Dear Yazzi,
There is a correlation between the assessed level of detection risk
and the depth of the tests performed during the substantive testing
stage: if the assessed level of detection risk is reduced (that is,
that the perceived risk, that a material misstatement in the unaudited
information will not be detected by the auditor, is low), then the
substantive procedures are less time consuming and extensive as they
would have been, had the assessed level of detection risk been higher.
As one can find at Sarbanes-Oxley's:
"[...] an inverse relationship exists between the planned assessed
level of control risk and detection risk. In other words, as the
planned assessed level of control risk decreases, the degree of
assurance placed on the systems of internal controls to prevent or
detect material omissions or misstatements increases, which in turn
influences the nature and extent of substantive tests of details to
reduce detection risk to an acceptable level." (SOURCE: Section 207,
<http://www.cpatalk.com/displaysection.php?level=2&pub_id=IC-Primer&chap_id=IC2&message_id=201>).
They also write further:
"Detection Risk. Detection risk is the risk that the assurer will not
detect a material omission or misstatement that exists in an
individual assertion. Detection risk is a function of both the
effectiveness and application of an assurance procedure. The
practitioner can control detection risk through the selection and
application of tests of the assertion.
[...]
Inherent risk and control risk differ from detection risk in that they
exist independently of the assurance engagement, whereas detection
risk relates to the practitioner?s assurance procedures, which can be
changed at his or her discretion. Detection risk bears an inverse
relationship to inherent and control risk. The practitioner can accept
greater detection risk as the inherent and control risk he or she
believes to exist decline.
Assessment of inherent and control risk in assurance engagements can
be made either separately or in combination, and the risk components
themselves can be expressed in either quantitative or qualitative
terms. Quantitative methods typically use percentages or other numeric
data, whereas nonquantitative methods express risk in terms of a
range, from minimum, through moderate, to maximum. "
(SOURCE: Section 202,
<http://www.cpatalk.com/displaysection.php?level=2&pub_id=IC-Primer&chap_id=IC2&message_id=196>).
Further Reading:
===============
ABREMA, Substantive procedures, <http://www.abrema.net/abrema/sp_g.html>
ABREMA, Achievable detection risk DR, <http://www.abrema.net/abrema/DR_g.html>
Wikipedia, Information Technology Auditing Process,
<http://en.wikipedia.org/wiki/Information_Technology_Audit_Process#Detection_Risk>
Graham Cosserat, Audit strategy, 01 Feb 1999
<http://www.accaglobal.com/publications/studentaccountant/49870>
I hope this answers your question. Please contact me if you need any
clarification on this answer before you rate it. |
