How Auditors Assess Risk, and Why It Sets Your Fee

Understanding that gives you a lever on both the fee and the experience.

The model auditors use

Three components multiply together.

Inherent risk. How likely an error is before you consider any controls. Cash is higher risk than a rent expense. Estimates are higher risk than invoices.

Control risk. How likely your controls are to miss it. In a company where one person does everything, this is assessed as high, and there is no way around that.

Detection risk. What the auditor accepts they might miss. This is the only one they control, and they lower it by doing more work.

The arithmetic is simple. Higher inherent and control risk forces lower detection risk, which means more testing, which means more hours, which means a bigger fee.

The four things that raise your risk

1. Unreconciled bank accounts. If cash is not proved, nothing else can be relied on, and the auditor tests everything harder.
2. Related party transactions with no written agreements. The auditor cannot verify terms that were never agreed in writing.
3. Estimates with no support. A provision of AED 200,000 because it felt right.
4. Prior year adjustments. If last year needed fixing, the auditor assumes this year might too.

Each of these is inside your control and each one costs you money every year until it is fixed.

Where they always look hardest

Revenue, because it is the easiest figure to move and the one management has the most reason to move.

Cut-off around the year end. A sale recorded a week early, or a cost a week late.

Completeness of liabilities. This is the hardest thing to audit, because a liability you never recorded leaves no trace in your books. Expect questions about commitments, disputes and unbilled supplier work.

Anything involving judgment. Impairment, provisions, useful lives, recoverability.

Materiality

Auditors set a threshold below which an error would not change a reader's decisions.

This is why your auditor may find a small error and not adjust it, and it is not laziness. It is the framework working as designed.

It also means the audit was never a guarantee of arithmetical perfection.

How to lower your own risk profile

Reconcile monthly. Put related party arrangements in writing before the auditor asks. Document how you arrived at each estimate at the time you made it, not afterwards. Close the year properly rather than leaving decisions to month 13.

A company doing these things pays materially less than one of the same size that does not, and gets a better management letter.