Risks at the financial statement level: overall responses
How to recognise risks that affect the financial statements as a whole, such as a weak control environment, and the overall responses ISA 330 expects.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Some risks sit in one balance: a complex provision, a revenue stream with unusual contracts. Others sit everywhere. A financial director who resigned mid-year and was never replaced. An owner who treats the company bank account as his own. A business so anxious about a lender's covenant that every estimate leans the same way. These are risks at the financial statement level, and no single extra procedure on one account answers them.
They call for a different kind of response, one that changes how the whole audit is staffed, supervised and run. This article explains how to spot them and what the overall responses look like on a real file.
Pervasive rather than assertion-level
A risk at the assertion level attaches to a particular class of transactions, balance or disclosure and a particular assertion, such as the valuation of inventory or the occurrence of revenue. A risk at the financial statement level relates to the statements as a whole and can affect many assertions at once. Common sources include:
- a weak control environment, or management lacking competence or integrity;
- pressure on management from lenders, investors or the owner's personal finances;
- major change, such as new systems, new management, rapid growth or sharp decline;
- doubt about going concern;
- poor accounting records that undermine evidence across the file.
Recognising them matters because the response differs. The IAASB states that the ISA 315 (Revised 2019) risk assessment requirements are intended to support more focused responses under ISA 330. For a pervasive risk, the focused response is an overall one.
The tone at the top
Investopedia explains that the control environment, set by the board of directors and management leading by example, establishes for all employees the importance of integrity and a commitment to rooting out improprieties, including fraud. When that environment is weak, every control beneath it is weaker than it looks on paper. An approval control means little if the approver signs whatever the owner puts in front of them.
Evidence about tone usually comes from behaviour rather than policy documents: how management responded to last year's management letter, whether month-end adjustments come with explanations, whether staff feel able to raise problems, and how the board deals with a director's overspending.
Overall responses that change the audit
ACCA lists overall responses under ISA 330 to risks at the financial statement level, including emphasising to the team the need for professional scepticism, assigning more experienced or specially skilled staff or using experts, and changing the direction, supervision and review of the team's work. It also lists incorporating more unpredictability in the choice of further procedures, and changes to the overall strategy or planned procedures. ACCA's article on ISA 330 and responses to assessed risks sets these beside the assertion-level responses for comparison.
Each one needs to be concrete on the file:
- Scepticism. ACCA explains that ISA 200 requires the audit to be planned and performed with professional scepticism, including a questioning mind and a critical assessment of evidence. For a pervasive risk, say so at the planning meeting and in the briefing notes, and name the areas where management's explanations must be corroborated.
- Experience. Put a senior or manager on the areas most exposed, not whichever trainee happens to be free.
- Supervision and review. More frequent check-ins during fieldwork, earlier manager review of judgemental areas, and partner involvement before conclusions are drafted rather than after.
- Unpredictability. Visit a location not usually visited, change the timing of a test, use a different method, or test items below the usual threshold. If the client can predict the audit, someone determined to hide something can plan around it.
- Strategy. A weak control environment may push the whole audit towards a substantive approach, with more work at year end.
ACCA also notes that ISA 330 indicates that, in general, the extent of audit procedures increases as the risk of material misstatement increases. A pervasive risk raises risk in many areas together, so expect the extent of work to grow broadly rather than in one corner. Linking risks to procedures covers the assertion-level side.
Adding review levels and a quality reviewer in Achekam
In Achekam, the Supervision, Manager and Partner desks each show that level's review queue, returned work and risks, so closer supervision can be organised around what each level sees. Opening a review from a desk does not by itself give sign-off authority, so bringing review forward does not blur who signs what.
For a higher-risk engagement, a partner can name an engagement quality reviewer, who must be a partner or senior manager not on the engagement team, and that person must clear the audit report before it can be issued. Achekam does not require a reviewer for any engagement type at a South African firm, so naming one there is the firm's own decision under its quality management policies. A risk that touches the whole set of statements is often a good reason to make it. The engagement partner's own supervisory role is covered in supervision under ISA 220.
Planning the extra senior hours
Overall responses cost time, and mostly senior time. In Achekam, staff can compare each engagement's planned hours with the hours logged, and see a people-by-weeks capacity plan in which a week with no capacity recorded shows as "not set". Build the extra manager and partner hours into the plan at the start, check that the people who must provide them have capacity in the weeks of fieldwork, and watch planned against logged as the audit runs. If senior hours on a high-risk file are falling behind plan, the response is probably not happening as designed.
Explaining the response to the client
Clients notice when an audit changes: a manager on site more often, requests from areas never examined before, questions put to staff outside the finance team. Explain in general terms why, without signalling exactly what will be tested, because unpredictability only works while it stays unpredictable. At the planning meeting and in the communication to those charged with governance, it is usually enough to say that the team has identified matters affecting the statements broadly and has adjusted staffing, supervision and procedures in response. If the fee changes, explain that too.
The test of a good overall response is simple: someone reading the file should be able to see that this audit was run differently from last year's, and why.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
