(excerpt from SAS 82)
Risk factors that relate to misstatements arising from misappropriation of assets may be grouped in the two categories below. The extent of the auditor's consideration of the risk factors in category ( b ) is influenced by the degree to which risk factors in category ( a ) are present.
a. Susceptibility of assets to misappropriation. These pertain to the nature of an entity's assets and the degree to which they are subject to theft.
b. Controls. These involve the lack of controls designed to prevent or detect misappropriations of assets.
The following are examples of risk factors relating to misstatements arising from misappropriation of assets for each of the two categories described above:
a. Risk factors relating to susceptibility of assets to misappropriation
- Large amounts of cash on hand or processed
- Inventory characteristics, such as small size, high value, or high demand
- Easily convertible assets, such as bearer bonds, diamonds, or computer chips
- Fixed asset characteristics, such as small size, marketability, or lack of ownership identification
b. Risk factors relating to controls:
- Lack of appropriate management oversight (for example, inadequate supervision or monitoring of reinote locations)
- Lack of job applicant screening procedures relating to employees with access to assets susceptible to misappropriation
- Inadequate record keeping within respect to assets susceptible to misappropriation
- Lack of appropriate segregation of duties or independent checks
- Lack of appropriate system of authorization and approval of transactions (for example, in purchasing)
- Poor physical safeguards over cash, investments, inventory, or fixed assets
- Lack of timely and appropriate documentation for transactions (for example, credits for merchandise returns)
- Lack of mandatory vacations for employees performing key control functions
The auditor is not required to plan the audit to discover information that is indicative of financial stress of employees or adverse relationships between the entity and its employees. Nevertheless, the auditor may become aware of such information. Some examples of such information include (a) anticipated future employee layoffs that are known to the workforce, (b) employees with access to assets susceptible to misappropriation who are known to be dissatisfied, (c) known unusual changes in behavior or lifestyle of employees with access to assets susceptible to misappropriation, and (d) known personal financial pressures affecting employees with access to assets susceptible to misappropriation. If the auditor becomes aware of the existence of such information, he or she should consider it in assessing the risk of material misstatement arising from misappropriation of assets.
