Group 4: Risk Assessment & Internal Control

Correct answer A: Inherent risk.

Inherent risk is assertion susceptibility before considering related controls. It is different from control failure or audit-procedure detection failure.

Correct answer B: Unperformed entity review concerns control risk; unsuitable auditor testing concerns detection risk.

Control risk concerns entity prevention/detection/correction; detection risk concerns the auditor failing to detect an existing material misstatement.

Correct answer C: Detection risk, as part of reducing audit risk to an acceptably low level.

The auditor influences detection risk through responses. Entity inherent/control risks exist independently of the audit and are not directly eliminated by more audit work.

Correct answer D: At overall financial-statement level, potentially affecting many assertions.

Financial-statement-level risks relate pervasively to statements and may affect many assertions. Specific account risks can coexist; a pervasive concern is not limited by its lack of an account title.

Correct answer A: Combine relevant inquiries with analytics and observation/inspection, then assess reporting implications.

Risk assessment uses inquiries of management and others, analytical procedures and observation/inspection. Reports are information to investigate, not automatic findings.

Correct answer B: Risk-assessment procedures provide a basis for responses but alone do not supply all sufficient appropriate opinion evidence.

Risk-assessment work is useful but does not alone provide sufficient appropriate evidence on which to base the opinion.

Correct answer C: Investigate actual regulatory factors, operations, ownership/structure and financing relevant to expected reporting.

Understanding includes external factors and the nature of the entity. Actual relationships and structure can affect expected transactions, balances and disclosures; industry experience is not a substitute.

Correct answer D: Understand the change and evaluate appropriateness for the business and consistency with the applicable reporting framework.

Selection/application of policies, including reasons for changes, require understanding and evaluation. Neither imitation nor change alone determines compliance.

Correct answer A: Understand the measures and pressure because they may increase reporting risk; fraud is not yet established.

Internal/external performance measures may create reporting pressures. Understand measures and their use; incentives are not a fraud verdict.

Correct answer B: Update the entity understanding throughout the audit and use it in subsequent judgements.

Understanding is continuous and dynamic, gathering, updating and analysing information throughout the audit, not only at planning.

Correct answer C: Understand relevant business risks and possible reporting effects, without assuming responsibility for identifying every business risk.

Business risk is broader than risk of material misstatement. Understanding it helps identify reporting risks but the auditor need not identify/assess every business risk.

Correct answer D: Oversight may compensate for some segregation limits while override risk still needs attention.

Small entities can have useful owner oversight and limited segregation, while owners can override less structured systems. Both aspects require evidence-based understanding.

Correct answer A: Commitment to competence.

Control environment includes competence and how required skills translate into knowledge. A signed ethics code does not establish competent staffing.

Correct answer B: Key stages of the entity's risk-assessment process beyond identifying risks.

The process includes identification, estimating significance, assessing likelihood and deciding actions. A list is not the complete process.

Correct answer C: How significant events/conditions are captured and reporting roles/information are communicated.

Information-system understanding includes significant events/conditions and financial-reporting processes; communication of roles/responsibilities and relevant information matters.

Correct answer D: External communications can indicate control problems requiring monitoring attention and remedial action.

Monitoring assesses performance over time and appropriate correction; external customer/regulator communications can indicate problems. Complaints still require investigation.

Correct answer A: Performance reviews.

Control activities include performance reviews, information processing, physical controls and segregation. An entity budget comparison is a performance review.

Correct answer B: Design capability is different from implementation, which requires existence and actual use.

Design evaluates capability; implementation means the control exists and is used. Investigate actual activity rather than equate policy with use.

Correct answer C: Implementation work may support operation evidence only conditionally, considering relevant assessed/tested supporting controls.

IT consistency can let implementation procedures serve as effectiveness tests depending on assessment/testing of relevant controls such as program changes. It is not an unconditional rule.

Correct answer D: Treat it as a significant risk.

The module identifies significant related-party transactions outside normal business as always significant risks. That classification does not itself prove fraud or determine the opinion.

Correct answer A: These features can increase misstatement risk and need understanding and appropriate significant-risk judgement.

Greater manual/management intervention and complex calculations or principles can raise non-routine transaction risk. Investigate actual facts rather than infer wrongdoing.

Correct answer B: Narrative record.

A narrative record describes the system found in operation and can suit small entities with no formal system. It should not simply copy an ideal policy.

Correct answer C: Checklist.

A checklist is instructions/questions staff follow or answer, with completion initials and review by responsible senior staff. Completion does not itself prove effectiveness.

Correct answer D: Discuss the inconsistency with relevant staff and corroborate the actual process before evaluating deficiencies.

Questionnaires reduce omissions but answers may conflict. Clarify inconsistencies and evaluate supported findings, rather than treat client responses as tested operation evidence.

Correct answer A: Flow chart.

A flow chart is a concise graphic presentation of the system and flow. It needs actual process understanding, including exceptions, and is not itself effectiveness evidence.

Correct answer B: Inquire of relevant staff and observe who actually performs the functions.

Inquiries and observation help test controls without audit trails, focusing on actual performers rather than intended assignments.

Correct answer C: Reperformance.

Reperformance is the auditor's independent execution of procedures/controls originally performed by the entity. It is distinct from inquiry or observation.

Correct answer D: Investigate causes/timing and appropriately cover the change or fluctuation period.

Operation evaluation considers how, consistently and by whom controls were applied. Deviations warrant specific inquiries and coverage of changed or fluctuating periods.

Correct answer A: Revise the assessment and modify planned substantive procedure nature, timing and extent as appropriate.

Unsupported preliminary assessment must be reconsidered; revised control risk affects further substantive work. It does not automatically decide the report.

Correct answer B: Internal control provides reasonable, not absolute, assurance and can be circumvented by collusion.

Collusion and management override are inherent limitations. Evaluate actual evidence and audit implications without zero-risk guarantees or universal misstatement findings.