How to Document Audit Risk Results

By Maire Loughran from Auditing For Dummies

As you do your investigative work getting to know your audit client, following your risk assessment procedures, and assessing the risk of material misstatement, you must extensively document everything you do. You use this documentation to provide a clear audit trail of what steps you took so you have written substantiation for the various levels of risk you’ve assessed for the financial statement accounts and transactions.

What seems perfectly evident one day will become less and less memorable as the audit goes forward. Your job while documenting is to be concise yet provide enough information about each audit risk factor so that both you and those at your firm unfamiliar with the client can understand how you reached your conclusions about the factors you’re responsible for.

For example, if your piece of the puzzle is looking at revenue, you document the following information:

Your understanding of the company’s products and services: For instance, if you were looking at a clothing manufacturer, you’d state what types of clothing it makes and briefly discuss its target market: the individuals toward whom it focuses any advertising efforts.

You’d also document your understanding of how the client sells its clothing line: online, retail (selling directly to the end user), and/or wholesale (selling to an intermediary that further markets the goods to the end user).
The business’s revenue recognition policy and whether the method used is appropriate: Revenue is recognized only when it’s earned and realizable. Earned means the business did what it was supposed to do — the good or service has transferred to the customer. Realizable means that, all things being equal, the company will be paid for the good or service.

For instance, the company ships 200 shirts to a small strip-mall clothing store. After the order is shipped, the store closes, and the owner disappears. This is not revenue that can be recorded. The company earned the revenue when it shipped the shirts, but the revenue isn’t realizable.
Any remaining risk: For example, you could state that there’s no remaining risk because the company uses appropriate methods to record revenue and provides an adequate reserve for returned merchandise. If remaining risk exists, such as collectability not being reasonably possible, you’d make a note to that effect.

The workpaper you use to document your actions follows this basic format. Keep in mind that this example addresses only one specific risk factor. To adequately cover all risks, you’ll have many different risk factors, descriptions, and conclusions regarding risk remaining.