HHH-111 Risk Assessment 05
HHH-111 Risk Assessment 05
Note Generally, the data used to develop the accounting estimate will
also be used in the performance of controls that address the risks
associated with the estimate. Therefore, in an integrated audit, or
when we are otherwise relying on the effectiveness of relevant
controls, it is likely that we will test the controls that address the
completeness and accuracy of the data used to develop the
accounting estimate. See Framework Step 4, "Respond to
Identified Risks of Material Misstatement — Perform Tests of
Controls," for additional discussion.
For example, in determining the allowance for doubtful accounts, the company develops a migration
analysis to determine the percentage of allowance needed by aging category (i.e., an assumption
used in determining the accounting estimate). The migration analysis is developed through the use of
an Excel spreadsheet prepared by management and which is manually updated by management. The
analysis includes data related to collections and write-offs by period that is derived from the financial
reporting systems. In considering the risks of misstatement related to the allowance for doubtful
accounts, we would typically consider whether risks of misstatement exist related to the accuracy
and completeness of the migration analysis, including the accuracy and completeness of the
collections and write-offs data as well as risks related to the formulas or calculations used.
For example, identifying a risk of misstatement that "the valuation of complex financial instruments
is not appropriate" would generally not be sufficient to clearly understand the types of potential
misstatement that could occur. Given the nature of the estimate there are likely multiple risks of
misstatement, for example:
For example, the allowance for loan losses (ALL) has been identified as a significant estimate. The ALL is
a complex accounting estimate that includes both a general loss reserve and a specific loss reserve.
Accordingly, it likely would not be appropriate to determine there is only one risk of misstatement related
to the valuation of the ALL. Rather, we would typically identify the components of the accounting estimate
and assess the risks associated with each component. For example, the risks of misstatement in this
situation may include:
Data used in constructing loss rates does not agree to actual loss history
Credit quality issues are not appropriately identified on homogenous loans
Economic factors (e.g., unemployment data, changes in housing prices) used by management are not
appropriately correlated to losses.
The allowance for collateral dependent impaired loans is improperly calculated because of stale
appraisal data or unqualified appraisers
For example, identifying a risk of misstatement that "the goodwill is impaired" would generally not be
sufficient to clearly understand the types of potential misstatement that could occur. Given the nature of
the estimate, there are multiple risks of misstatement that may need to be identified, for example:
Our judgments related to the identification of risks of material misstatement may be influenced by the
extent to which a generally accepted model or method used to make the accounting estimate exists. In
instances when the applicable financial reporting framework does not prescribe the model or method to
be used, we may consider whether the method or model used by the company (or a specialist engaged
by the company) is used commonly within the industry, or whether it is internally developed, and
therefore unique to the company.
For example, an entity has two different revenue streams: one is based on complex, multiple-
element arrangements and the other is a single element product where revenue is recognized
upon shipment. A risk described as “revenue is recorded for a sale that did not occur” is likely not
described at an appropriate level of detail; therefore, it may not be sufficient to clearly understand
the types of potential misstatements that could occur and to design appropriate further audit
procedures. As the risk of misstatement related to the occurrence assertion is applicable to each
revenue stream, describing the risk in a manner that describes in more detail how the
misstatement could occur in each revenue stream would be more appropriate.
Identifying and then documenting the risk at a more detailed level informs our risk assessment process,
including considerations related to whether the risk of material misstatement is lower, higher, or significant
(Section 3.2) and the design of planned further audit procedures. In particular, it will allow us to effectively
identify relevant controls, if applicable, and design further audit procedures that are responsive to the risk.
PCAOB AAM The auditor should identify and assess the risks of material misstatement at
Requirements the financial statement level and the assertion level. In identifying and
and Guidance assessing risks of material misstatement, the auditor should: . . .
[AAM 13150.4]
At this point in the risk assessment process for most risks of misstatement, based on the evidence
obtained from the risk assessment procedures performed, it will be simple to conclude that the likelihood
and potential magnitude of the risks of misstatement gives rise to a risk of material misstatement (i.e.,
very little, if any, additional evaluation is needed to determine that a risk of material misstatement exists).
Some risks of misstatement, however, may require further evaluation to determine if the identified risk
has a reasonable possibility of causing an account or disclosure to be misstated, such that the financial
statements would be materially misstated.
"Likelihood" refers to the chance that a material misstatement could happen, based on our consideration
of what could go wrong. Examples of factors that may affect the likelihood of a risk of material
misstatement occurring related to an accounting estimate may include the:
Nature and amount of assets, liabilities, and transactions executed at a location or component.
Degree of centralization of records or information processing.
Existence of related-party transactions.
Complexity, including the method or model used by management in making an accounting estimate.
Estimation uncertainty.
Competency of entity personnel involved in processing the transactions, recording the transaction or
balance, determining the balance (for accounting estimates), or preparing financial statements or
disclosures.
"Magnitude" refers to the significance of the misstatement that could occur to the financial statements,
including a material misstatement. Examples of factors that may affect the magnitude of a misstatement
(including a material misstatement) occurring related to an accounting estimate may include the following:
Financial statement amounts or total of transactions exposed to the risk — the larger the account
balance, the greater the potential magnitude.
For example, the fair value of a “mark-to-market” asset or liability (e.g., a derivative with large
notional amounts) may have a small recorded value at a particular point in time, but the fair value at
other or future points in time could be much greater, thereby increasing the magnitude of the
misstatement related to the derivative accounts that could occur.
Volume of activity (in the current period or expected future periods) in the account or class of
transactions exposed to the risk — the larger the volume of transactions, regardless of the size of the
recorded account balance, the greater the potential magnitude.
For example, the accrued expenses balance at year-end is quantitatively immaterial; however,
during the year the volume of transactions processed through the account is very large. The
significant volume of transactions likely increases the magnitude of potential misstatement of the
accrued expenses balance.
Note In order to identify and assess the risks of material misstatement, which includes
understanding the likelihood and potential magnitude of misstatement, we will need to
have first determined an appropriate materiality level. Although materiality commonly
is expressed in quantitative terms, our determination of materiality is a matter of
professional judgment that includes both quantitative and qualitative considerations.
As we perform audit procedures and evaluate the results, we may revise our
determination of materiality. If our judgments of materiality change, we are required to
evaluate the effect on our risk assessment and audit procedures; see further discussion
in Framework Step 1.
See the Determining Materiality and Performance Materiality Guide for further discussion
on evaluating audit results and revising materiality.
We also consider the possibility that the risks of misstatement we identified could result in multiple
misstatements, thereby increasing the magnitude of the potential misstatement.
For example, cash flow projections are used in multiple accounting estimates, including the
discounted cash flow (DCF) analysis used to determine the fair value of reporting units, and the
valuation allowance for deferred tax assets. The risks related to cash flow projections (e.g.,
inappropriate assumptions are used) are therefore risks that could result in multiple misstatements
(e.g., if the cash flow projections are incorrect, the fair value of reporting units as well as the
valuation allowance for deferred tax assets may be incorrect).
The consideration of the magnitude of a potential misstatement is not limited to quantitative factors, but
also takes into account qualitative factors that could result in an increased risk that a misstatement may
be material to the financial statements.
For example, we identified a risk related to the impairment assessment of the entity’s goodwill may
be misstated, despite the fact that the total goodwill on the balance sheet is less than our established
performance materiality. The users of the financial statements under audit may interpret even an
impairment of goodwill as an indicator of future performance. Given these factors, we may determine
that the magnitude of the potential misstatement may not be quantitatively material to the
financial statements taken as a whole, but that an impairment may provide information that could be
significant to the users of the financial statements, and therefore, qualitatively material. While this
fact pattern may not be typical, it is being used here to illustrate that an appropriate assessment of
qualitative factors is an important aspect of identification of risks of material misstatement.
For example, the entity has a customer lawsuit related to a defective product, but has not recorded
a liability other than legal expenses incurred to date (as under the applicable financial reporting
framework, although a loss is probable, it is not estimable; therefore, a liability does not need to be
recorded). The product is significant to the entity’s future operations. While we may determine that
the magnitude of the potential misstatement related to the specific customer’s claim may not be
quantitatively material to the financial statements taken as a whole, because the claim is of the
nature that it could ultimately result in a large class action suit, and because of the importance to the
product to the entity’s future operations, information about the customer lawsuit may be significant
to the users of the financial statements. For that reason, the lawsuit may be considered qualitatively
material, particularly to the risks of misstatement associated with appropriate disclosure (e.g.,
disclosing the nature of the probable loss and possibly a range of loss). While the amount of the
specific customer’s claim and probable loss is less than materiality, the outcome of the lawsuit may
potentially have a significant impact on the entity’s operations.
Our consideration of the likelihood and magnitude of the risks of misstatement helps us to determine
whether there is a reasonable possibility that a material misstatement may occur. Figure 3.7 illustrates the
relationship between magnitude and likelihood when determining whether risks of material misstatement
exist. Our judgments about the likelihood of a misstatement occurring (including the possibility of multiple
misstatements) intersect with our considerations about the potential magnitude of possible misstatement
and collectively inform our conclusions about whether the risk gives rise to or presents a reasonable
possibility of material misstatement of the financial statements. Therefore, we consider the likelihood and
the potential magnitude associated with a particular risk of misstatement in combination rather than
separately (e.g., we do not need to separately quantify the probability of occurrence of misstatement or
material misstatement as a specific percentage or as a range; rather, we determine whether the risk
presents a reasonable possibility of a material misstatement). In doing so, we recognize that there might
be greater likelihood that misstatements of a smaller amount could exist and a lesser likelihood that
misstatements of a larger amount could exist. As the likelihood and potential magnitude of misstatement
increases, the more likely it is that a risk of material misstatement exists. Accordingly, the area in Figure
3.8, to the left of the red arch, shaded in green, generally represents those risks of misstatement that we
may conclude, based on our risk assessment and professional judgment, are not risks of material
misstatement because either of the following exists:
A. The likelihood of misstatement is very low, irrespective of the potential magnitude of potential
misstatement (i.e., even though there is a possibility of a misstatement of a greater magnitude, the
likelihood of that happening is very low)
B. The likelihood of a misstatement is greater, but the magnitude of a misstatement that is of greater
magnitude is low.