Some of the most difficult audit judgments arise where financial reporting depends heavily on management estimates. Impairment assessments, expected credit losses, fair values, provisions, useful lives and other estimates can contain sophisticated models and substantial amounts of data. Yet mathematical complexity does not eliminate uncertainty. In fact, it can sometimes conceal it. An estimate can appear precise while being extraordinarily sensitive to relatively small chang

One of the lesser discussed challenges in enterprise risk management is that controls can become obsolete without becoming obviously ineffective. A control may continue to operate exactly as designed while the risk environment around it has fundamentally changed. Consider an organization whose cybersecurity controls were designed around human-generated threats. The controls may include authentication, access reviews, phishing awareness and periodic vulnerability assessments.

Traditional auditing is inherently periodic. An auditor examines a defined period, evaluates evidence and ultimately reports a conclusion about conditions that existed during that period. But business risk does not operate on an annual reporting cycle. Fraud can occur tomorrow. A critical control can fail next week. A supplier can become distressed next month. An unusual transaction can occur between two audit visits. The gap between when a risk emerges and when assurance ide

Audit has always been fundamentally concerned with evidence. Yet the modern audit environment presents an unusual paradox: auditors have access to more information than ever before, while determining what constitutes sufficiently reliable evidence is becoming more difficult. ERP systems, data warehouses, APIs, automated controls, cloud applications and artificial intelligence can generate enormous volumes of information. The challenge is no longer simply obtaining evidence. I

Too often organizations mistake motion for progress. Reports were generated. Meetings were held. Approvals were routed. But activity alone does not move an objective forward. Progress is effective movement toward the objective. Everything else is just effort in motion. The same principle applies to internal controls. A control’s value is not measured by how often it operates, but by whether it can actually detect, prevent, or correct what it was designed to address. Controls