Risk Assessment: Asking Employees for Information

By Kenneth Boyd, Lita Epstein, Mark P. Holtzman, Frimette Kass-Shraibman, Maire Loughran, Vijay S. Sampath, John A. Tracy, Tage C. Tracy, Jill Gilbert Welytok

To effectively assess the risks associated with an audit client, you need to be assessing more than just the numbers. People run businesses, so talking to employees about the company is important.

Deciding what’s important

After you decide to speak with employees, keep these considerations in mind:

  • Level of responsibility: When asking for information, talk to many different employees in the organization besides management. To get a well-rounded idea of the business, talk with individuals holding different levels of authority, from low-level clerks to senior management.

  • Internal control environment: To assess the strength of the client’s internal controls, you want to question the internal auditors. These employees set internal controls and perform self-assessments. You need to determine whether these employees are competent. Weak controls enforced by incompetent employees are definitely red flags.

  • Employee attitudes about internal controls: Find out whether employees take the internal control process seriously. Keep in mind that the best internal controls available are ineffective if employees don’t follow them. If management enforces internal controls and updates them when new issues arise, the business’s internal control structure is more likely to be strong.

Asking effective questions

After you nail down what information you want to obtain from employees, you can make a list of questions. Here are some questions to ask when assessing risk that are effective in extracting the information you need:

  • When is revenue recognized? Speak with marketing and sales staff. These employees live by their numbers, so they’re familiar with how the company records their portion of revenue. After all, their commissions and bonuses depend on this recognition. Ask them when revenue is recognized: When the product is shipped? When an invoice is sent? You’re looking to see whether revenue recognition guidelines are applied consistently.

  • How closely are performance goals tied to bonuses, raises, promotions, or keeping one’s job? Most of your client’s functioning departments have different performance goals. How much of an employee’s promotion and compensation is tied to reaching the goals? Are the goals realistic, or do they seem unreachable? Understanding these goals can help you identify potential sources of inadvertent errors or motivation for committing fraud that may affect the financial statements.

  • How dedicated is the company to training its employees? Does the company take employee training seriously? Does it make an investment in time and money to train employees properly? Well-trained employees make fewer mistakes, which means the internal controls are more reliable.

These questions are a starting point for assessing risks related to the audit.