THE MANAGEMENT OF RISK IN THE AUDIT OF SMALL ENTERPRISES
O. I. WALE AWE B.Sc., PGD, FCA
Department of Accounting, University of Ado-Ekiti, Nigeria.
Professionals undergo serious training in order to become experts in their various fields. They are expected to apply their expertise in a flawless manner. Within human limits they are authorities in these fields. Given the same parameters, it is expected that other experts would give the same opinion at all times. In most cases he issues a certificate to state his opinion on the situation at hand. He is, by implication, telling the whole world that he is accountable to them for believing him. This is a great risk. In his own interest he must be perfectly sure before appending his signature.
The auditor is such a professional. His expertise is the weight behind his report and opinion on financial statements. His name and signature form a stamp signifying a notice of general acceptance of the financial statement to which it is affixed. He is saying that he has examined the accounts of the entity and certifies that it is true for all uses and fair to all users. What if he is wrong? He may have even been given deceitful evidence.
What a risk! In this paper we shall be looking at the sort of risk the auditor faces in the audit of small enterprises. How can he identify such risks and evaluate their potential impact on his practice? What measures can he take to eliminate them or reduce their impact?
Life itself, per se, involves taking risks and so, too, does business whether of manufacturing goods or of rendering services. Risks are associated with the success or failure of particular activities or endeavours. The management of risk, therefore, should include the arrangement of activities and the control of the use of resources in such a way that the occurrence and effect of uncertainties is minimised.
An audit is defined as an independent examination of the books and accounts of an enterprise by a duly appointed person to enable that person give an opinion on the financial statements prepared therefrom: whether it shows a true and fair view and complies with relevant statutory and regulatory guidelines. In expressing his opinion the auditor takes all reasonable care to ensure that it contains no material misstatement. The probability of such misstatements going undetected, in the course of his audit, exposes him to some risk.
The combination of statutory regulations, accounting and auditing standards, and the profession places a great responsibility on the auditor to maintain high standards of technical competence, independence and ethical conduct in his audit assignments. This is to reduce his exposure to the potential risk that is inherent in all audits. Audit risk refers to the probability of damages to the auditor as a result of giving an opinion that is wrong in some material particular. This risk can lead to losses that include a loss of the client audit, a loss of his reputation in the business community and a payment of damages to offended parties. Every audit poses some potential risks. However strong the audit evidence there is always the possibility of errors and frauds going undetected.
To manage a normal audit risk the auditor should organise his firm in a competent manner and follow auditing standards and guidelines. In this way, he would never be found negligent and may not have to pay damages as a consequence of errors or frauds not discovered by him. The majority of audits, however, contain at least one area of high risk or the other. In such cases the auditor should approach his assignment with an inquiring mind and he should
• employ high calibre audit staff
• collect a wide range of audit evidence in the area of suspicion
• probe risk areas to the bottom
• be meticulous in the preparation of his working papers, and
• take extreme care in drafting his audit report.
Small enterprises pose special problems. The auditor should understand their special features and the problems they pose. In this way he would design his audit approach to manage the associated risk accordingly. A small enterprise is one in which the administrative and operational management are in the hands of one or two people who also make important decisions in that enterprise. This is an all embracing definition that covers about 85% of all small enterprises regardless of any other way they are defined. Generally speaking, any definition of small enterprises would depend on their activities, the purpose of the definition, and the level of development of the country where the enterprise is located.
Some business activities tend to be the preserve of small enterprises while others tend to be mostly in the hands of large enterprises. Motor garages give impressions of small enterprises in Nigeria but specific company names like Leventis Motors beat such a generalisation. The purpose for which the term “small enterprise” is defined will definitely narrow down the definition. For the purpose of lending to small scale enterprises the Central Bank of Nigeria defined small scale enterprise as those enterprises with a turnover of up to =N=500,000 only and the Ministry of Trade defined it as any manufacturing and service industry with a capital not exceeding =N=150,000 in machinery and equipment. Small enterprises exist in all countries whatever the level of development, but the level of the country’s development would determine what constitutes a small enterprise. Thus what is categorised a small enterprise in the USA might be ranked a medium enterprise in Nigeria.
In Nigeria, the Companies and Allied Matters Decree (CAMD), 1990 in section 351 defines a ‘small company’ as follows:
• a private company with a share capital
• its turnover for the year shall not exceed =N=2million
• its net assets value shall not exceed =N=1million
• all its shareholders are Nigerians
• none of its shareholders is a government, government agency, corporation, or its nominee, and
• its directors must collectively hold not less than 51% of the company’s share capital.
The criteria for describing an enterprise as “small” might be the numbers of employees, capital investment or value of sales as the CBN, the Ministry of Trade and the CAMD definitions reveal. But the main factors distinguishing a small enterprise from a large one are the following
• finance source (personal or family savings)
• management (where the manager has close personal contact with the whole enterprise)
• operations (where the enterprise operates in a limited geographical area)
With this background, we can identify the risk inherent in the audit of small enterprises.
An auditor would see the following as characteristics of small enterprises. By these very characteristics, small enterprises harbour the risk of errors and frauds going undetected by the auditors.
• Close involvement of directors or proprietors.
The day-to-day involvement of the proprietor in initiating, handling, processing and recording of transactions may either increase or decrease the risk of material misstatement being present in the accounts.
• Proprietary domination and management override of controls.
No one questions his authority because he is owner and therefore he bypasses controls imposed on subordinate management and staff.
• Poor organisation and management controls.
His judgement as a one-man management is weak and is susceptible to personal prejudices.
• Small staff establishment. The level of operation is usually small. Staff vacancies are filled when it becomes glaringly obvious that it can no longer be tolerated ‘profitably’.
• Few classically segregated controls features.
The smallness of staff makes segregation of duties impracticable. To the proprietor, the level of operation does not justify the employment of staff to the extent of allocating specific functions to particular employees. Whoever is available does whatever is to be done.
• Inadequate or non-existent internal controls.
The owner relies on personal supervision that works at best where he can do the job all alone. For example, he might decide to receive all monies but the storekeeper issues out goods in excess of quantities paid for and later goes to negotiate with the customer for his part of the bargain. The storekeeper might even be his first son.
• Poor operation of existing controls.
The proprietor, probably on the advice of his auditor, might institute a system of internal controls. This will barely run for months before he discards the system on the complaint of unnecessary policing and a bondage to auditor-inflicted boring paperwork.
• Incomplete records.
Most transactions are unrecorded albeit unwillingly. The lean staff and nonchalant attitude to paperwork make it almost difficult having complete records and book of accounts. For example, cheque-book counterfoils are often missing at the time of audit and there are no compensating source documents to corroborate available evidence. At times cash duly drawn from bank could not be accounted for while there are also application of fund for which the source could not be explained.
• Insufficient audit evidence.
Where there are documents and information on transaction they may be too weak to support or explain the base transactions. Corroborative evidence is rare. The auditor spends hours to extract information but ends up with evidence not fair enough to rely upon.
• Absentee Proprietor.
Occasionally, the enterprise is managed by someone else on behalf of an ‘absentee’ proprietor. This is an environment that is generally low-paying, where there is no promotion, no pension scheme or job satisfaction and yet the controls are weak or non-existent. The auditor should therefore probe matters to the bottom where his suspicion is aroused.
This is the type of environment in which the auditor operates while auditing the accounts of small enterprises. We can now ask ourselves, ‘what impact does this have on the auditor’s work and practice?’
ASSESSMENT OF IMPACT
The existence of these risks points to the potential errors in the accounts of small enterprises. The implication is that a non-discovery renders his opinion misleading to users.
It is the responsibility of proprietors to prevent and detect fraud and irregularities. They should discharge this duty by installing an effective internal control system. It is not the duty of auditors to search for fraud and irregularities. This being the case, how does a non-discovery of fraud affect him?
An effective internal control system ensures that records are accurate, reliable and error-free; that fraud is prevented and uncovered; and that assets are safeguarded. In small enterprises where these controls are not in operation, the accuracy of the records are suspect and they cannot be relied upon by the auditor. For example, sales are mostly on cash and discounts are given on bargained rates. This gives a large margin for irregularities and fraudulent practices both from management and employees. Management would defraud to evade tax, divert funds and use business assets for private purposes while employees would make fictitious payments, introduce ‘ghost’ workers to the payroll and misappropriate cash. In an environment where these activities prevail, how does the auditor discharge his duty without giving a misleading opinion?
The auditor is expected to recognise the possibility of material fraud or irregularities which, when not disclosed, would distort the state of affairs shown by the financial statement. He should apply existing auditing standards and guidelines in auditing the accounts. This is the best practice and the jury knows it. A proof of negligence on his part will spell legal liability. He should therefore plan his work so that he can detect material misstatements emanating from fraud and irregularities.
In planning, performing and evaluating the results of his audit procedures, the auditor should neither assume that the proprietor is dishonest nor assume unquestioned honesty. He should recognise that audit evidence needs to be evaluated objectively to determine whether the financial statements are free of material misstatement.
In assessing the effects of the proprietor’s involvement in the business, and his attitude, on the risk of there being material misstatements in the accounts, the auditor may also take account of his knowledge of the proprietor and of the business gained from previous audits. For instance, whilst the auditor may identify a potential motivation to understate or overstate profits, his experience, from previous audits, of the proprietor’s attitude and actions may contribute to his forming the view that the risk of misstatement on one or other direction is not, in the circumstances, high. Equally, the auditor’s experience may suggest that the proprietor’s checks are not as effective as they could be and consequently in practice the risk of material errors is not significantly reduced.
As in all audits, the auditor should have regard to any motivation the proprietor may have to cause the reported profit to be misstated. The features of an owner-managed business increase the risk that misstatements may occur. However, the auditor should be careful to distinguish between recognising the increased risk arising from this and assuming that the proprietor is dishonest.
MANAGING THE RISKS
The auditor must take special steps to manage the high risk inherent in small audits by ensuring a good quality audit file and by taking special care in drafting his audit report. His knowledge of the client’s business and of its proprietors would help him in taking decision on the depth of work to be done, the areas of emphasis, the wordings of his report and how to give his opinion.
KNOWLEDGE OF THE BUSINESS
Generally speaking, auditors of small enterprises know their duties very well. They understand the business, its qualities and problems. They are conversant with the industry, business environment and the regulations controlling it. This is made more possible because of many consulting jobs and accountancy services they perform for the clients. The size of the company allows for a close study and quick understanding. With a good knowledge of the business, the auditor knows the areas of potential risk and therefore plans his work to extensively cover such areas and satisfy himself that every figure is adequately substantiated. A comparative analysis of year to year figures and against industry averages guides him in identifying key figures in the accounts and the need for a detailed analysis and tests.
KNOWLEDGE OF THE PROPRIETORS AND MANAGERS
The size of operations and management makes it possible for the auditor to be close to the proprietors or managers. He knows their skills, weaknesses, interests and fears. Such familiarity helps in his audit assurance as the background knowledge of the proprietors means familiarity with the management and operations controls of the enterprise. The auditor knows when to trust him. He will, in most cases, inadvertently confide the truth to the auditor. The auditor should strive to know him the more as years go by.
The characteristics of small enterprises form a background information upon which the auditor relies in drawing up his audit approach. He should concentrate more on substantive verification of balance sheet items and a critical analysis of accounts against expectations. Further substantive work would be necessary to determine the completeness and accuracy of the source documents from which the records have been created to identify undisclosed liabilities and to discover whether the enterprise is a going concern. When put on enquiry, he should probe the matter to the bottom.
Usually the auditor of a small enterprise may also be engaged to carry out a significant amount of accountancy work. In carrying out this work he may obtain audit evidence relevant to meeting certain audit objectives. This will be the case where the accountancy work directly substantiates one or more aspects of transactions or balances. For instance:
• the auditor examines prime documentation (such as invoices or paid cheques) which supports a transaction or a balance.
• the auditor himself calculates a balance for inclusion in the accounts.
• the auditor posts entries in the books of account.
The information provided by the accountancy work must be relevant to one or more of the objectives set by the auditor in order to build up the necessary audit evidence on which to base his audit opinion. The audit evidence derived should be recorded in the working papers relating to the audit objective to which the work is relevant.
REPRESENTATIONS FROM MANAGEMENT
The auditor should not rely solely on the unsupported oral representations of the proprietor as being sufficient reliable evidence when they relate to matters which are material to the financial statements. Oral representations should be corroborated by checking with sources independent of the enterprise or by checking with other evidence obtained by the auditor. He should ensure that there is no evidence which conflict with representations of the proprietor.
The auditor should ask for written confirmations of all representations made and this should be included in his file. He must decide whether the total of other evidence and representations from management are sufficient for him to form an unqualified opinion.
LETTER OF WEAKNESS
It has been established that it is characteristic of small enterprises to operate with little or no controls in place. It is therefore of no use attempting to identify and report significant weaknesses in internal controls. The auditor should discuss the situation with the proprietor and confirm that it is not possible to comment effectively on such controls as might exist.
It is important for a good audit file to reflect the following
• the audit approach as determined at the planning stage
• the enterprise’s accounting system showing the books and records and their functional inter-linkages
• a note on the extent of the auditors involvement in accounts preparation sufficient to avoid duplications in the course of audit work. Areas of importance are reconciliation of control accounts, preparation of schedules of accounts and prepayment as pertaining to rent, insurance, etc.
• the auditor’s assessment on the adequacy of basic management controls such as payments authorisation, cheque requisition and issues, periodic surprise cash counts, payroll checks and stock taking procedures.
• the auditor’s level of confidence in each main functional area of the business.
• the determination of the materiality levels and the sample sizes.
• the verification and analytical review work performed in the course of the audit.
The auditor’s documentation should be concise with cross-references and linkages from subsidiary sources through sectional totals to actual figures shown on the financial statements. The working papers should be pre-printed in the various sizes and formats as dictated by prior experience. He should have standardized audit manuals on various types of audit assignment that would be a form of checklist and therefore assist in ensuring that all grounds are covered in reviewing the client’s books and records. There should be properly prepared engagement letters, bank confirmation and solicitors’ letters, and many other correspondences necessary in obtaining audit evidence. Representation should be obtained from management in areas of doubt and these should be filed accordingly.
With a properly prepared audit file, the auditor would be able to marshal a secure defence
against claims of damage in cases of any alleged misstatements on his part.
The auditor should not be over-dependent on a particular client. This can be achieved by ceding other non-audit services to other firms. Fees should not be charged below the minimum so as to give the auditor enough room to cover his costs and therefore expend the required energy on the job to produce the prescribed quality output. Otherwise there is the temptation of laying emphasis on high paying jobs and rushing through the low fee paying ones. This increases the audit risk seriously, as the low fee-paying clients are in most cases the ones that are in deep financial and management difficulties with the attendant control breakdowns.
The auditor needs to obtain the same degree of assurance in order to give an unqualified opinion on the financial statement of both small and large enterprises. How does this become possible in the light of those major control weaknesses characterising the small business environment? Or does the auditor qualify his opinion at all times?
1. It has been established that the approach in small audits should involve extensive substantive tests and analytical review procedures. If this supports an unqualified opinion, then the auditor should give it.
2. There will be other situations where the evidence available to the auditor is insufficient to give him the confidence necessary for him to give an unqualified opinion. In such situations the report may be one which indicates the need to accept the assurances of management as to the completeness or accuracy of the accounting records. Such a report should contain a “subject to” opinion. He will give such a report only if he is satisfied that
• the system of accounting and control is reasonable, having regard to the size and type of the enterprise’s operations, and is sufficient to enable management to give the auditor the assurances which he requires.
• there is no evidence to suggest that the assurances may be inaccurate.
The auditor should consider referring to the specific areas of the financial statements in which he has had to rely on assurances. The following example is from the auditing standard on Audit Report examples.
We have audited the financial statements on pages ...........to.......... Our audit was conducted in accordance with approved Auditing Standards having regard to the matters referred to in the following paragraph.
In common with many businesses of similar size and organisation the company’s system of control is dependent upon the close involvement of the directors (who are also major shareholders). Where independent confirmation of the completeness of the accounting records was therefore not available we have accepted assurances from the directors that all the company’s transactions have been reflected in the records.
Subject to the foregoing, in our opinion the financial statements, which have been prepared under the historical cost convention give a true and fair view of the state of the company’s affairs at 31st December 19 ............. and of its profit and source and application of funds for the year ended and comply with the Companies and Allied Matters Decree 1990.
If the system of internal control over the major areas of the company’s affairs is considered to be adequate and the limitations are confined to non-fundamental areas, it might be appropriate to describe the areas in which there are limitations and to give a subject to opinion. This is a method of reporting when a scope limitation is confined to specific areas. For example:
We have audited the financial statements on pages ...to... Our audit was conducted in accordance with approved Auditing Standards except that the scope of out work was limited by the matter referred to below.
One branch of the company did not carry out a physical count of stock at 31 December
19 ........ and there was no practicable alternative auditing procedures that could apply to confirm quantities. Accordingly, we have been unable to obtain all the information and explanations considered necessary to satisfy ourselves as to the existence of stock valued at =N= ... at 31st December 19 ... which is included as part of the total stock of =N= ... in the balance sheet. In our opinion, in the case of the stocks referred to above, proper accounting records have not been kept as required by the Companies and Allied Matters Decree, 1990.
Subject to the effects of any adjustments which might have been shown to be necessary has a physical count of the branch stock been carried out, in our opinion the financial statements, which have been prepared under the historical cost convention, give a true and fair view of the state of the company’s affairs at 31st December 19... and of its profit and source and application of funds for the year ended and comply with the Companies and Allied Matters Decree, 1990.
3. Where the lack of evidence of the operation of internal controls coupled with the inability to adopt alternative auditing procedures to compensate is regarded as so
fundamental as to prevent an effective audit being carried out, a disclaimer opinion such as that set out below will be appropriate.
We have audited the financial statements on pages ......... to.......... Our audit was conducted in accordance with approved Auditing Standards except that the scope of our work was limited by the matter referred to below.
A major part of the company’s income comprises cash sales. There was no system of control over such sales upon which we could refer for the purpose of our audit and there were no satisfactory procedures that we could adopt to verify the completeness of the income. We were therefore unable to obtain all the information and explanations we consider necessary. Consequently, we were unable to satisfy ourselves as to the completeness and accuracy of the accounting records.
Because of the significance of the matter referred to in the preceding paragraph, we are unable to form an opinion as to (1) whether the financial statements give a true and fair view of the state of the company’s affairs at 31st December 19 ... and of its profit and source and application of funds for the year then ended, (2) whether proper accounting records have been kept, or (3) whether the financial statements comply with the Companies and Allied Matters Decree, 1990.
In this particular case the lack of evidence of the operation of internal controls coupled with the inability to adopt alternative auditing procedures to compensate has been regarded as so fundamental as to prevent an effective audit from being carried out.
This disclaimer of opinion would apply irrespective of the accounting convention adopted. Reference to an accounting convention should therefore be omitted from the opinion paragraph because such a reference might imply that a different form of opinion could be given under a different accounting convention. In order to distinguish the financial statements from statements prepared under an alternative convention it may be appropriate to include a reference to the accounting convention in the first paragraph of the report viz.:
... the financial statement on pages ...to ... which have been prepared under the historical cost convention. Our audit was conducted in accordance with approved Auditing Standards except that...
Completeness of records is one of the objectives the auditor will wish to achieve in the course of the audit. He may find this particularly difficult in the audit of small enterprises. The proprietor is the only one who can ensure that all transactions are recorded and he can use that dominant position to ensure that some transactions are excluded from the records. The proprietor’s representations may provide a limited amount of the evidence the auditor requires in respect of completeness but they would never provide all the necessary evidence.
Given the risk of misstatement inherent in small enterprise audits, the auditor should have a sound knowledge of the business and its proprietor. This will form a yardstick for assessing the reliability of representations from management as corroboration for other audit evidence. He must exercise his professional judgement to determine whether to qualify his opinion or not. Furthermore, notwithstanding all his diligence and care, the auditor should take professional indemnity insurance.
1. A. H. Millichamp, Auditing: An Instructional Manual for Accounting Students, 4th Ed.,
ELBS/DP Publications, 1987.
2. The Auditing Standard, The Audit of Small Businesses, 1991.
3. The Auditing Standard, Audit Report Examples, April 1980.
4. The Auditing Standard, Qualifications in Audit reports, April 1980.
5. The Auditing Standard, Representations from Management, July 1983.
6. Milan Kubr (Ed), Management Consulting: A guide to the profession. 2nd Rev. Ed.,
7. Emile Woolf, Small Company Audits: Satisfying the Regulators, Accountancy, April 1991.
8. Federal Government of Nigeria, Companies and Allied Matters Decree, 1990.
9. Tony Ewelike, Small Scale Business Finance: The Lending considerations. The Nigerian Banker,