ACCY 405 Chap.6 Strategic-Systems Auditing and the Client's Business
Strategic-Systems Auditing and the Client's Business
Starting from the business
Module II opens with a strategic analysis of a client and its business processes.
The course objectives explain that the strategic-systems approach asks assurers to identify an organisation's strategic and business risks, which arise from cultural, economic, regulatory and technological factors, because those risks and the organisation's responses shape the relevance and reliability of its performance measures and assertions.
The assurer then decides the nature and extent of evidence each risk needs.
Three sources of evidence
The assigned monograph gives the vocabulary used for the rest of the course. Entity business states are the strategies, conditions, processes, events and relationships of the entity and its environment.
Management information intermediaries are the people, policies, systems, controls and reporting framework that transform those states into records.
Management business representations are the results, from ledgers and statements to management discussion and press releases.
How auditing became risk based
The monograph traces a century of change: auditors moved from checking every record to relying on the client's internal check and testing selectively; a 1930s fraud made inventory observation and receivable confirmation normal procedures; the 1970s brought the audit risk model; statistical sampling split detection risk into sampling and non-sampling risk.
The strategic-systems approach emerged in the 1990s largely to control non-sampling risk, such as misunderstanding the business.
Complement, not replacement
Auditing through the transactions and auditing from the business down are presented as complements.
Understanding the entity helps plan the audit, is audit evidence in its own right and gives context for other evidence, while transaction testing still substantiates the balances.
Why this matters for fraud
The monograph notes that some evidence about the business is far harder for management to distort than its own records, which makes that evidence especially valuable when fraud is possible.
If management were manipulating the figures, every source it controls might carry the same distortion, while market data, customers and suppliers would not.
What this chapter covers
- 01
Strategic and business risk
- 02
Business states, intermediaries and representations
- 03
A century of risk-based auditing
- 04
Sampling and non-sampling risk
- 05
The purely substantive audit
- 06
The top-down route to assertions
Worked example · free
Carry a strategic change down to the accounts
- 2Name the business risk created by the strategy.
- 2Identify the accounts and assertions exposed.
- 2Choose evidence from outside the bank's records.
Key terms
- Strategic-Systems Auditing
- An audit approach that starts from the client's strategy and business risks and works down to the assertions at risk.
- Entity Business States
- The strategies, conditions, processes, events and relationships of the entity and its environment.
- Information Intermediaries
- The people, policies, systems, controls and reporting framework that turn business events into records.
- Business Representations
- Management's portrayals of the business, from ledgers and statements to press releases and analyst calls.
- Non-Sampling Risk
- The risk of a wrong audit conclusion for any reason not related to sample size, such as misunderstanding the business.
- Purely Substantive Audit
- An audit that treats inherent and control risk as maximal and relies almost entirely on substantive tests.
Strategic-Systems Auditing and the Client's Business FAQ
Why does an auditor need to understand the client's strategy?
Strategy creates the business risks that make certain accounts likely to be wrong. Without it, the auditor has no expectation for what the figures should look like and cannot spot results that are too good to be true.
What is the difference between sampling and non-sampling risk?
Sampling risk is the chance a sample misrepresents its population. Non-sampling risk covers everything else, such as misreading the business or a standard, and larger samples do nothing to reduce it.
Does the strategic-systems approach replace transaction testing?
No. The monograph presents the top-down and transaction-based views as complements: the business view directs attention and sets expectations, and detailed testing still supplies direct evidence about balances.
What are the three evidence sources in the KPMG monograph?
Entity business states, management information intermediaries and management business representations: the business itself, the people and systems that record it, and the reports and statements that management produces from those records.
Exam move
Pick a public company you know and write one sentence each on its strategy, its biggest business risk, the account that risk would hit and one piece of outside evidence you would want.
Working through Strategic-Systems Auditing and the Client's Business in ACCY 405? Sia is AskSia’s AI Accounting tutor — ask any ACCY 405 Strategic-Systems Auditing and the Client's Business question and get a clear, step-by-step explanation grounded in how ACCY 405 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
