ASB Issues Risk-Based Auditing Standards

by Dr. Raymond Thompson, CMA
Pursuit, December 2006

The Auditing Standards Board (ASB) recently introduced a suite of eight related standards intended to move the profession toward a risk-based auditing approach to all engagements. Not since the mid-1980s "expectation gap" standards has the ASB issued auditing standards with the potential for such a profound impact on the profession. The ASB believes that these standards will engender a significant improvement in the quality and effectiveness of audits and are the AICPA's response to damage caused by major audit failures over recent years. The revised standards are also an attempt by the ASB to recapture the initiative in improving audit standards that have been placed in question by the Public Company Accounting Oversight Board's (PCAOB) emergence as a parallel, and perhaps competitive, standard setter.

The ASB cautions us to not underestimate the new standards' significance and far-reaching effects. The board is fully aware that the new standards will place an increased burden on the entire audit team, requiring a major overhaul of audit procedures as well as extensive staff training. For this reason, the standards will not be effective for audits of financial statements until Dec. 15, 2006.

In addition to the eight revised standards-ASA No. 104 through 111-AICPA published an Audit Risk Alert to provide guidance on the audit risk model. A detailed Audit Guide also addresses implementation issues.

Risk-based auditing is a term that has been in use for years and typically means different things to different people. One largely discredited version of risk-based auditing involved tailoring the scope and depth of the audit based upon the litigation risk involved in that particular area. Practitioner's Publishing Company materials contain extensive documentation of their risk-based approach: to identify high-risk areas and select appropriate audit procedures in response to identified risk. The ASB's risk model is not explicitly articulated in the new standards, however. Risk-based auditing is broader than the familiar formula where overall risk is determined by the interaction of material misstatement and detection risk. Rather, the ASB's model is much more fundamental. It embodies an iterative, cumulative process of risk assessment and brings with it changes in audit strategy, resulting in procedures that alter perceived risks.

The risk-based auditing approach adopted in SAS No. 104 through 111 alters the audit process by encouraging an ongoing reassessment and revision of the nature and extent of audit risks that should drive the conduct of the audit. This differs from the traditional, largely sequential audit process which involved following an audit plan. In contrast, risk-based auditing is nonlinear. It is a process of learning and revising as more information is gathered. The risk-based auditing process ends only after the auditor has identified account balances and the types of transactions and disclosures where material misstatements are most likely to occur.

The new ASB standards will undoubtedly pose a major challenge for auditors and their staff. However, they also promise to yield substantial benefits in terms of public confidence in audit effectiveness, improvement in audit quality, and a reversal in recent corporate and audit failures.

“'FASB/SAS Update' covered areas such as FIN 46 and updated fraud requirements indepth, for which there is very little guidance."
–Brad W. Risch
Ross Buehler Falk & Co.