Risk assessment

Risk assessment

The audit team leader conducts a risk assessment to help them understand and evaluate the risks involved in the audit. Section 3.9 of the Codes of practice lists the requirements for risk assessments.

Risks include:

● Audit risk: the risk that the audit team leader will issue the wrong conclusion.

● Inherent risk: the possibility of there being an error in what's being audited despite the audited body putting in controls. For example, the reliability of electricity meters.

● Detection risk: the risk that the audit team leader will not detect an error or non-compliance that exists. For instance, an audit team leader checks if the emissions calculation is accurate but doesn't review the data that supports the calculation.

● Control risk: the risk that an error could happen and not be detected, corrected or prevented by the audited body's internal control system.

Based on the risk assessment, it's likely the audit team leader will find significant risks.

Rather than try to address these risks, the audit team leader should plan how they will manage these risks using different assurance procedures during the performing phase.

The higher the level of risk, the more detailed the procedures need to be. The procedures should gather enough evidence to lower the risk to an acceptable level.

The audit team leader should document these assurance procedures in the assurance engagement plan.