John, the audit partner in charge of Cash CPA Firm is discussing the concept of risk with a new audit intern, Sarah. Sarah explains that she understands what risk is, but doesn't understand why auditors would need to concern themselves with it. Which of the following represents John's best reply? Risk can really mean anything that stops the company achieving its operational and financial goals. Part of the auditor's job is to identify risks that may materially affect the client's financial statements. Risk is something that all auditors need to be concerned about. The only way that risk can be eliminated is through an effective audit. A major component of risk is the auditors risk of material misstatement, which is inversely related to control and detection risk. Part of what the auditors do toward the end of an audit is complete the risk assessment phase. This involves substantive testing and discussing risk with the client's major shareholders. Sue and Andy are discussing internal control with a new audit intern, Mark. Mark has heard about the importance of internal control from his professor; however he still fails to see why internal control is important. Which of the following represent Sue and Andy's best response to this question? Internal control is required to be implemented by all companies, and is designed to ensure that no misstatements whatsoever exist in the firm's financial statements. None of these answer choices are correct. Internal control is optional for larger companies, as their processes and operations are usually efficient enough to where this type of system is not needed. Internal control is designed and implemented by the client, and helps to prevent and detect misstatements in the firm's financial statements. John and Josephine are working on the audit of Crabtree Enterprises, and are discussing detective controls. John advises Josephine that while he's heard of these controls, he's not really sure where they're used. Which of the following represents Josephine's best response to this question? Detective controls are rarely used by firms these days, as most processes are automated, eliminating the need for them. Detective and preventive controls are really one in the same. They just deal with different a process, that's all. Detective controls look for issues during processing, and are designed to prevent errors and misstatements from occurring at all. Detective controls typically look for misstatements that have already occurred, and are often enacted through IT application controls