Group 4: Risk Assessment & Internal Control

Three risk components are not three names for one defect Aster Sensors has a highly judgemental warranty estimate. Management has not implemented the planned independent review of it. The audit team then uses an unsuitable procedure that may fail to detect a material estimate error. No misstatement is yet proved. The manager says more audit work changes the client's inherent risk to zero and guarantees a correct opinion. Required: Classify the three risk concerns, explain their relationship and correct the guarantee/direct-control claim. (5 marks)

Higher assessed risk changes the audit response Birch Devices introduces a complex new estimate while its review control is weak. A senior proposes keeping exactly the prior procedure solely because last year's audit found no error. A junior instead proposes an automatic adverse opinion. No current evidence establishes a misstatement. Required: Explain the appropriate risk-response logic and the limits on a conclusion. (3 marks)

An interview is not the whole risk assessment Cedar Retail's CFO says all systems are unchanged. Sales staff report new return rights, legal counsel knows of product claims and IT staff report a billing-interface change. The audit team has conducted no analytics or observation/inspection and proposes relying on the CFO interview for its opinion. Required: Design an applied risk-assessment information plan and explain its evidence boundary. (5 marks)

Business risk is broader than reporting risk Dahlia Textiles expands to a new market. Demand forecasts may be optimistic and staff lack local expertise. The auditor is asked to identify every commercial risk and guarantee expansion success. No audit evidence yet proves any account wrong. Required: Explain the financial-reporting relevance and scope limit of understanding business risks. (3 marks)

Build an initial risk map for a changed business Elm Appliances has four developments: A. A rushed acquisition adds an unfamiliar inventory system and management has not reconciled the interface to the ledger. B. Sales bonuses depend on a steep year-end revenue target. Sales staff mention side agreements allowing unusual returns; the CFO says standard contracts have not changed. C. A warranty estimate uses a wide range of possible outcomes. A proposed independent review has not yet been implemented. D. A significant one-off transaction with a related party is outside the normal course of business. Its accounting is complex and heavily directed by management. All are risk indicators, not proved fraud or misstatement. No control operating-effectiveness tests or further substantive conclusions have been completed. The partner wants a risk map, not a predetermined opinion. Required: (a) Map each development to what could go wrong, relevant risk factors and useful understanding work. (6 marks) (b) Distinguish potentially pervasive and assertion-specific risks and significant-risk assessment. (2 marks) (c) Explain response and evidence boundaries. (2 marks)

A policy exists, but is the control in use? Fir Manufacturing's policy says a supervisor compares each supplier invoice with authorised purchase and receipt records before posting. Staff confirm the policy verbally. A walkthrough finds postings made before matching, and no review record for selected transactions. The control, if performed properly, could identify relevant quantity/price differences. The audit team calls the written policy effective for the full year. Required: Distinguish design, implementation and operation; identify understanding evidence and correct the reliance claim. (5 marks)

Two signatures can still be circumvented Grove Motors requires two approvals for payment. Two employees collude, while a manager can override the approval setting. The board claims dual approval eliminates every possible error or fraud. No particular loss is quantified. Required: Explain the limitation, assurance level and audit implication. (3 marks)

Owner oversight is neither automatic strength nor automatic failure Hazel Repairs has four employees, making full segregation impractical. The owner reviews bank reconciliations and unusual supplier payments using supporting records. The same owner can override all payment limits and enter adjustments without independent challenge. A trainee says small size means no relevant controls, while the owner says personal supervision guarantees perfect records. Required: Evaluate the compensating oversight, override risk, evidence needs and proportionate audit understanding. (5 marks)

Relevant to the financial-statement audit is not the same as important to operations Iris Transport has a route-punctuality system, access controls over cash-disbursement data and a fuel-use efficiency dashboard. Route/fuel tools are stated to serve only operational objectives with no identified financial-reporting link. Disbursement access protects posting/payment data. No additional statute requires a broader controls report. The manager wants equal audit attention to every system because each is important commercially. Required: Assess control relevance, the benefits of understanding relevant controls and the scope exception. (5 marks)

A control review with five different weaknesses Juniper Foods' review shows: 1. The code of conduct exists, but senior management rewards staff who bypass controls to meet targets; oversight is weak. 2. No one assesses reporting risks from a newly launched product and its unfamiliar warranty terms. 3. The billing system records dispatch data, but changed return terms are not communicated to finance; sales and ledger records no longer reconcile. 4. A designed review of unusual credit notes is not used, even though staff say it is policy. 5. Repeated reconciliation exceptions are reported, but no one follows up or checks whether controls remain effective. No loss or fraud is proved, and no operating-effectiveness conclusion is supplied. The trainee groups all five under missing passwords and says a new policy document solves them. Required: (a) Map the five weaknesses to internal-control components and explain the specific reporting concern. (5 marks) (b) Distinguish control understanding from operation testing and state corroborating work for two issues. (3 marks) (c) Explain assurance limitations and what the proposed policy does not prove. (2 marks)

A familiar industry, an unfamiliar entity Kestrel Diagnostics has overseas subsidiaries, a newly acquired laboratory, owner-controlled suppliers and debt carrying financial covenants. A new regulatory requirement may affect its operations. The auditor says having audited another diagnostics company makes entity-specific understanding unnecessary. No breach or misstatement has been established. Required: Develop an entity-specific understanding plan addressing four distinct areas and explain why industry experience is not a substitute. (5 marks)

A changed policy needs a reason, not a popularity vote Linden Components changes an accounting policy and says the change is valid because two competitors use it. The file contains no reason for the change or evaluation against the applicable reporting framework. The auditor has not established whether either policy is appropriate. Required: State the understanding and evaluation needed, and the limit on the conclusion. (3 marks)

Performance pressure is information, not a fraud verdict Maple Distribution rewards managers for quarterly margins and lender ratios. Internal reports show large budget variances while public credit reports show funding pressure. A trainee calls all good reported results fraudulent without inspecting the measures or underlying records. Required: Explain the relevance of performance measures, useful understanding work and the conclusion boundary. (3 marks)

A risk register without a risk process Nectar Foods lists a new cold-storage technology and new product line in a register. The register has no estimate of significance, likelihood assessment or decision on responses. Management says listing names alone proves its risk-assessment process is complete. Required: Evaluate the process through its four stages, apply each to the facts and distinguish the entity process from the auditor's work. (5 marks)

Trace a sale through a changed information system Orchid Machines moves to a new billing platform. Order records start in sales; dispatch files feed billing; rejected interfaces await manual correction; accepted batches reach the ledger. Finance prepares statements from that ledger. Customer return terms are held separately, while finance says it never receives changes. Manual journal entries can adjust revenue. Management shows one successful invoice and claims every reporting stage and control is understood. Required: (a) Design an understanding plan covering six areas of the information system, applying each to these facts. (6 marks) (b) Explain communication and the people/procedures/data dimensions beyond hardware. (2 marks) (c) State corroborating work and limits on what the successful invoice proves. (2 marks)

External complaints can be monitoring information Pine Logistics' customers repeatedly complain of duplicate bills. Management files the messages without investigating. A supervisor reviews control performance monthly, but no corrective actions are tracked and procedures remain unchanged after the system changes. Management says only internal reports can count as monitoring information. Required: Explain monitoring, evaluate the facts and outline what the auditor should understand without assuming a proved loss. (5 marks)

A code of conduct is not the whole control environment Quartz Services has a signed ethics code. Its governance body rarely scrutinises estimates, and finance staff assigned complex estimates receive no relevant training. The manager treats the signed code as conclusive evidence of a satisfactory control environment. Required: Identify two other relevant elements and explain the limit of the code and environment. (3 marks)

Automated consistency depends on more than one screenshot Redwood Retail's application rejects invoices without a valid account code. A walkthrough shows one rejection. During the year, developers could change validation rules without approval or a reliable change log. The team says automation means the walkthrough always proves full-year effectiveness. Required: Evaluate the qualified automation principle, the change-control concern and the appropriate evidence boundary. (5 marks)

Unusual transactions and judgemental estimates need different attention Sequoia Energy enters a significant one-off transaction needing management-directed accounting, manual data assembly and complex calculations. Separately, an estimate depends on subjective assumptions about uncertain future events. Neither issue is established as fraudulent and the counterparty is not stated to be related. Required: Explain three risk drivers of the transaction, a distinct estimate driver and the significant-risk judgement boundary. (5 marks)

Update the understanding when the business changes Tamarind Packaging's planning file describes a domestic manufacturer with a stable policy and bank financing. Before fieldwork ends: A. A subsidiary is acquired and purchases begin from an entity controlled by a director. B. Management changes an accounting policy but supplies no reason or framework analysis. C. Financing is replaced with debt linked to performance ratios; managers now receive bonuses tied to those ratios. D. Technology changes the transaction flow, but the old process description is still used. The senior says understanding was completed at planning and only a new audit opinion template is needed. No breach, fraud or misstatement has been established. Required: (a) For each development, state what understanding to update and a useful source/action. (6 marks) (b) Explain two distinct uses of the updated understanding in audit judgement. (2 marks) (c) Correct the completed-at-planning claim and state the evidence/conclusion boundary. (2 marks)

A narrative must describe the system actually operating Umber Crafts has no formal control manual. The auditor proposes a narrative record but copies an owner's ideal process without testing or observing what staff do. Staff roles have changed repeatedly. Required: Explain the method's suitability, the evidence needed and a practical limitation. (3 marks)

Initials on a checklist are not automatic proof Violet Traders uses a list instructing audit staff to check purchase-order numbering and authorisation. Staff initial each completed instruction and answer Yes/No/Not Applicable. The senior has not reviewed the completed list, and one No answer has no explanation. Required: Identify the method and explain completion and review limits. (3 marks)

Resolve conflicting questionnaire answers Willow Supplies' internal-control questionnaire asks whether supplier invoices are matched with purchase orders and receipt notes. The accounts head answers Yes; receiving staff say invoices often arrive before any receipt record exists. A question about a process the company does not use is answered Yes merely to avoid an empty field. The trainee wants to accept every response as tested evidence. Required: Explain the method's benefit, response conventions, inconsistency follow-up and the resulting evaluation boundary. (5 marks)

A flow chart must show the real flow Xenia Manufacturing's lengthy process description hides the route for rejected invoices. The auditor plans a flow chart but draws only the approved route, omitting corrections and transfers between departments. Required: Explain the method, its benefit and the preparation needed. (3 marks)

Control evaluation changes the audit programme Yarrow Works' payroll review finds weak recruitment/enrolment records and no reliable link between approved workers and the wages sheet. A trainee says this administrative weakness is irrelevant to financial reporting and proposes the same programme as a client with supported strong controls. No dummy worker or loss is yet proved. Required: Explain the reporting link, two distinct audit-programme implications, useful work and the conclusion limit. (5 marks)

Controls need evidence of application, consistency and performer Zinnia Services' bank-reconciliation review is supported by signatures for selected months. A new reviewer took over midyear, and high-volume months have unsigned reviews. The auditor says one old signature establishes operation throughout the period. Required: Explain three operating-effectiveness dimensions, suitable follow-up and the effect on the preliminary assessment. (5 marks)

Understanding evidence can sometimes serve a second purpose Acacia Stores' auditor performs procedures while understanding bank reconciliations. The work also supplies evidence about relevant control design and operation. A trainee says all understanding work is either always sufficient as control testing or can never be used for that purpose. Required: Explain the conditional use and the sufficiency limit. (3 marks)

Match control tests to three different evidence problems Banyan Repairs has three controls: A. Purchase orders require approval before release and normally retain approval records. B. Cash custody and transaction recording are assigned to different staff, but there is no written trail of who actually does each task. The organisation chart names intended staff only. C. Monthly bank reconciliations and review records exist, but unexplained items may have been carried forward incorrectly. During the audit, the approver changes and transaction volume rises sharply in the final quarter. The team proposes asking the manager once and treating all controls as effective for the year. Required: (a) Design two linked control-testing actions for each of A, B and C. (6 marks) (b) Explain two features of testing application over the period in the changed circumstances. (2 marks) (c) Explain deviation evaluation and the consequence for planned substantive work. (2 marks)

A control improvement announcement is not closure Cypress Tools' interim review identifies weak supplier-statement reconciliation and missing follow-up of differences. Management announces a revised procedure. At year end, the auditor has not checked whether it is used. A senior says the announcement closes the deficiency and the old risk assessment need not be reconsidered, even though substantive work identifies unexplained differences. Required: Explain follow-up, relevant evidence, reconciliation of the assessment with later evidence and possible response changes. (5 marks)

Build a focused four-area control questionnaire Dogwood Engineering has these process facts: A. Purchasing staff can issue orders and also record goods receipts; order authorisation is unclear. B. Supplier statements differ from ledger balances; duplicate invoices are not marked and no one follows up differences. C. Physical inventory counts identify shortages, but there is no evidence of investigation or authorised adjustment of stock and accounting records. D. Fixed-asset verification reports identify damaged assets and record differences, but capital spending authority and correction approval are unclear. The manager asks the auditor to write eight focused control questions, not a generic request to describe every system. No actual misstatement or loss is established. Required: (a) For each area, formulate two distinct questions and explain the specific control concern they address. (8 marks) (b) Explain response conventions and corroboration/follow-up before concluding on implementation or operation. (2 marks)