Risk Assessments Part III Breaking Bad Habits on Inherent Risk

Statement on Auditing Standards (SAS) 145 now requires a separate assessment of inherent risk and control risk (p. 35-38). For many, this would not appear to be a significant change in practice, as most private company audit practitioners' third-party practice aides already make separate assessments of inherent risk and control risk. However, as we work with firms, we see almost universally, that some inherent risk assessments will inappropriately cite controls and/or audit procedures. In this report, we discuss the proper