Applying materiallity concept of amounts of expenditure. Identifying the critical procesee and the Defining the KRAs for the processee.  

All IS that may have an impact on the accountability correctness of the organization (e.g. social media systems are not relevant).

From experience, exercise professional skepticism at all times when auditing high risk areas. Question, question, question...even if transactions appear justified. For example, if it is a procurement transaction which skipped one of the required approvals, and there is an email in support indicating that "it was an emergency procurement", question, question. Organizations must always have safeguards to mitigate possible losses even  when controls have to be circumvented. Next, apply materiality thresholds as necessary, and if possible, consider the extent to which you should set performance materiality. Another approach I found quite useful is to increase sample size, or even audit some items which were not sampled. Focusing on high value items also helps....

Hi Gin, in addition to the insights you and others and provided, I think it is important to realise that 'high risk areas' would defer from one industry to the other, and therefore, it is expected or presumed that the auditors carrying out any audit are familiar with the risks associated with the particular industry in which they are operating. Therefore, high risk areas in the banking industry, might not necessarily be the same like those in the manufacturing industry. And when we look at the manufacturing sector, this itself is very diverse, depending on the nature and complexity of the products being manufactured. Therefore, KNOWLEDGE OF THE INDUSTRY is key to being able to identify high risk areas associated with that industry. This is also why audit firms have their areas of expertise. An audit firm that is very knowledgeable about a particular sector or industry and the intricacies of operating within that sector can easily identify loopholes, or 'high risk areas' that cannot be ignored. And the audit process will be designed with these in mind.  

Dear Dr. Okike, rather than focusing solely on the internal variables, I like your idea of emphasising on assessing the auditees' external risk including business and inherent risk. A great suggestion.

For starters, I think that David Mathuva's counsel for skepticism, more skepticism, and still more skepticism is dead-on. Auditors need to think like prosecutors and ask tough questions like diplomats, but most auditors of my acquaintance are too hung-up on the annuity relationship to do that. I have always thought that the auditors' Management Letter is a great tool by which an audit firm could differentiate its services, but that would require the auditors to quit kissing the CFO's backside. With the exception of one audit firm, I have never seen a Management Letter that was worth the paper it was written on. They are invariably disposed to worrying about the client's hairstyle. . .while the client's feet are on fire.

I also believe that the advice from Elewechi Okike is pitch-perfect. Industries DO differ. I would also argue that there's a compelling likelihood that clients in unattractive industries pose greater risk to auditors; I suspect there's research out there that affirms that, but I couldn't uncover any of it w/a quick search of Google Scholar.

What's missing here is the need for an 'industry analysis'. Michael Porter, whose PhD is in industrial organization, developed a 'five-forces framework' (NOT 'model') of industry analysis in the late 1970s. His Harvard Business Review paper, 'How Competitive Forces Shape Strategy' (March 1979), is the all-time best-seller from articles published in HBR. He also did an update that HBR published in its January 2008.issue.

However, I argue in my book, Value Maps (link is here: https://bit.ly/ValueMaps), that what used to be five forces should now be six. The addition is 'Complements', the opposite of Substitutes, which was one of the forces in Porter's 1979 paper. I also argue that gauging external risk (the 'OT' of SWOT analysis) must also include an examination of the six forces in the 'macroenvironment': Economy, Demographics, Politics, Innovation, Lifestyles & Values, and Disasters. The unit of analysis at both levels is the industry or, in the case of most non-dominant firms, 'strategic groups'. As first coined by Michael S. Hunt in his 1972 Harvard dissertation on the major home-appliance industry, 'strategic groups' are segments of industries. They are separated by 'mobility barriers' (see Caves & Porter, QJE, 1977, Vol. 91: 241-262). The process of analyzing strategic groups is the same as analyzing industries; we classify both of these under the banner of 'domain analysis' in our work.

A rigorous analysis of both the macroenvironment (do this group of six forces first) and the domain (industry or strategic group) will tell an audit firm a lot about the the attractiveness of the domain in which a given client competes. . .or the unattractiveness thereof. Factors that can make a domain unattractive (a.k.a. less profitable) include low-to-no barriers to entry, no switching costs, strong bargaining power of suppliers, strong bargaining power of customers, competition that is largely price-based, and the existence of substitute products or services.

I hasten to add that these kinds of analyses are not for the weak of heart. They are also well beyond both the capabilities and the knowledge of most auditors. These types of analyses are typically conducted by strategy consultants. Done right, these analyses will cost some money, but that cost can be amortized across clients in the same industry and also over a period of years; how long that period is depends on how rapidly the industry is changing. One will get a sense of that by examining the 'innovation' dimension of the macroenvironment.

There is also industry-level rate-of-return data in two datasets that are updated annually. One goes back to 1926, and the other to 1963. The higher the rate of return--the cost of equity capital, if you will--the riskier the domain. And, of course, the riskier the domain, the riskier the audit.

In my book, Value Maps, I summarized the results of nine papers published in 'A' journals starting in 1991 to try to quantify the relationship between external sources of variation in rates of returns for companies and internal sources of such variation. From the papers, I concluded that the company level of a tri-level analysis (the other two are the domain and the macroenvironment) could account for as much as 3x the risk as the two sets of external sources. In other words, the greatest source of risk to a company is often. . .the company itself! As the cartoon character Pogo said more than fifty years ago, "We have met the enemy. . .and he is us!"

I have never understood why audit firms do not routinely involve strategy experts in their audits. Strategists can ask questions that auditors do not know to ask. They can also evaluate the efficacy of the answers they get and the underlying knowledge of those providing those answers. From these conversations, strategists can infer additional risk considerations that will enhance the audit effort and reduce the risk thereof. 

Full disclosure: Although I've been a strategist for 32 years--in June 1983, I entered a PhD program in strategic management, but I didn't complete it--I was an internal auditor, a Controller, and a CFO before that. I am a CPA, and I also hold the Chartered Financial Analyst designation. I had hired and fired audit firms before I began to study strategic management.

If any readers of this post have questions or would like clarification of what I've said here, please contact me at: [email protected].

Auditors should consider all corporate governance (CG) mechanisms (internal and external) when auditing high risk areas. My paper "The role of audit committee in CG", among other papers, refers.

I agree with you all that the external auditors need to be professional and be skepticism in their approaches and procedures. Due diligent and exercising high level quality audits will help gain confidence among the stockholders (and stakeholders). Years ago, I recall the audit profession has called upon focusing on risk-based auditing, but now, this seems lost in the recent literature. Any thoughts and comments?

After the dot-com implosion in 2000, Enron's collapse late in 2001, and WorldCom's disintegration in the spring of 2002, the U.S. Congress enacted the Sarbanes-Oxley Act of 2002, which then-Pres. GW Bush signed into law. The new law created the Public Company Accounting Oversight Board (PCAOB - pronounced 'Peek-a-boo' here in the states). About the first official act of PCAOB was to revoke the authority of the American Institute of CPAs to make ANY GAAP pronouncements for public companies. That was because PCAOB believed--rightly, in my view, that the AICPA was too much under the influence of the Big Four accounting firms and, as such, had helped contribute to the accounting fraud.

PCAOB was (and is) certainly right in its belief that AICPA is a wholly owned subsidiary of the Big Four accounting firms (which I call, with apologies for my crudeness, 'The Four Whores' [TFW]. TFW would sell their mothers if they thought they could make money doing it. They are shameless and relentless. In my view, audit firms should be stand-alone. That is, they should offer no other services--no tax returns, no IT consulting, none of that stuff. The problem w/that idea is that auditors have never figured out a way to deliver value to their clients. Most public companies get audits, not because they want them or think they need them, but because they have no choice in the matter: All public companies in the U.S. must get an annual audit.

The problem, as one can anticipate, is that the audit firms lose their sense of independence and, in essence, climb in bed with their audit clients. The service is, after all, an annuity flow of annual revenue. Building one's "book of business" is the best way to become a partner in one of TFW.

The obvious solution to the loss-of-independence issue is to have mandatory rotation of the audit firms. Not the partners. The firms themselves. So far, TFW has fought off that idea by agreeing to mandatory rotation of the partners-in-charge on the various audits of public companies. I believe that is not enough. If the audit firms know that they will be auditing a company for no more than, say, six years, then any kind of long-lived annuity is out of the question. That frees up the auditors to do what they should have been doing all along: auditing with great skepticism. It's no surprise that the audit 'failures' that have occurred--Enron, WorldCom, Adelphia, etc.--all happened with audit firms that had been audited these firms for decades. Well, life gets too cozy over time, and besides, TFW are not stand-alone audit firms. So they tend to use auditing as a loss-leader while they cross-sell other services (esp. tax returns and M&A).

I also believe that, rather than signing the firm's name to an audit opinion, the signature of the particular partner should be there. That gives the auditor incentives for real independence because, if an 'audit failure' comes later, it's her/his name, not the firm's, that was on the Opinion Letter.

In closing, let me say that, in my 40 years as a financial professional, I've met exactly one (1) audit firm that was truly independent. It was (and is) owned by a sole practitioner now living in Florida. He was a pretty senior partner in the research/policy arm w/one of TFW, but he got banished to a city in a large, sparsely populated state in the western United States because, his firm said, he "pushed back too much and too hard" with against his colleagues who wanted to cave to client's wishes when they shouldn't.

But this guy does the best audit of any firm I've ever seen. It's tough, fair, and no-nonsense. That is because he doesn't look at his firm's relationships with clients as an annuity. As a result, he writes Management Letters that have real 'teeth' in them, rather than the sort of banal pap that appears in those Letters everywhere else. His are the only Management Letters I've ever read that are worth the paper they're written on. Every other such Letter I've read from other firms, including TFW, were suck-up documents that, in essence, talked about the client's hairstyle (figuratively speaking) when the client's feet were on fire.

Audit services CAN deliver value to clients. But audit partners must get their heads of the sand and realize that delivering value starts with the Management Letter.

Gin, risk-based auditing is a good approach towards quality audits. However, it may sometimes not yield the intended results. That is why forensic audits are capable of uncovering the hidden inherent risks, which ordinary external audits are not capable of. The challenge is, forensic audits (or a 100%) review of transactions is costly and time-consuming. Even with regard to value-add, you may perform such an extensive audit and not find any anomalies. And that is why, for external audits, a risk-based approach provides a convincing case of a quality audit.

Dr. Mathuva, this is interesting. We need to define and differentiate between a risk-based auditing and a forensic audit. In reality, it is not cost benefit for auditors to conduct forensic audits for all the assignments.

Please share your thoughts and suggestions.