Figure 6-6 provides eight classifications of process risks that should be considered by auditors when analyzing business processes. For each broad category of risks-people risks, direct process risks, and indirect process risks-describe how the transactions generated within business processes might be at a greater risk of misstatement should these risks not be properly addressed.

Figure 6-6

Transcribed Image Text:

Managerial Risk Lines of authority Performance incentives Institutional constraints Competence Operational Risk Quality of products Cost of processes Cycle time Efficiency People Risks Ethics Risk Management fraud Employee theft Illegal acts Unethical behavior Unauthorized actions Capacity usage Repairs and maintenance Resource utilization and wastage Process failure Process interruption Direct Process Risks Human Resource Risk Competence Performance incentives Hiring and retention Training and development Required skills Information Risk Reliability of information Quality of performance measurement Timeliness of information Relevance Completeness Dissemination and reporting Indirect Process Risks Technology Risk Planning Risk System reliability System adequacy System security Process efficiency System changes Budgeting and planning Incentives Adequacy of resources Performance measurement Regulatory Risk Labor laws Tax laws Environmental laws Health and safety regulations Product licensing