Risk Assessments and Internal Controls

1 auditing Standard AUS 402 (July 2002) Risk Assessments and Internal Controls Prepared by the auditing & Assurance Standards Board of the Australian Accounting Research Foundation Issued by the Australian Accounting Research Foundation on behalf of CPA Australia and The Institute of Chartered Accountants in Australia The Australian Accounting Research Foundation was established by CPA Australia and The Institute of Chartered Accountants in

2 Australia and undertakes a range of technical and research activities on behalf of the accounting profession as a whole. A major responsibility of the Foundation is the development of Australian auditing Standards and Statements. auditing Standards contain the basic principles and essential procedures identified in bold-type (black lettering) which are mandatory, together with related guidance. For further information about the responsibility of members for compliance with AUSs refer Miscellaneous Professional Statement APS Conformity with auditing Standards.

3 Australian Accounting Research Foundation Level 10, 600 Bourke Street Melbourne Victoria 3000 AUSTRALIA Phone: (03) 9641 7433 Fax: (03) 9602 2249 E-mail: COPYRIGHT 2002 Australian Accounting Research Foundation (AARF). The text, graphics and layout of this Assurance Engagement Standard are protected by Australian copyright law and the comparable law of other countries. No part of this Assurance Engagements Standard may be reproduced stored or transmitted in any form or by any means without the prior written permission of the AARF except as permitted by law.

4 ISSN 1324-4183 - 3 - auditing STANDARD AUS 402 RISK Assessments AND Internal Controls CONTENTS Paragraphs . Inherent . The Internal control Structure .. The control Environment .. The Information System .. control . Inherent Limitations of Internal control Structures ..25 Understanding the Internal control . control Risk Preliminary assessment of control .

5 Documentation of Understanding and assessment of control Risk .. Tests of . Quality of Audit . Timeliness of Audit . Deviations Found in Performing Tests of . Review of the Preliminary assessment of control Risk ..56 Relationship Between the Assessments of Inherent and control .57 Detection . Internal control in the Small .64 Operative Date ..65 Compatibility with International Standards on auditing ..66 - 4 - Appendix 1: Illustration of the Interrelationship of the Components of Audit Risk Appendix 2.

6 Flowchart Reflecting the Logic of AUS 402 AUS 402 RISK Assessments AND Internal Controls - 5 - Introduction .01 The purpose of this auditing Standard (AUS) is to establish standards and provide guidance on obtaining an understanding of the Internal control structure and on audit risk and its components: inherent risk, control risk and detection risk.

7 02 The auditor should obtain an understanding of the Internal control structure sufficient to plan the audit and develop an effective audit approach. The auditor should use professional judgement to assess audit risk and to design audit procedures to ensure it is reduced to an acceptably low level..03 Audit risk means the risk that the auditor gives an inappropriate audit opinion when the financial report is materially misstated. Audit risk has three components; inherent risk, control risk, and detection risk.

8 04 control environment means the overall attitude, awareness and actions of management regarding Internal control and its importance in the entity..05 control procedures means those policies and procedures in addition to the control environment that management has established to ensure, as far as possible, that specific entity objectives will be achieved..06 control risk means the risk that misstatements that could occur in an account balance or class of transactions and that could be material, individually or when aggregated with misstatements in other balances or classes, will not be prevented or detected on a timely basis by the Internal control structure.

9 07 Detection risk means the risk that an auditor s substantive procedures will not detect a misstatement that exists in an account balance or class of transactions that could be material, individually or when aggregated with misstatements in other balances or classes..08 Information system means the methods and records established to identify, assemble, analyse, calculate, classify, record and report the transactions and other events that affect an entity, and to maintain accountability for assets, liabilities, revenues and expenditures.

10 09 Inherent risk means the susceptibility of an account balance or class of transactions to misstatement that could be material, individually or when aggregated with misstatements in other balances or classes, assuming there were no related Internal Controls . AUS 402 RISK Assessments AND Internal Controls - 6.