1.1 Business risk is the collective risk faced by a company that engages in business. It encompasses all threats to and organization’s goals and objectives. It includes the chance that customers will buy from competitors, that product lines will become obsolete, that taxes will increase, that government contracts will be lost, or that employees will go on strike.
1.2 The conditions of complexity, remoteness, time-sensitivity, and consequences increase demands by outside users for relevant, reliable (useful) information. They cannot produce the information for themselves because of these conditions. Company managers and accountants produce the information.
1.3 Information risk, in contrast to business risk, is the risk (probability) that the information (mainly financial) disseminated by a company will be materially false or misleading. This risk creates the demand for objective outsiders to provide assurance to decision makers.
1.4 Students can refer to the AAA and AICPA definitions in Chapter 1. Some instructors may want to extend the consideration of definitions to include the internal and governmental definitions (located in Module D).
In response to “What do auditors do?,” students can refer to Exhibit 1.2 and respond in terms of: (1) obtaining and evaluating evidence about assertions management makes about economic actions and events, (2) ascertaining the degree of correspondence between the assertions and the appropriate reporting framework, and (3) providing an audit report (opinion). Students can also respond more generally in terms of “lending credibility” to financial statements presented by management (attestation).
1.5 An attest engagement is: “An engagement in which a practitioner is engaged to issue or does issue a written communication that expresses a conclusion about the reliability of a written assertion that is the responsibility of another party.” To attest means to lend credibility