent risk is close to the upper end of the spectrum of inherent risks.

Control Risk (CR)

Definition: The risk that a misstatement which could be material will not be prevented, detected, or
corrected on a timely basis by the entity’s internal controls.

Key Point:
Auditors assume control risk is high at the start. They perform tests of controls to decide whether they can
rely on the client’s internal systems. Strong controls reduce control risk and lower the need for detailed
substantive testing.

Detection Risk (DR)

Definition: The risk that audit procedures will fail to detect an existing material misstatement.

Detection risk is the only component directly managed by the auditor.

Risk of Material Misstatement (RMM)

Definition: The combined effect of Inherent Risk (IR) and Control Risk (CR).
Formula: RMM = IR × CR

Levels of Risks and Responses

Auditors respond to risks at 2 levels:

(a) Risk at Financial Statement Level

This risk affects the financial statements broadly.

Examples:
1. Risk of fraud by management
2. Management override of controls
3. Incompetent or dishonest management
4. Going concern issues

Auditor’s Responses to Risk at Financial Statement Level:

• Apply more professional scepticism
• Lower materiality thresholds and improve planning
• Assign more experienced staff or experts
• Increase supervision and review
• Add unpredictability in audit procedures
• Perform more work at year-end instead of interim dates
• Obtain more reliable audit evidence
• Assess accounting policies and key estimates carefully

Page | 57
 Auditing – Study Notes Chapter 7 Risk Assessment

(b) Risk at Assertion Level

This risk relates to specific assertions for balances, transactions, or disclosures.

Examples:
1. Risk that portable assets may not exist
2. Risk that liabilities may not be recorded
3. Risk that complex or unusual transactions may not be correctly recorded
4. Risk that large year-end transactions may be misstated

Auditor’s Responses to Risk at Assertion Level:

• Perform tests of controls to check reliability of internal systems
• Perform substantive procedures such as detailed testing and analytical procedures

EXAM CHEAT-SHEET
Scenario-Based Question Short Answer

Orion Manufacturing expanded to a new region with low costs but Risk of non-compliance with local laws and
unfamiliar regulations. What is the inherent risk? misstatement due to oversight.

Orion’s new facility faced production delays, high costs, and Risk of incorrect inventory valuation and
quality issues, leading to excess inventory. What is the inherent overstatement due to obsolescence or cost allocation
risk? errors.

Orion’s management is under pressure to show success of new Risk of aggressive accounting practices, overstated
facility to directors. What is the inherent risk? revenues or assets, and misstated results.

Orion is setting up a new internal audit department, but it is not Weak internal controls may fail to detect errors or
yet functional. What is the risk? fraud at the new facility.
Orion is family-owned, with family members holding key High risk of management override of controls, leading
positions. What is the control risk? to manipulation of accounting records.

Can inherent risk be lowered by strong controls and oversight? No. Inherent risk exists independent of controls.

Is audit risk derived only from inherent risk not prevented by

No. Audit risk = inherent × control × detection risks.
controls?

Can detection risk be reduced by more substantive testing? Yes. More testing reduces detection risk.

If inherent risk is 50% and control risk 80%, can detection risk be
Yes. Audit risk = 0.5 × 0.8 × 0.25 = 0.10.
25% to achieve audit risk of 10%?

Paul audited Orion Cheese for 5 years with no adjustments. He No. Inherent risk can never be zero; errors are always
concluded inherent risk is zero. Is he correct? possible regardless of past experience.

Hill tested internal controls at Nova Foods and found them very No. Control risk can never be zero because of human
strong. He concluded control risk is zero. Is he correct? error, override, and collusion.

Shad audited Galaxy Security where staff resigned, records were No. Inherent and control risks were high; less audit
messy, and systems failed, yet he finished audit quickly. Is this work means detection risk too high and audit
valid? ineffective.
Control risk increases; receivables and bad debts
New CEO reduced credit staff at Orion Tractors. What risk arises?
valuation may be misstated.
A car maker records supplier invoices before goods arrive, using Control risk; liabilities and inventory may be misstated
electronic invoicing. What risk arises? due to cut-off issues.
.

Page | 58
Auditing – Study Notes Chapter 7 Risk Assessment

LO 4: RISK ASSESSMENT FROM GIVEN INFORMATION:

1. Risks Related to Receivables and Payables
Valuation of Debtors (Accounts Receivable)
Receivables may lose value if customers are unable to pay. For example, an increase in receivable turnover
days or disputes with debtors may indicate doubtful debts. In such cases, the business might need provisions
for bad debts. This also highlights weaknesses in credit control policies.

Completeness of Creditors (Accounts Payable)

A decrease in creditors or a falling turnover ratio may mean that some liabilities are not recorded.
Understatement of creditors gives a misleading picture of the company’s obligations. Auditors must check
that all payables are included in the financial statements.

2. Risks Related to Provisions and Obligations

Provision for Warranty
When companies offer warranties, they must record a reasonable provision for future claims. If warranty
periods increase or complaints from customers rise, the provision may be understated. Auditors must
evaluate whether the recorded provision reflects actual risks.

Provision for Restructuring or Staff Termination

Closure of a factory or reorganization requires recording provisions for restructuring and staff termination
benefits. If these are not recorded properly, liabilities will be understated.

Provision for Litigations and Contingent Liabilities

Legal cases, staff disputes, or environmental damages may lead to significant penalties. If provisions are not
fully recorded or disclosed, the financial statements will mislead users. For example, regulatory authorities
may even cancel licenses if issues are not handled properly.

3. Risks Related to Assets

Valuation of Non-current Assets Held for Sale
When a factory is closed, related assets must be reclassified and measured at the lower of carrying value and
fair value. If this is not done, the balance sheet may overstate asset values.

Development Costs
Development costs must meet strict recognition criteria under accounting standards. Sometimes, businesses
misclassify research costs as development costs to increase assets. This misclassification leads to
overstatement of intangible assets.

Valuation of Patents and Development Costs

If sales decline or competitors take legal action, the value of patents or development costs may fall. This
indicates possible impairment, meaning the assets may not be worth as much as shown in the books.

Valuation of Fixed Assets (Revaluation)

When fixed assets are revalued, there is subjectivity in estimating useful life and complexity in calculating
deferred tax. Errors in revaluation can significantly misstate asset balances.

Impairment of Machinery
If sales decline, assets remain unused, or the production process fails, the machinery’s value may reduce. This
signals impairment, requiring the asset to be written down to recoverable value.

Page | 59
Auditing – Study Notes Chapter 7 Risk Assessment

4. Risks Related to Inventory

Existence of Inventory
When inventory is held in multiple locations, with third parties, or when physical counts are not done on the
balance sheet date, it becomes difficult to verify existence. This raises the risk of unrecorded or missing stock.

Valuation of Inventory
Inventory must be valued at the lower of cost and net realizable value (NRV). If sales decline, goods are
returned, or inventory is damaged or outdated, NRV may be less than cost. In such cases, inventory is
overstated unless properly adjusted.

5. Risks Related to Sales and Income

Occurrence of Sales
Sometimes companies overstate sales to meet targets or earn bonuses. This can involve recording fake sales
or including next year’s sales in the current year. Auditors must ensure sales actually occurred during the
reporting period.

Overstatement or Understatement of Income or Expense

When income is received in advance or expenses are prepaid, there is a risk that cash movements are
recorded as revenue or expenses at the wrong time. Income and expense should be recognized when earned
or incurred, not when cash is received or paid.

6. Risks Related to Compliance and Regulation

Risk of Non-compliance with Laws and Standards
When new accounting rules or legal requirements are introduced, companies may fail to comply. This creates
the risk of misstatements and penalties. Non-compliance also reduces the credibility of financial reporting.

7. Risks Related to Audit Evidence

Disagreement or Inappropriate Scope Limitation
If a predecessor auditor resigns or issued a modified opinion, this may indicate disagreements with
management. Such situations increase audit risk and limit reliability of previous audit work.

Insufficient or Inappropriate Audit Evidence

When audit time is restricted, auditors may not collect enough evidence to support their opinion. This
increases the risk of issuing an incorrect audit report.

8. Risks Related to Internal Controls and Staffing

Risk of Incorrect Recording of Transactions
Weak segregation of duties, inexperienced staff, or absence of financial controllers increase the likelihood of
errors. New IT systems without proper supervision can also cause misstatements.

9. Risks Related to Going Concern

Risk of Going Concern
If the company’s current ratio falls, creditors’ turnover increases, or major customers go bankrupt, the
company may face liquidity issues. This raises doubt about whether the business can continue operating in
the foreseeable future.

Page | 60
Auditing – Study Notes Chapter 7 Risk Assessment

Additional Risks:
Revenue Recognition in Long-term Contracts
For construction or service contracts, revenue recognition depends on stage of completion. Misjudging
progress can overstate or understate revenue.

Related Party Transactions

Deals with related parties may not be at arm’s length. This increases the risk of misstated balances or hidden
obligations.

Cash Transactions
High use of cash increases the risk of unrecorded sales, theft, or understatement of income.

Loans and Borrowings

Incorrect classification between current and non-current borrowings can misstate liabilities. Interest
expenses may also be misstated if accruals are ignored.

Bank Reconciliations
Failure to reconcile bank balances increases the risk of unrecorded transactions, errors, or fraud.

Taxation
Understatement of tax liabilities or incorrect deferred tax treatment leads to material misstatements. Tax
penalties may also arise.

Leases
Leases must be correctly classified as finance or operating. Misclassification misstates assets, liabilities, and
expenses.

Intangible Assets
Brands, goodwill, and licenses may require impairment testing. If ignored, assets remain overstated.

Insurance Claims
If claims for damaged assets or stock are not properly recorded, income and assets are misstated.

Government Grants
Grants must be recognized as income or deferred income based on conditions. Misapplication leads to
misstated revenue or liabilities.

Formulae for Risk Assessment Through Figures:

1. Sales Percentage (Formula= current year’s sales/last year’s sales * 100)
2. Cost of Sales Percentage (Formula= Cost of Sales/Sales * 100)
3. GP Ratio (Formula= Gross Profit/Sales * 100)
4. Selling/operating expenses ratio (Formula= Selling or operating Expenses/Sales *)
5. Admin expenses (Formula= current year’s admin expense/last year’s admin expense * 100)
6. Interest/Finance charges (Formula= Interest/Loans * 100)
7. Debtors’ Turnover Ratio in Days (Formula= Debtors/Sales * 360)
8. Creditors’ Turnover Ratio in Days (Formula= Creditors/Purchases * 360)
9. Inventory Turnover Ratio in Days (Formula= Inventory/ Cost of Sales* 360)

Other ratios indicating liquidity or going concern problems of entity:

1. Decrease in Current Ratios (Current Ratio = Current Assets/Current Liabilities)
2. Decrease in Net Profit ratio (Net profit Ratio = Net Profit / Sales)
3. Decrease in interest coverage ratio (also called Times Interest Earned = Profit before
interest / Interest Exp.)

Page | 61
 Auditing – Study Notes Chapter 7 Risk Assessment

For Exam Tips

In exams, remember that one piece of information may affect multiple areas. For example, a decline in sales
can indicate impairment of machinery, valuation issues with inventory, and going concern problems at the
same time.

EXAM CHEAT-SHEET
Scenario-Based Question Short Answer
Orion FMCG faces fierce competition in fast moving consumer Business: loss of market share. Audit: overstated inventory
goods. What business and audit risks arise? or receivables.
Vega Dairy’s sales rose 50% though prices rose only 20%. What is
Sales may be overstated; risk of fictitious or early revenue.
the risk?
Vega Dairy’s inventory nearly doubled from Rs. 7m to Rs. 13m.
Risk of obsolete or overstated inventory.
What is the risk?

Orion Construction’s gross profit margin rose from 28% to 32%

Sales may be overstated or costs understated.
despite costlier imports and fewer contracts. What is the risk?

Warranty period increased from 3 to 5 years but provision rose

Risk of understated warranty provision and liabilities.
slightly. What audit risk arises?
Liquidity and going concern risk; loans may be
Borrowings and leases rose; cash fell. What audit risk arises?
misclassified.
Vega Ltd’s gross profit margin dropped from 29% to 23%. What Sales understated, purchases overstated, or closing
errors may cause this? inventory understated.

Where should auditors focus further testing in Vega Ltd? Sales cutoff, purchase records, inventory valuation,

LO 5: BUSINESS RISKS AND RELATED AUDIT RISKS:

1. Decline in Market Demand and Technological Change
When customers prefer alternative products or competitors introduce superior technology, the company may
lose sales and market share. This creates a business risk of reduced revenue and unsold stock. Management
may also struggle to recover the cost of heavy investments in production facilities.

The related audit risks are:

• Inventory may be overstated because slow-moving or obsolete goods are not written down.
• PPE may be overstated if machinery or production lines are underutilized and their value is
impaired.

2. Credit Defaults and Lenient Credit Policies

When companies extend easy credit to customers or when an economic downturn increases defaults, cash
collection becomes uncertain. The business risk is poor liquidity and the possibility of writing off receivables.

The related audit risks are:

• Receivables may be overstated if doubtful debts are not provided for.
• Revenue may be overstated if sales are recorded but later reversed as bad debts.

Page | 62
Auditing – Study Notes Chapter 7 Risk Assessment

3. Non-Compliance with Laws and Regulations

If management fails to comply with industry rules, tax laws, or environmental regulations, the company may
face fines, penalties, or legal action. The business risk is reputational damage and financial outflows.

The related audit risks are:

• Provisions may be incomplete if management does not record expected fines.
• Contingent liabilities may be omitted if ongoing litigation is not disclosed.

4. Product Malfunctions and Returns

When a product fails or large batches are defective, the business risk is twofold: financial (cost of recalls,
warranty claims, or replacements) and strategic (loss of customer trust).

The related audit risks are:

• Inventory valuation may be affected if defective items are kept at cost rather than written down.
• Warranty provisions may be misstated if future repair costs are underestimated or ignored.
• Contingent liabilities may not be disclosed if recall-related obligations are hidden.

5. Cybersecurity Breaches
A hacking incident or data theft leads to business risks such as operational disruption, customer mistrust, and
regulatory penalties for poor data protection.

The related audit risks are:

• Accuracy of records may be compromised if financial systems are manipulated or corrupted.
• Provisions may be incomplete if regulatory fines are not recognized.

6. Economic Downturn
Recessions or economic slowdowns reduce customer spending power. The business risk is lower sales, cash
shortages, and idle capacity.

The related audit risks are:

• Receivables may be overstated if customers cannot pay.
• Inventory may be overvalued due to unsold goods piling up.
• PPE may be impaired because assets are not generating expected benefits.

7. Factory or Business Unit Closures

Closing a unit or factory often results in business risks such as high restructuring costs, staff layoffs, and
reduced future revenues.

The related audit risks are:

• Restructuring provisions may be understated if closure costs are ignored.
• PPE may be overstated if assets from the closed unit are not written down.

8. Foreign Currency Exposure

When a company deals in multiple currencies, exchange rate fluctuations create business risks of unexpected
losses or reduced competitiveness.

The related audit risks are:

• Incorrect translation of foreign currency balances may misstate assets and liabilities.
• Misstatement of exchange gains or losses may distort profit or loss.

Page | 63
 Auditing – Study Notes Chapter 7 Risk Assessment

9. Poor Financial Condition and Debt Covenant Breaches

If a company’s financial health deteriorates or if it breaches loan terms, it faces the business risk of losing
financing and possibly being forced into liquidation.

The related audit risks are:

• Going concern may be in doubt, requiring disclosure.
• Debt classification may be misstated, with long-term debt wrongly shown as non-current when it has
become repayable.
• Penalties imposed by lenders may go unrecorded.

10. Fraud and Management Override:

Weak internal controls allow fraud or management override. The business risk is intentional misstatement or
asset loss.

The related audit risks are:

• Financial statements may contain deliberate misstatements. Related-party transactions may be
hidden. Journal entries may be manipulated to show false results.

11. Related Party Transactions

Dealings with group companies or directors may not be at arm’s length. The business risk is hidden
obligations or unfair transfers of value.

The related audit risks are:

• Related party transactions may not be disclosed. Assets or liabilities may be misstated due to non-
market pricing.

12. Cash Handling and Misappropriation

Where large amounts of cash are involved, the business risk is theft or misappropriation. Weak controls
worsen this risk.

The related audit risks are:

• Cash balances may be overstated if theft occurs. Bank reconciliations may be manipulated.

EXAM CHEAT-SHEET
Scenario-Based Question Short Answer

Titan Gear outsourced protective gear to Nova Sports. Injuries

Reputational damage, reduced demand, and possible
involving Titan’s products were reported. What business risk
lawsuits.
arises?

Profits fell 30% due to rising costs and recession. What risk Impairment risk for property, plant, and equipment;
arises (other than going concern)? risk of misstatements in valuation.

Sky Adventure launched “book now, pay later” installment Business: higher defaults. Audit: receivables may be
scheme. What risks arise? overstated, doubtful debts understated.

Vega Dairy’s payables rose only 20% while cost of sales rose Liabilities understated; some supplier balances may be
52%. What is the risk? missing.

Orion Appliances launched new products but revenue rose only

Risk of overstated inventory and plant impairment.
1%. What audit risk arises?

Page | 64
 Auditing – Study Notes Chapter 7 Risk Assessment

Nova Pharma’s short-term loans rose from Rs. 15,000m to Rs. Liquidity and going concern risk; risk of covenant
27,000m. What audit risk arises? breaches and misclassification of loans.

Orion Furniture keeps inventory at one site. Nova USB keeps Nova USB; multiple sites, theft risk, and fast
inventory at many outlets. Which is higher risk for auditor? technological obsolescence.

LO 6: AUDIT APPROACH IN NOT-FOR-PROFIT ORGANIZATIONS (NFPO):

What is a NFPO
A not-for-profit organisation (NFPO) does not work to make profit for shareholders. Its objective is to provide
services to society as a whole or to a particular group in society.

Examples of NFPOs include:

• Charities
• Clubs
• Societies
• Government-owned organisations

Audit Approach in NFPOs

Although the overall audit structure is similar to that of commercial organisations, the details differ because
of the nature of NFPOs. The audit approach covers planning, risk assessment, internal controls, obtaining
evidence, and reporting.

Planning the Audit

Planning ensures that the audit work is focused and efficient. In an NFPO, the auditor considers:
1. The environment in which the NFPO operates (e.g. health, education).
2. The objectives and scope of the audit work.
3. Local regulations that apply.
4. The form and content of financial statements.
5. Key audit areas, such as cash collection and use of restricted funds.

Assessing Audit Risk

Risk in NFPOs is analysed under 3 headings: Inherent Risk, Control Risk, and Detection Risk.

Inherent Risks Associated with Income:

Risk Factor Explanation Effect on Audit Approach
Donations are unpredictable. In economic Auditor may add a “Material
Income derived wholly
downturns, income may fall, creating Uncertainty Relating to Going
from donations
going concern issues. Concern” paragraph in the report.
Completeness of income is difficult to
Cash collected by Auditor may face scope limitation
verify. Volunteers may lack training, and
volunteers from different due to lack of reliable evidence. Audit
cash may be stolen since no invoices are
places opinion may be modified.
issued.

Page | 65
 Auditing – Study Notes Chapter 7 Risk Assessment

Inherent Risks Associated with Expenses:

Risk Factor Explanation Effect on Audit Approach
Constitution (Trust Deed) Auditor reviews expenditures to
Risk that expenditure is made for
specifies how income ensure funds are not misused and are
purposes outside the constitution.
should be spent not “ultra vires” (outside authority).
Risk of misclassification (liability vs. Auditor checks that donation is
Donations with specific
income) or misuse (not spent as per recorded as liability and spent
instructions
donor’s instructions). according to donor’s instructions.
Constitution requires
Risk of exceeding the limit or Auditor checks compliance with the
admin expenses not to
misclassifying other expenses as non- limit and investigates unusual
exceed a fixed % of
admin. expense increases.
income

Evaluating Internal Controls

Internal controls protect the NFPO’s resources and ensure proper use of funds. Key controls include:
• Controls over receipts (cash, cheques, fundraising events).
• Controls over payments (authorisation, use of funds for specified purposes).
• Controls over income and expenditure recording (membership fees, grants, donations).

However, NFPOs often face weak control environments due to:

1. Limited segregation of duties because of small staff size.
2. Volunteers who may not be trained or experienced.
3. Lack of internal audit departments.
4. Weak authorisation processes due to limited trustee involvement.

Obtaining Audit Evidence

Because internal controls are often weak, auditors in NFPOs usually rely more on substantive testing rather
than systems testing.

Key areas include:

• Completeness of income, expenses, assets, and liabilities.
• Detection of possible misuse or diversion of funds.
• Use of analytical procedures to test reasonableness of figures.
• Review of final financial statements and accounting policies.

Reporting Phase
The final step is reporting.
• If the audit is required by law, the report must follow the legal requirements.
• If the audit is voluntary, the report must reflect the agreed objectives. However, auditors usually
follow the structure required by ISAs, especially ISA 700, with suitable modifications.

Special Considerations in NFPO Audits

NFPO audits often involve challenges that affect the auditor’s work:
• Cash is often significant, but controls may be weak.
• Donation income is difficult to predict and verify.
• Restricted funds require careful monitoring to ensure proper use.
• Unstable income and expenses reduce the usefulness of analytical review.
• Stakeholders often monitor statistics, such as the percentage of income spent on administration,
which makes misclassification risks important.

Page | 66
 Auditing – Study Notes Chapter 7 Risk Assessment

EXAM CHEAT-SHEET
Scenario-Based Question Short Answer

Aurora Trust, a non-profit school network, received Rs. 500m Risk of material misstatement in income classification.
in grants and donations. During system change, Rs. 18m of Misallocation may lead to inaccurate financial reporting and
grants were misallocated. What is the audit risk? non-compliance with grant conditions.

Nova Foundation must keep admin expenses below 15% of Expenses may be misclassified or understated; exemption
donations for tax exemption. What risk arises? may be lost.
Star Welfare Trust collects donations mainly in cash at public Risk of misappropriation or incomplete recording of
kiosks. What risk arises? donations.
Ajio must spend donations only on education projects. What Risk of funds used for unauthorized purposes, breaching
inherent risk arises? constitution.
EuKaRe collects cash via volunteers. What inherent risk Risk of theft or misappropriation; completeness of income
arises? doubtful.
Wealthy donors impose conditions on some donations. What
Misuse of restricted funds may breach donor instructions.
risk arises?
Charity collects donations in cash through volunteers. What
Theft or incomplete recording of income.
risk arises?
.

Page | 67