General
The rationale for conducting a risk assessment is that auditors can limit testing and focus on those areas most vulnerable to noncompliance and abuse. This produces a more cost-effective and timely audit.
In conducting a risk assessment, the auditor:
- Identifies the threats associated with the area or activity under review;
- Determines the inherent risk associated with the identified threats; and
- Assesses whether the existing internal controls will prevent, detect, or correct instances when threats actually occur.
The extent of audit testing is directly related to an assessment of the activity's degree of vulnerability. The higher the vulnerability, the more extensive the audit testing needs to be and vice versa. Thus, even though an activity may have a high degree of inherent risk, a strong system of internal controls can reduce the entity's exposure to a low or moderate level. Accordingly, the need to conduct detailed audit tests could be reduced to an appropriate level.
