Tag Archives for " Risk Assessment "

In this article, I explain SAS 143, Auditing Accounting Estimates and Related Disclosures, a new audit standard applicable for periods ending on or after December 15, 2023.   

We'll look at the objectives of SAS 143, auditor responsibilities (including risk assessment and responses), the nature of estimates, documentation requirements, and overall evaluation of your work to ensure appropriateness and completeness. 

Estimate Examples

To get us started, here are a few examples of estimates:

• Depreciation of plant, property, and equipment
• Valuation of investments
• The outcome of pending litigation
• Inventory obsolescence
• Warranty liabilities
• Allowance for uncollectible receivables

So, what is an accounting estimate? It's a monetary amount for which the measurement is subject to estimation uncertainty. Of course, you need to consider the financial reporting framework as you think about the estimate. For example, an estimate might be significantly different when using GAAP versus a regulatory basis. 

But what is estimation uncertainty? It's the susceptibility of an estimate to an inherent lack of precision in measurement. In layperson's terms, it's an estimate that is hard to pin down.

SAS 143 Objectives

The objective of SAS 143 is to see if the accounting estimate and related disclosures are reasonable by obtaining sufficient appropriate audit evidence. 

Nature of Estimates

Some estimates are simple, while others are difficult. For example, estimating the economic life of a vehicle is straightforward, but computing an allowance for uncollectible receivables might be complex.

But even one type of estimate, such as an allowance for uncollectible, can vary in complexity. For example, the allowance computation for uncollectible receivables is usually more complex for a healthcare entity (e.g., more payor types) than for a small business. Why? Because it is more complex and more challenging to determine. Therefore, the estimation uncertainty for a healthcare entity (with many payor types) is higher than that of a small business with one type of customer. Additionally, the volume of transactions should be higher for a healthcare entity versus a small business.

Estimation Uncertainty

So, the inherent subjectivity of an estimate creates estimation uncertainty. 

Consider estimation uncertainty in this manner: ask twenty people to compute the allowance for a hospital and then ask them to do the same for the small business's uncollectible estimate. How much variation would you expect? Yes, much more for the hospital because the inherent risk is higher. 

SAS 143 tells us to increase our risk assessment procedures and further audit procedures as the estimation uncertainty increases. We perform more risk assessment work concerning the hospital's allowance than that of the small business. Moreover, we complete more extensive further audit procedures for the hospital's allowance than for the small business's estimate. 

More risk, more work. 

To understand SAS 143, we need to know the underlying concepts.

SAS 143 Concepts

Relevant Assertions

You need to assess the risk of material misstatement at the relevant assertion level. Further, you are required to assess inherent risk and control risk separately. And as you assess inherent risk, you might encounter significant risks. 

The Spectrum of Inherent Risk

Usually, a hospital's valuation assertion related to receivables is relevant, and the inherent risk is often high due to its subjectivity, complexity, and volume of transactions (i.e., inherent risk factors). Therefore, the valuation assertion's risk might fall toward the end of the spectrum of inherent risk. On a ten-point scale, we might assess the inherent risk as a nine or a ten. And if we do, it is a significant risk, affecting our professional skepticism.

Professional Skepticism and Estimates

Our professional skepticism increases as the estimation uncertainty rises (or at least, it should). Why? The potential for management bias may be present since it's easier to manipulate complex estimates. And complexity can be a smokescreen to hide bias, increasing the need for internal controls.

Estimate Controls

As estimates become more complex, entities increase internal controls (or at least, they should). And consequently, auditors need to evaluate the design and implementation of those controls. Additionally, auditors must determine whether they will test the controls for effectiveness. 

Another SAS 143 concept is the reasonableness of the estimate.

Reasonableness of Estimates

For an estimate to be reasonable, the applicable financial reporting framework must be its basis. Additionally, management should consider the facts and circumstances of the entity and the related transactions. In creating a reasonable estimate, management will often use the following:

• A method
• Certain assumptions
• Data

Let's consider these elements using the allowance for uncollectible receivables. 

First, management considers the financial reporting framework. If the entity uses GAAP, it makes sense to create the estimate. No allowance is necessary if the cash basis of accounting is in use. In this example, we'll assume the company is using GAAP.

Estimate Method

In computing an allowance for uncollectible, an entity might calculate the estimate as a total of the following:

• 20% of receivables outstanding for more than 60 days
• 60% of receivables outstanding for more than 90 days
• 90% of receivables outstanding for more than 120 days

Estimate Assumptions

And what assumptions might management consider? Bad debt percentages have stayed the same over time. The company needs to increase the percentages if there if collectible amounts erode. 

Estimate Data

Finally, consider the allowance data. In this example, it would typically be an aged receivable listing. Such a listing breaks receivables into aging categories (e.g., 0 to 30 days; 31 to 60 days; etc.). Such data should be consistent. Suppose the company purchases new software that computes the aged amounts differently using different data than previously. If this occurs, management and the auditors need to consider the reasonableness of the new data. 

Is the Estimate Reasonable?

Most importantly, estimates need to make sense (to be reasonable) in light of the circumstances. While consistent methods, assumptions, and data are desirable, change, such as a slowdown in the economy, can require new ways of computing estimates.

One more concept is that of management's point estimate and disclosure.

Management's Point Estimate and Disclosure

The auditor will examine management's point estimate and the related disclosures to see if they are reasonable. How? Review the estimate's development (how was it computed?) and the nature, extent, and sources of estimation uncertainty. 

If circumstances are similar to the prior year, then the estimate's method, assumptions, and data will typically be similar. Likewise, the disclosure will be much like the preceding period. 

But if, for example, the economy slows significantly, the percentages applied to the aged receivable categories (see above) may need to increase so that the allowance for uncollectible is higher. The auditor might question the estimate if management did not raise these percentages. 

The company should disclose how the estimate is created and the nature, extent, and sources of estimation uncertainty. 

Now, let's see what the SAS 143 requirements are.

SAS 143 Requirements

The requirements for estimates are conceptually the same as in any area. The auditor does the following:

• Perform risk assessment procedures
• Identify and assess the risk of material misstatement
• Develop responses to the identified risks and carry those out

1. Perform Risk Assessment Procedures for Estimates

As you consider the entity and its environment, consider the following:

• Transactions and other events that give rise to the need for estimates and changes in estimates
• The applicable financial reporting framework as it relates to estimates
• Regulatory factors affecting estimates, if any
• The nature of estimates and related disclosures

Next, as you consider internal control, ask about the following:

• Nature and extent of estimate oversight (who oversees the estimate? how often is the estimate being reviewed?)
• How does management identify the need for specialized skills or knowledge concerning the estimate?
• How do the entity's risk assessment protocols identify and address risks related to estimates?
• What are the classes of transactions, events, and conditions giving rise to estimates and related disclosures?
• How does management identify the estimate's methods, assumptions, and data sources?
• Regarding the degree of estimation uncertainty, how does management determine the range of potential measurement outcomes?
• How does management address the estimation uncertainty, including a point estimate and related disclosures?
• What are the control activities relevant to the estimate? (e.g., second-person review of the computation)
• Does management review prior estimates and the outcome of those estimates? How does management respond to that review?

Additionally, the auditor reviews the outcome of prior estimates for potential management bias. 

If there are any significant risks (inherent risk falling toward the end of the spectrum of risk), the auditor should understand the related controls and, after that, see if they are designed appropriately and implemented. 

And finally, the auditor considers if specialized skills or knowledge are needed to perform risk assessment procedures related to estimates. 

Of course, after you do your risk assessment work, it's time to assess the risk.

2. Identify and Assess the Risk of Material Misstatement

SAS 143, as we have already seen, requires a separate assessment of inherent risk and control risk for each relevant assertion.

In assessing inherent risk, the auditor will consider risk factors such as complexity, subjectivity, and change. It's also important to consider the estimate method and the data used in computing management's point estimate. 

Some estimates represent significant risks. So, for example, if the computation of warranty liability is complex or has a high degree of estimation uncertainty, then identify the liability as a significant risk since the valuation assertion is high risk (toward the upper end of the spectrum of inherent risk).

3. Responses to Assessed Risk of Material Misstatement

Once the assessment of risk is complete, you are in a position to create responses. As usual, document linkage from the risk level to the planned procedures. Higher risk calls for more extensive actions. 

If, for example, the auditor identifies an estimate as a significant risk, go beyond basic techniques (i.e., more than a basic audit program). Higher risk calls for more responses.

Additionally, base those responses on the reasons for the assessments. In other words, create audit procedures based on the nature of the risk. No good comes from performing more procedures unrelated to the identified risk. 

Three Responses to Risks Related to Estimates

The audit procedures need to include one or more of the following three steps:

1. Obtain audit evidence from events occurring up to the date of the auditor's report
2. Test how management made the accounting estimate by reviewing the following: 
   • Methods in light of: 
     • Reporting framework
     • Potential management bias
     • The estimation computation (is it mathematically correct?)
     • Use of complex modeling, if applicable
     • Maintenance of the assumptions and data integrity (does this information have integrity?)
   • Assumptions; address the following: 
     • Whether the assumptions are appropriate
     • Whether the judgments made in selecting the assumptions give rise to potential bias
     • Whether assumptions are consistent with each other
     • When applicable, whether management has the intent and ability to carry out specific courses of action
   • Data; address the following: 
     • Whether the data is appropriate
     • Whether judgments made in selecting the data give rise to management bias
     • Whether the data is relevant and reliable
     • Whether management appropriately understands and interprets the data
   • Management's point estimate and related disclosure; address the following: 
     • How management understands estimation uncertainty
     • See if management took appropriate steps in developing the point estimate and related disclosure
     • If the auditor believes management has not sufficiently addressed estimation uncertainty, the following should occur: 
       • Request management perform additional procedures to understand the estimation uncertainty; consider disclosing more information about the estimation uncertainty
       • Develop an auditor's point estimate or range if management's response to the auditor's request in the prior step is not sufficient
       • Evaluate whether an internal control deficiency exists
3. Develop an auditor's point estimate or range; do the following: 
   • Include procedures to evaluate whether methods, assumptions, or data are appropriate
   • When the auditor develops a range,  
     • Determine whether the range includes only amounts supported by sufficient audit evidence and are reasonable in the context of the reporting framework
     • Regarding disclosures related to estimation uncertainty, design and perform procedures regarding the risk of material misstatement (i.e., determine if the disclosure provides sufficient information regarding estimation uncertainty)

Once you complete your audit work related to estimates, evaluate what you've done. 

Overall Evaluation of Estimate Work

Evaluate the sufficiency of your estimate work by considering the following:

• Are the risk assessments at the relevant assertion level still appropriate?
• Do management's decisions regarding recognition, measurement, presentation, and disclosure of the estimates agree with the financial reporting framework? 
• Has sufficient appropriate evidential matter been obtained?
• If evidence is lacking, consider the impact on the audit opinion
• Has management included disclosures beyond those required by the financial reporting framework when needed for fair presentation?

Here are some additional considerations in determining if your work is complete.

Documentation of Estimate Work

SAS 143 says that the auditor's documentation should include the following:

• The auditor's understanding of the entity and its environment, including internal controls related to estimates
• Linkage of further audit procedures with the risks of material misstatement at the assertion level
• Auditor's responses when management has not taken appropriate steps to understand and address estimation uncertainty
• Indicators of possible management bias related to estimates
• Significant judgments related to estimates and related disclosures in light of the reporting framework

Governance Communication Regarding Estimates

Finally, consider whether you should communicate estimate matters to those charged with governance, especially if a high estimation uncertainty is present. 

SAS 143 Summary

While SAS 143 requires that auditors understand the estimate process and then perform procedures to ensure the reasonableness of the numbers and disclosures, there's nothing unusual about this. We gain an understanding of the estimates, assess the risk, and create responses. 

Many estimates, such as plant, property, and equipment depreciation, are simple. In those areas, there's little to do. But as always, our risk assessment and responses will increase as complexity and uncertainty increase. 

You may also be interested in my article titled SAS 145: New Risk Assessment Standard.

Purpose of Preliminary Analytical Procedures

When to Create Planning Analytics

Developing Expectations 

The Best Types of Planning Analytics

How to Document Preliminary Planning Analytics

Developing Conclusions

Linkage to the Audit Plan

Summary of Preliminary Analytical Procedure Considerations

Peer reviews find that many CPA firms don't identify significant risks in audits, and that's a problem. Why? Because they are the seedbed of many material misstatements. And when material misstatements are not identified, audit failure often occurs.

Below, I will tell you how to identify, assess, and respond to significant risks.

I also explain the new requirement to communicate significant risks to those charged with governance.  

Defining Significant Risk

The Auditing Standards Board previously defined significant risks as those deserving special audit consideration. They've amended this definition in SAS 145 to focus on the inherent risk characteristics rather than the response. 

For example, a highly complex receivable allowance is inherently risky because it's subjective and complicated. Yes, we will give it special audit consideration. But it's a significant risk because of its nature (subjective and complex), not because of our response (re-computing the estimate and comparing it with prior periods, for example). 

How Many Significant Risks?

At least one significant risk exists in most audits, and frequently there are more. The number depends on the entity, its environment, the types of services it provides or goods it sells, the complexity of its accounts, the subjectivity of determining balances, the susceptibility of accounts to bias or fraud, and the level of change.

Defined in SAS 145

SAS 145, Understanding the Entity and Its Environment and Assessing the Risk of Material Misstatement, defines significant risk in terms of likelihood and magnitude. The threat must be likely, and the result must be material. (See my SAS 145 article.)

The audit standard defines the risk as one close to the upper end of the spectrum of inherent risk without regard for controls. In other words, we consider the inherent risk factors, and we disregard internal controls as we identify these risks.

Align Inherent Risk with Significant Risk

Notice that significant risks are based solely upon inherent risk. So don’t make the mistake of identifying such a risk and then assessing inherent risk below high. After all, the definition says close to the upper end of the spectrum of inherent risk.

Suppose, for example, you identify a significant risk for the allowance for uncollectible receivables, an estimate, due the concerns about the valuation assertion (because it's complex and subjective; see inherent risk factors below). Then the inherent risk for the valuation assertion must be high (or max). 

It's useful to think of inherent risk on a scale of 1 to 10, with 10 being high risk. If you believe the inherent risk is a 9 or a 10 (close to the upper end of the spectrum of inherent risk), then a significant risk is present. Though auditors commonly use low, moderate, high to measure inherent risk, the audit standards don't specify how this is to be done. I'm not saying don't use low, moderate, high, only that thinking of inherent risks on scale of 1 to 10 helps me evaluate risk and to determine whether a significant risk is present.

Inherent Risk Factors

And what are the inherent risk factors? 

• Complexity
• Subjectivity
• Change
• Uncertainty
• Susceptibility to misstatement due to management bias or other fraud risk factors (in terms of how they affect inherent risk)

Two Questions to Consider

So the auditor reviews an assertion and asks, "In light of these risk factors, what is the probability of misstatement without regard for controls?" The auditor also asks, "Would a material misstatement occur?" So we consider two things:

• Is it highly likely that a misstatement will occur for the assertion (without regard for controls)?
• Will the misstatement be material?

If both answers are yes, it's a significant risk.

Responses to Significant Risks

Peer reviews find that auditors sometimes identify these risks but plan inadequate responses. If the risk is significant, then a strong response is necessary. 

For example, if inventory obsolescence is an issue, the auditor should plan procedures to identify the impaired items and test for appropriate valuation. You may need a specialist in such a situation. So, what would be an inadequate response?  Performing basic inventory procedures. Additional procedures, sometimes referred to as extended steps, are necessary to address the inventory valuation assertion.

As you plan the additional audit procedures, link them from the identified risk (usually on your summary risk assessment form) to your responses (usually on your audit program). In the inventory example, you would link the risk for the valuation assertion to the inventory audit steps (the extended steps to identify and value the impaired items).

You must also communicate these risks to those charged with governance. 

Communicating Significant Risks

Communicate the significant risks to those charged with governance as you implement SAS 134, Auditor Reporting and Amendments, Including Amendments Addressing Disclosures in the Audit of Financial Statements (required for December 31, 2021 year-end engagements and after).

(See my SAS 134 article to understand the types of audit opinions.)  

Present guidance states that significant risks are those that deserve special audit consideration, so you'll use that definition until SAS 145 is implemented. (Even so SAS 145 will help you understand these risks now.)

How to Communicate 

You can communicate significant risks in one of three ways:

1. Engagement letter
2. Planning letter to those charged with governance
3. Verbally to the board with documentation of that communication in the audit file--this could be a separate Word document that says who you talked with, when, and the significant risk areas communicated. 

The Communication Change

SAS 134 amended AU-C 260.11 (AU-C 260 The Auditor's Communication with Those Charged with Governance) as follows (amended language is underlined):

The auditor should communicate with those charged with governance an overview of the planned scope and timing of the audit, which includes communicating about the significant risks identified by the auditor.

Sample Significant Risk Language 

Here's an example of the language to be used in any of the three options above:

The anticipated significant risk areas in the audit are:

1. receivables/revenues,
2. the allowance for uncollectibles 
3. the pension liability and disclosure. 

Aligning the Communication with Workpapers

The significant risk areas communicated to the board during planning should align with those identified in your workpapers. You could, however, not know all of the risk areas when you create your initial communication. It's even possible you might not identify a these risks until you are well into the engagement. So the initial significant risk communication and the identified risks in the audit file could be different. You can communicate any additional risks in your final communication to those charged with governance. 

Why are we making this communication the board? Well the board governs the entity, so they need to be aware of areas with a higher risk of potential misstatements. 

Optional Communication 

The explanatory information that accompanies AU-C 260 (specifically .A21) states you may include in the governance communication how you (as the auditor) are going to address the significant risks, but this is optional.  

Audit Risk Assessment Book on Amazon

See my book on Amazon: Audit Risk Assessment Made Easy, Seeing What Others Miss.