What does significant risk mean on the CPA exam?
Last reviewed
Significant risk. A risk of material misstatement that warrants special audit attention because of its likelihood or its size. Every audit presumes at least one, improper revenue recognition.
Defined against AU-C 315.12.
Worked example
A privately held builder recognizes revenue over time on fixed-price contracts, measured by costs incurred against estimated total costs. Three large contracts are behind schedule, and small changes in the estimated costs to complete would move revenue by several times materiality. The auditor assesses inherent risk for contract revenue at the top of the spectrum and plans to test it substantively, without relying on controls.
What does identifying this as a significant risk change about the audit of contract revenue?
- The risk qualifies as significant because both its likelihood and its potential size put inherent risk near the upper end, before any consideration of controls.
- Even with no plan to rely on them, the auditor learns how the controls over the cost estimates are designed and whether they are in place.
- Because the response is substantive only, it must include tests of details, for example agreeing estimated costs to complete to vendor quotes, engineering reports and costs actually incurred after year end. Substantive analytics alone cannot carry it.
Answer: Contract revenue gets a response aimed at the specific risk, and with no reliance on controls that response must include tests of details rather than analytical procedures alone.
The trap: Answering with a precise trend analysis of gross margin by contract. However tight the expectation, analytics on their own do not meet the requirement for a significant risk tested substantively.
Based on AU-C 315.12; AU-C 330.22.
Which CPA exam sections use significant risk?
Significant risk appears in the AUD section of the CPA exam.
Other terms defined against AU-C 315
- application controls: Controls built into one business process or system, such as a validity check on an input field or a three-way match.
- assessed risk: The auditor's judgment about the risk of material misstatement at the assertion level, combining inherent and control risk.
- control environment: The governance and management functions and the attitudes, awareness, and actions of those charged with governance and management concerning the entity's system of internal control.
- general controls: Controls over the IT environment as a whole -- access, change management, operations -- that everything else depends on.
- general IT control: A control over the entity's IT processes that supports the continued effective functioning of information-processing controls and the integrity of information.
- information and communication: One of the five components of internal control: how an entity obtains the information it needs and gets it to the people who have to act on it.
- information-processing control: A control over processing in an IT application or a manual information process that directly addresses a risk to the integrity of information.
- rights and obligations: The assertion that the entity genuinely owns the assets it reports and genuinely owes the liabilities.
Related terms
- risk of material misstatement: The risk that the statements are materially misstated before the audit begins.
- control risk: The risk that the entity's own controls will not prevent, or detect and correct, a material misstatement on a timely basis.
- inherent risk: The susceptibility of an assertion to material misstatement before any control is considered.
- revenue recognition: Deciding when a sale becomes revenue.
- significant deficiency: A deficiency, or combination of deficiencies, less severe than a material weakness but important enough to merit attention by those charged with governance.
- cash equivalents: Short-term, highly liquid investments readily convertible to known amounts of cash and so near maturity that interest rate changes pose insignificant risk.