Auditors generally employ a ‘risk-based’ approach to auditing financial statements. The auditor’s assessment of the risk that a financial statement amount or disclosure is misstated affects the nature, timing and the extent of the auditor’s work on that financial statement amount or disclosure. How is an audit of internal control over financial reporting risk-based?

(Adapted from PCAOB, 2005)