The Business Risk Audit Redux

In the 1990's, prior to the twin audit scandals of Enron and WorldCom that preceded the Sarbanes‐Oxley Act of 2002, most large audit firms were actively redesigning their audit methodology to better reflect the link between the business risk of a client and the risk of an audit. These methodological innovations were generally referred to as business risk auditing (BRA). The regulatory intervention of SOX caused firms to rethink this approach, but the concepts of BRA continued to inform new auditing standards (e.g., ISA 315). In this essay I argue that the increasing complexity of business and the economy we witness today justifies reconsideration and reworking of these concepts to address a set expanding and increasingly complex risks where authoritative audit guidance may be lacking. I discuss three examples: (1) the expanding subject matter subject to assurance, (2) the transformative effect of technology on information processing and decision making and (3) the blurring of organizational boundaries as more of a company's activities occur in a complex network of strategic relationships.