Using the audit risk model to opine on internal control

Using the Audit Risk Model to Opine on Internal Control By Abraham D. Akresh, CPA, CGFM US Government Accountability Office akresha@gao.gov 202-512-9361 ABSTRACT: In recent years, auditors have reported on the effectiveness of internal control, usually as part of an integrated audit. The audit risk model currently provided in auditing standards was designed for financial statement audits, not internal control audits, a key part of integrated audits. Since the audit of processes (internal control) is conceptually different from the audit of outputs (financial statements), the auditor needs a modified audit risk model to provide a conceptual framework for internal control audits. This conceptual framework provides the auditor a method to determine the appropriate nature, timing and extent of substantive testing. In this paper I provide an overview of a proposed model to achieve this purpose. My proposed internal control model is focused on the risk of material weakness, rather than the risk of material misstatement. I also show how the auditor could use two different models in an integrated audit. Key Words: Audit risk model, integrated audit, internal control, risk of material misstatement, risk of material weakness Revised 12/09//08 2 1Using the Audit Risk Model to Opine on Internal Control INTRODUCTION The audit risk model has provided a conceptual framework for auditing practice for more than 40 years. ...