Assessment of control risk and testing of internal controls?

Question

Are the assessment of control risk and testing of internal controls the most important parts of a modern audit?

Answer 1

In a word, yes.

Those two elements make up the lion's share of an audit to make sure that the financial statements are not materially mistated.

First, you get the engagement - which includes a letter where the auditee will essentially represent the truth to the auditors.

Second, an audit assess the risk of the companies internal controls. If the controls are weak, more testing is needed to gain assurance. If the controls are strong, then less. The level of controls determines the testing based on statistical formulas so that I can and should catch errors.

Third, an auditor begins testing the financial statements, either on a trial basis (e.g. look at individual invoices when testing the accounts payable balance) or on an analytical basis (e.g. receivables should be low in an ice-cream stores since it is an all cash basis, so it probably not mistated if it is low).

Fourth, the footnotes are combed through to make sure that they have proper disclosures.

Fifth, the "management discussion and analysis" is reviewed (but not audited) to make sure it "jives" with the financials.