Risk Assessment: Observing the Client at Work
One common type of observation is to watch the staff take a count of physical inventory. Visiting the company’s business locations is another. Doing so gives you the opportunity to view the company’s operations beyond what’s in the books and records and to find out about the company’s internal controls.
Observing the client is much like walking around an unfamiliar city. If you can actually experience different points of interest in the city, they become more familiar than they would be if you just read about them in a tourist guide. Make sure you include your observations in your workpapers: the documents you prepare that explain your audit steps.
Touring the business provides you with a baseline as to the validity of facts shown on the books. As you walk around, you can see whether the big assets shown on the balance sheet actually exist. You may also find additional sources of revenue that aren’t recorded. For example, if the property is renting a billboard to another business, is your client reporting that revenue?
Your observations will also key you into what’s on the financial statements that shouldn’t be there. For example, maybe the warehouse is too small to hold the volume of inventory the business reflects on the books.
If so, where’s the rest of the inventory? Is it in another storage facility, or is the cost of goods sold understated? Understating cost of goods sold artificially inflates a company’s net income, which isn’t a good thing when you’re issuing an opinion on the correctness of the financial statements.
You must also determine whether the business is walking the walk when it comes to internal control procedures. You conduct your tours with employees who are knowledgeable about the departments you’re inspecting.
You can verify whether the employees in each department are handling their work duties the way they’re spelled out in the internal controls manuals. You can also find out whether key duties are separated and whether assets are safeguarded per the internal control manuals. (For example, are customer payments locked in a safe until they’re taken to the bank?)