4) Auditors assess the risk as a part of an audit. Auditors divide risk into 3 types forming part of the Audit Risk Model:

Inherent Risk (IR): It is the susceptibility of financial statements to material misstatement when there are no internal controls at all. It is the probability of an error or irregularity(fraud). Errors are unintentional and relate to the integrity of the organization's personnel. Fraud is intentional and relates to the integrity of the organization's personnel. Competence and integrity of personnel are the cornerstone of effective internal control.

Control Risk (CR): It is the likelihood that the misstatements exceeding an acceptable level will not be prevented or detected by the firm's internal controls. It is the probablility of a control failure.

Detection Risk (DR): Sometimes called planned detection risk, is a mesaure of the risk that audit evidence will fail to detect misstatements exceeding an acceptable audit risk. It is the risk the auditor is willing to take that an error or fraud goes undetected by audit procedures.

Acceptable Audit Risk (AAR): AAR is the probability of an audit failure and is a function of the 3 types of risk that were just defined. It is the probability that the auditor will conclude that the financial statements "fairly present" and issues an unmodified opinion when the statements are materially misleading.

AAR is a function of 3 things:

1. Management Integrity
2. The number of financial statement users
3. The auditee's financial condition

The lower the management integrity, the lower will be the AAR. The more financial statement users, the lower the AAR. The worse the auditee's financial condition, the lower the AAR.

AAR = IR * CR * DR

OR

DR = AAR / (IR * CR)

WHERE, AAR=acceptable audit risk

IR=inherent risk

CR=control risk

DR=detection risk

Brainstorming is a process of determing the areas where it is highly likely for anyone to commit fraud and after identification of these areas according to the priority model, digging those areas deeper to detect it efficiently and effectively.

In the case of Alpine, the audit personnel have tried to exercise preliminary audit procedures to find out discrepancies in account balances and material misstatements in the financial statements and significant deviations from legal requirements.

Factors should be taken into consideration which affect risk:

• Frequency of independent checks on performance
• Adequacy of organizational controls methods
• Adequacy of communication of authority and responsibility
• Consistency of enforcement of controls
• Adequacy of systems controls that limit access to or physical control of assets, records, software or data.

While considering risk, there is need for regular monitoring of control policies and proicedures as well as regular independent audits to monitor compliance with internal controls.

5) Preliminary Audit Procedures forms part of an overall audit plan to be formulated even before starting of a n audit.

External auditor is required to attest and report on the adequacy of an organizations financial reporting internal controls. In this connection, a perfect approach would be in the given case, a Top Down Risk Assessment (TDRA) which applies to the specific risk factors to determine the scope of work. The steps the auditors should take in this regard are cited as below:

• Identifying and evaluating entity-level controls. Entity level controls are those internal controls that help ensure that management directives pertaining to the entire entity are carried out. Examples like - Policies and Procedures Manual, Whistle Blower Hotline, Code of Conduct etc.
• Identifying significant accounts or disclosures like Cash, Inventory etc.
• Identifying material misstatements risks within these accounts or disclosures like theft risk for cash, risk of obsolescence for inventory etc. Doing this requires determination as to whether an account/disclosure is significant and, if significant, rating the misstatement risks as low, medium, or high. Management is charged with developing a list of assertion level control objectives for each significant account/disclosure and from those objectives developing the risks that have a reasonable possible likelihood to cause material misstatements risk (MMR) in the financial statements.
• Determining which entity level controls sufficiently address the risk.
• Determining which transaction based controls compensate for possibly entity level control failures. For each MMR, controls are identified that will sufficiently mitigate the risk, which is defined as reducing the risk to a low level.
• Determining the nature, extent, and timing of evidence gathering tests needed to complete the assessment of the internal controls.