Thomson Reuters Corporation · TSX:TRI
Thomson Reuters — Investor Presentation (2022)
61 slides from Thomson Reuters's investor presentation, 2022
Slide 1: Understanding Audit Risk Assessment
Understanding Audit Risk Assessment
Slide 2: Objectives of This Course
Objectives of This Course: • Outline the PPC audit risk assessment process • Understand how to use PPC practice aids to perform and document risk assessment
Slide 3: What is Risk Assessment?
What is Risk Assessment? Risk Assessment Audit • Obtain an understanding of the client, including Procedures internal control • Identify and assess risks of material • Concentrate audit misstatement of the Linkag effort in high risk areas financial statements, whether due to error or e – Inherent ri
Slide 4: PPC Audit Approach
PPC Audit Approach Ste Description p 1 Perform Preliminary Engagement Activities • Client acceptance/continuance • Establish an understanding with the client in an engagement letter 2 Perform Planning and Risk Assessment Procedures • Hold an engagement team discussion • Determine materiality • Perfo
Slide 5: Preliminary Engagement Activities
Preliminary Engagement Activities Client acceptance/continuance Establish an understanding with the client
Slide 6: Client Acceptance/Continuance
Client Acceptance/Continuance Consider: Document • Nature and purpose of • CX-1.1: “Engagement engagement Acceptance and • Preconditions for an audit Continuance Form” • Client’s reputation, integrity, and • CX-1.2: “Engagement competence Independence • Communication with Compliance and predecessor
Slide 7: Establish an Understanding with the Client
Establish an Understanding with the Client • Establish an understanding about: Objectives of the engagement Auditor’s services to be performed, including nonattest services Management’s responsibilities Auditor’s responsibilities Limitations of the engagement • Communicate the understandin
Slide 8: Planning and Risk Assessment Procedures
Planning and Risk Assessment Procedures Hold an engagement team discussion Determine materiality Perform risk assessment procedures Understand the entity and its environment, including internal control Perform a retrospective review of accounting estimates
Slide 9: Engagement Team Discussion
Engagement Team Discussion • Susceptibility of the financial statements to material misstatement, including material misstatement due to fraud or error that could result from the related party relationships • Application of GAAP to the entity’s facts and circumstances in light of its accounting poli
Slide 10: Engagement Team Discussion (cont.)
Engagement Team Discussion (cont.) • Attendance: Engagement partner Key members of engagement team • Document: How and when the discussion occurred, who participated, and decisions about planned responses CX-3.2: “Engagement Team Discussion” CX-7.1: “Risk Assessment Summary Form” (if risks
Slide 11: Materiality
Materiality • Materiality for the financial statements as a whole • Materiality for particular items of lesser amounts • Performance materiality • Component materiality (group audits only)
Slide 12: Materiality (cont.)
Materiality (cont.) • Apply professional judgment • Consider decisions that users make • Use appropriate benchmarks, such as % of assets or revenue • Re-evaluate materiality as the audit progresses. If lower, reconsider: Level of performance materiality Adequacy of procedures
Slide 13: Materiality (cont…)
Materiality (cont…) • Document: Materiality at the financial statement level If applicable, materiality level(s) for particular transaction classes, account balances, or disclosures Performance materiality Factors considered in their determination Any revisions made during the audit The
Slide 14: Risk Assessment
Risk Assessment Two categories of audit procedures: • Risk assessment procedures • Further audit procedures Risk Assessment Procedures Both Provide Audit Further Evidence Audit Procedures
Slide 15: Risk Assessment Procedures Diagram
Risk Assessment Procedures Diagram Observati on and Inspectio n Analytica l Inquiry Procedur es Risk Assessm ent Procedur es
Slide 16: Risk Assessment Procedures (cont…)
Risk Assessment Procedures (cont…) • Performed to obtain an understanding of the entity and its environment, including internal control, for the purpose of assessing risks • All of the procedures should be performed • Inquiry alone is not sufficient to understand internal control • Provide audit evi
Slide 17: Inquiries
Inquiries • Management • Internal audit (if such a function exists) • Other employees • External parties (maybe)
Slide 18: Required Inquiries
Required Inquiries • Inquire about: Entity and its environment Fraud-related matters Related parties Accounting estimates Compliance with laws and regulations Service organizations • Document the inquiries: CX-3.3, “Fraud Risk Inquiries Form” CX-7.1, “Risk Assessment Summary Form” (i
Slide 19: Observation and Inspection
Observation and Inspection • Inspect documents and records • Read management and internal reports and minutes • Read external information • Visit premises and plant facilities • Trace transactions through the system (walkthroughs)
Slide 20: Analytical Procedures
Analytical Procedures • Preliminary analytical procedures • Analytical procedures related to revenue required by AU-C 240 • To enhance understanding of the business and identify potential risk areas • Documented by completing a step on AP-1: “Audit Program for General Planning Procedures” • Add risk
Slide 21: Risk Assessment Procedures
Risk Assessment Procedures • Document the procedures performed • AU-C 230 provides guidance on documenting procedures For inquiries, document the date, name, and title of individual, inquiry, and response For observation, document what was observed, where, when, and entity personnel involved For
Slide 22: Understanding the Entity and Its Environment
Understanding the Entity and Its Environment • Perform risk assessment procedures (inquiry, analytics, observation, and inspection) to gather information about: Industry, regulatory, and other external factors Nature of the entity Objectives, strategies, and related business risks Measurement an
Slide 23: Understanding the Entity and Its Environment (cont)
Understanding the Entity and Its Environment (cont) • Obtain an understanding of the client’s selection and application of accounting policies Are accounting policies appropriate for the entity and consistent with the industry? Are there any changes in accounting policies? 23
Slide 24: Understanding the Entity and Its Environment (cont.)
Understanding the Entity and Its Environment (cont.) • Consider the presence of fraud risk factors • Update information obtained in prior years by performing risk assessment procedures to determine if the information has changed
Slide 25: Using the PPC Approach
Using the PPC Approach • CX-3.1: “Understanding the Entity and Identifying Risks” Key elements of the understanding The consideration of fraud risk factors Sources of information Risk assessment procedures performed • CX-7.1: “Risk Assessment Summary Form” • CX-6.1: “Entity Risk Factors” and CX-
Slide 26: Understanding Internal Control Diagram
Understanding Internal Control Diagram Control Environment Risk Assessment Information and Communication Monitoring Control Activities 26
Slide 27: Understanding Internal Control
Understanding Internal Control • Understand design and implementation • Perform inquiry, observation, and inspection • Inquiry alone is not sufficient to understand the design and implementation of controls 27
Slide 28: Understanding Internal Control (cont.)
Understanding Internal Control (cont.) • Evaluate the design and implementation of controls— Related to significant risks Related to risks that cannot be tested effectively using substantive procedures alone • Understand— How the incorrect processing of transactions is resolved How detail is rec
Slide 29: Understanding Internal Control (cont)
Understanding Internal Control (cont) • Document the following: Understanding of internal control components Sources of information Procedures performed Controls evaluated related to significant risks and risks for which substantive procedures alone are not effective
Slide 30: The PPC Approach
The PPC Approach • Entity-level controls Control environment Risk assessment Information and communication Monitoring • Activity-level controls Financial reporting system Control activities • IT environment and general IT controls
Slide 31: Using the PPC Approach (cont)
Using the PPC Approach (cont) • CX-4.1: “Understanding the Design and Implementation of Internal Control” Evaluate entity-level controls Identify significant transaction classes • CX-4.2.1: “Financial Reporting System Documentation Form— Significant Transaction Classes” Document the processing
Slide 32: Using the PPC Approach (cont…)
Using the PPC Approach (cont…) • CX-4.2.2: “Financial Reporting System Documentation Form—IT Environment and General IT Controls” Understand the effect of IT • CX-4.3.1: “Walkthrough Documentation Memo” or CX-4.3.2: “Walkthrough Documentation Table” For each walkthrough • CX-5: “Activity and Entit
Slide 33: Identifying Significant Transaction Classes
Identifying Significant Transaction Classes • Transaction classes that present a reasonable possibility of material misstatement of the financial statements or disclosures based on: Volume of activity Size and composition of accounts Types of transactions Presence of fraud risks or other signifi
Slide 34: Understanding Significant Transaction Classes
Understanding Significant Transaction Classes • How are transactions initiated and authorized? • How are transactions recorded, processed, and corrected? • How are transactions transferred to the general ledger and reconciled? • What reports are generated and how are they used?
Slide 35: Understanding Significant Transaction Classes (cont)
Understanding Significant Transaction Classes (cont) • Consider control objectives: Completeness: All transactions are recorded Occurrence: All recorded transactions occurred and pertain to the entity Accuracy: Transactions are recorded in the proper amount Classification: Transactions are recor
Slide 36: Documenting Significant Transaction Classes
Documenting Significant Transaction Classes • Narrative description • Focus on key controls and control objectives related to identified risks • How are control objectives achieved? • What controls are in place to address significant or fraud risks? • Are controls properly designed and implemented?
Slide 37: Performing Walkthroughs
Performing Walkthroughs • Select one or a few transactions • Trace from initial creation of the source document to final posting in the general ledger • Inspect documents and records used in processing, make inquiries, and observe procedures being performed
Slide 38: Retrospective Review of Accounting Estimates
Retrospective Review of Accounting Estimates • Performed to evaluate: Effectiveness of management’s estimation process Information relevant to current year estimates The need for disclosure The existence of possible management bias • AP-1: “Audit Program for General Planning Procedures”
Slide 39: Assessing Risks and Developing Responses
Assessing Risks and Developing Responses Assess risks at the financial statement level Develop the overall audit strategy Assess risks at the relevant assertion level Develop the detailed audit plan
Slide 40: Assess Risks at the Financial Statement Level
Assess Risks at the Financial Statement Level • Identify risks that are pervasive to the financial statements and potentially affect many assertions • Assess the risk of material misstatement at the financial statement level • Develop overall responses • Document the risk assessment and the response
Slide 41: Develop the Overall Audit Strategy
Develop the Overall Audit Strategy • Characteristics of the engagement that define its scope • Reporting objectives of the engagement • Important factors that determine audit focus • Resources needed to perform the audit 41
Slide 42: Factors That Determine Audit Focus
Factors That Determine Audit Focus • Materiality levels • Assessed risk of material misstatement at financial statement level • Preliminary identification of high risk audit areas • Whether you plan to test controls • Level of client assistance 42
Slide 43: Assess Risks at the Relevant Assertion Level
Assess Risks at the Relevant Assertion Level • Identify risks of material misstatement (due to error or fraud) for specific— Account balances Transaction classes Disclosures • Consider what can go wrong at the relevant assertion level 43
Slide 44: Assess Risks at the Relevant Assertion Level Diagram
Assess Risks at the Relevant Assertion Level Diagram Valuation Rights or or Obligations Allocation Accuracy Completen or ess Classificati on Account Balances, Existence or Transactio Cutoff Occurrence n Classes, Disclosure s 44
Slide 45: Assess Risks at the Relevant Assertion Level (cont)
Assess Risks at the Relevant Assertion Level (cont) • Assessing risks at the assertion level Are the risks of a magnitude that could result in material misstatement? What is the likelihood that the risks could result in material misstatement? • Likelihood is a function of: Inherent risk Control
Slide 46: Assess Risks at the Relevant Assertion Level (cont..)
Assess Risks at the Relevant Assertion Level (cont..) • Identify significant risks that require special audit consideration Fraud risks Other significant risks • Significant risks often relate to: Significant economic, accounting, or other developments Complex, nonroutine, or judgmental matters
Slide 47: Assess Risks at the Relevant Assertion Level (cont…)
Assess Risks at the Relevant Assertion Level (cont…) • Identify risks for which substantive procedures alone are not adequate • Revise the risk assessment and reconsider planned audit procedures if audit evidence contradicts the original risk assessment
Slide 48: Assess Risks
Assess Risks • Document the following: Risk assessment at the relevant assertion level Basis for the assessment Significant risks Risks for which substantive procedures alone are not adequate • CX-7.1: “Risk Assessment Summary Form” (Part II) 48
Slide 49: The Detailed Audit Plan
The Detailed Audit Plan • The nature, timing, and extent of further audit procedures to respond to the risk assessment (i.e., the audit program) • Provides linkage between the risk assessment and the responses at the assertion level 49
Slide 50: Tailoring the PPC Audit Programs
Tailoring the PPC Audit Programs • No audit program Limited • Used for insignificant audit areas with low RMM • Primarily substantive analytics Basic • Some tests of details (required by GAAS) Basic + • Tests of details and extended analytics Extende • For audit areas or assertions with d higher ris
Slide 51: Performing Further Audit Procedures
Performing Further Audit Procedures Further Substantiv Audit e Procedure Procedure s s Tests of Tests of Controls Details Substantiv Substantiv e e Analytical Procedure Procedure s s 51
Slide 52: Tests of Controls
Tests of Controls • Perform tests of controls if: Relying on them to reduce the risk assessment Substantive tests alone are not adequate • Inquiry alone is not sufficient for testing controls 52
Slide 53: Tests of Controls (cont)
Tests of Controls (cont) • Rotational tests of controls are permitted: Obtain evidence about whether the controls have changed using inquiry, observation, and inspection If controls have changed, rotation is not appropriate Test a control at least once every three years If several controls a
Slide 54: Substantive Procedures
Substantive Procedures • Test all relevant assertions for material account balances, transaction classes, and disclosures • Perform procedures specifically to address significant risks • Substantive analytical procedures alone are not sufficient for significant risks 54
Slide 55: Substantive Procedures (cont)
Substantive Procedures (cont) • Perform the following substantive procedures in all audits: Agree or reconcile the financial statements and notes to the accounting records Examine material journal entries and other adjustments made when preparing the financial statements Procedures required by AU
Slide 56: Documenting Further Audit Procedures
Documenting Further Audit Procedures • Document the following: Nature, timing, and extent Linkage Results, including results of procedures to address management override Conclusion about relying on tests of controls performed in a prior audit 56
Slide 57: Summary
Summary • Completed risk assessment consists of: AP-1: “Audit Program for General Planning Procedures” CX-1.1: “Engagement Acceptance and Continuance Form” CX-1.2: “Engagement Independence Compliance and Nonattest Services Documentation Form CX-2: “Financial Statement Materiality Worksheet f
Slide 58: Summary (cont)
Summary (cont) • Completed risk assessment (cont.) CX-4.1: “Understanding the Design and Implementation of Internal Control” CX-4.2.1: “Financial Reporting System Documentation Form—Significant Transaction Classes” (for each significant transaction class and financial close and reporting) CX-4
Slide 59: Summary (cont…)
Summary (cont…) • Other PPC practice aids related to risk assessment CX-5: “Activity and Entity-level Control Forms” (optional) CX-6.1: “Entity Risk Factors” (memory jogger) CX-6.2: “Fraud Risk Factors” (memory jogger) CX-10.1: “Test of Controls Form” (if controls are tested) CX-12.2: “Aud
Slide 60: SAS No. 145 Highlights
SAS No. 145 Highlights Enhances and clarifies aspects of assessing the risks of material misstatement Introduces or revises key definitions, such as significant risk and spectrum of inherent risk Requires separate assessment of inherent risk and control risk Revises requirements related to u
Slide 61: Questions?
Questions?