Much of the debate over the risk assessment standards and the imposed risk based audit methodology has centered around its applicability to small business clients. The focus of the concerns is over whether a substantive balance sheet approach is superior in these engagements where a small business client may not have adequate internal controls to evaluate in the first place. There are merits to both sides of the argument. Don't most small businesses have informal internal controls such as owner-manager oversight? What is being missed here is not the merit of one approach over the other, but the change in the perception of what it means to audit a financial statement. There has been a continuing trend in the perception that audit work is purely insurance rather than factual assurance of the financial statements. The imposition of the risk based audit approach has only worked as a catalyst to accelerate this perception.
The intent of the risk based approach is to focus the substantive work (the factual assurance) on the most risky areas of the engagement. However the practicality of the matter is that it gets viewed as an exercise in risk management transforming an audit service into an insurance product. This transformation started with the Big Four and the subsequent commoditization of the audit and now has trickled down to all firms performing audits. What are firms doing now to combat this perception?