AUDIT ANALYTICS AUDIT

ESSAY 6: MANAGING RISK AND THE AUDIT PROCESS
instance, if historical findings suggest that a product specifications
conformity rate of 99.999 percent is minimally acceptable from both
product quality and customer satisfaction standpoints, then this might be
perceived as a legitimate threshold value. Performing this type of
analysis for each risk indicator will help ensure that functional threshold
values are structured so that management, internal auditors, and external
auditors are all able to proactively monitor and respond to the changing
risk environment.
Once KRIs and associated thresholds have been created and compiled by
the project team and relevant stakeholders, auditors begin linking each
KRI with the related subset of accounts and assertions to be tested (Moon
2014b). Objectives in this phase pertain mainly to understanding KRI
impacts on financial statement information and, consequently, how audit
activities should be modified in response to changing KRI levels when
significant business risks are detected. As an example, one important
audit assertion relates to valuation of assets. In an embedded component
of testing this assertion, the auditor will seek to determine the
reasonableness of any pertinent estimates such as depreciation,
amortization, and allowances. For instance, imagine that a KRI and
related set of tolerance limits based upon historical experience are
implemented to monitor depreciation levels on fixed assets. When the
KRI moves near or outside the acceptable boundary, auditors are alerted
about an emerging risk relative to the valuation assertion for fixed assets.
The accounts primarily affected in this case are non-current assets of a
depreciable nature. In addition, an income statement account (that is,
depreciation expense) is also affected, thus impacting net income in a
potentially questionable manner. In response to increasing risk in this
area, auditors would adjust the audit plan and testing activities so as to
more heavily emphasize examination of depreciable assets as well as the
reasonableness of depreciation amounts currently being recognized. If
problems of a material nature are unearthed, then timely remedies can be
proposed and implemented. In so doing, the auditor is positioned to
productively modify the audit plan and related testing routines
dynamically as changes in the risk landscape are reported by the CRMA
system.
The final step in figure 6-4 encapsulates the implementation phase for
CRMA. In the auditing domain, the entire set of KRIs are continuously
measured and reported by the CRMA system. When emerging risks are
detected, auditors use this information to adjust the audit plan so that
appropriate emphasis is placed on examining and testing the assertions,
accounts, and controls that are most likely to be impacted.
To ensure ongoing system relevance and reliability, KRIs are regularly
maintained so that new measures are created, existing metrics are
modified, and obsolete KRIs are eliminated as the risk profile dictates.
141