Dilnessa Demissie Fenta Auditing and Accounting Service Firm

17/08/2026

10 THINGS EVERY AUDITOR SHOULD DO BEFORE REUSING LAST AUDIT’S RISK ASSESSMENT

If you are an auditor, there is one thing I want you to stop doing.

Do not take last year’s risk assessment, change the date and call it a new risk assessment.

I understand why it happens. You are under pressure. The previous risk assessment is already there. It looks good. The risks are already documented.

But here is the problem.

The business did not stop changing just because you completed last year’s audit.

So before you reuse that risk assessment, here are 10 things you should do.

1. Ask what has changed in the business.

Start with the bas

Has the organisation changed its structure, strategy, operations or business model?

A change in the business can create a completely different risk profile.

2. Check whether there are new systems or technology.

Maybe the organisation introduced a new accounting system, payroll system, payment platform or enterprise resource planning system.

Do not assume the controls around the new system are the same as the old one.

New systems can introduce new risks.

3. Check for changes in key personnel.

Did the head of the department leave?

Was a new manager appointed?

Did someone take over a sensitive role?

Changes in people can affect segregation of duties, approvals, knowledge transfer and accountability.

4. Review changes in vendors and third parties.

A new vendor may mean a new risk.

Ask yourself:

Who are the new vendors?

What services do they provide?

How were they selected?

Are there new third-party dependencies?

Sometimes the risk is not inside the organisation. It sits with the person or company the organisation depends on.

5. Look at changes in transaction volume.

A process handling 500 transactions last year may now be handling 5,000.

The control may have worked perfectly before but may no longer be strong enough for the current volume.

Risk can increase simply because the business has grown.

6. Check for regulatory or policy changes.

Have new laws, regulations, industry requirements or internal policies been introduced?

An area that was low risk last year could become high risk because the requirements have changed.

7. Review previous audit findings.

This one is very important.

Do not just look at the risk assessment.

Look at what you reported last time.

Which findings were resolved?

Which ones are still open?

Which recommendations were only partially implemented?

An unresolved high risk from last year should not magically disappear from this year's risk assessment.

8. Review incidents and unusual events.

Ask what went wrong during the period.

Were there fraud cases?

Customer complaints?

System failures?

Operational losses?

Stock shortages?

Payment issues?

Control breaches?

These events can tell you where the current risks are.

Sometimes the business itself has already shown you where the risk is.

9. Challenge the old risk ratings.

Do not automatically carry forward the same rating.

A risk rated low last year may now be high.

A high risk may have reduced because management implemented stronger controls.

Your job is not to protect last year's assessment.

Your job is to determine the current level of risk.

10. Speak to the people doing the work.

This is one of the most useful things you can do.

Talk to process owners.

Ask them:

“What has changed in this process since our last review?”

You may discover risks that are not visible in the previous risk assessment.

People working in the process every day often know where the real problems are.

And finally, remember this:

Your previous risk assessment is a useful reference, but it is not your answer.

Use it as your starting point.

Then update it based on what is happening today.

Because as an auditor, you are not auditing yesterday's business.

You are auditing the business as it exists now.

So before you change the date on last year's risk assessment, ask yourself:

“What has changed?”

That single question can completely change the quality of your audit planning.

07/08/2026

10 Red Flags Every Auditor Should Watch for During a Cash Count

Cover points such as
I. Staff appearing nervous

II. Delays before producing cash

III. Missing supporting documents

IV. Excess IOUs

V. Numerous unrecorded receipts

VI. Frequent cash shortages

VII. Unusual cash movements

VIII. Poor segregation of duties

IX. Unsecured cash

X. Differences between physical cash and records

Cash counts are not just about counting money. They are about evaluating whether the controls around cash are working effectively.

29/07/2026

How to Audit Revenue Recognition
(A Step-by-Step Guide for Internal & External Auditors)

Revenue is one of the most significant figures in an organization's financial statements.
It is also one of the areas most vulnerable to error, manipulation, and fraud.

Whether you're auditing a manufacturing company, bank, hospital, university, NGO, retailer, or service provider, understanding how revenue is recognized is essential.

Here's a practical guide.

Step I. Understand How Revenue Is Generated

Before testing transactions, understand the business.

Ask questions like
• What products or services does the organization provide?

• Who are the customers?

• How are prices determined?

• When should revenue be recognized?

Without understanding the business model, it is difficult to determine whether revenue has been recorded correctly.

Step II. Understand the Revenue Process

Walk through the entire process.

For example
Customer Order

↓

Approval

↓

Goods Delivered / Service Rendered

↓

Invoice Raised

↓

Revenue Recorded

↓

Customer Payment Received

Identify every control within the process.

Step III. Review Revenue Recognition Policy

Verify whether the organization's policy complies with the applicable accounting framework.

Check
• When revenue is recognized

• Treatment of discounts

• Returns and refunds

• Credit sales

• Advance payments

The policy should be consistently applied.

Step IV. Test Sales Transactions

Select a sample of transactions and verify:

✔ Customer order

✔ Delivery note or service completion evidence

✔ Sales invoice

✔ Accounting entry

✔ Payment (where applicable)

Every sale should be supported by complete documentation.

Step V. Perform Cut-off Testing

One of the most important audit procedures.

Verify that
Sales made before period-end were recorded before period-end.

Sales made after period-end were recorded in the next accounting period.

Incorrect cut-off can materially misstate financial statements.

Step VI. Review Credit Notes and Sales Returns

Check
• Approval for credit notes

• Reason for returns

• Supporting evidence

• Customer acknowledgement

Frequent credit notes may indicate revenue manipulation.

Step VII. Perform Analytical Review

Compare
• Current revenue with previous years

• Monthly sales trends

• Gross profit margins

• Sales by customer

• Sales by product

Investigate unusual fluctuations.

Step VIII. Confirm Customer Balances (Where Applicable)

For selected customers
Send confirmation requests to verify:

• Outstanding balances

• Transactions

• Payments

Independent confirmations provide strong audit evidence.

Step IX. Review Manual Journal Entries

Pay special attention to
• Large manual adjustments

• Month-end journals

• Year-end journals

• Unusual revenue entries

These require additional scrutiny.

Revenue Red Flags

Significant sales recorded on the last day of the reporting period.

Large unexplained revenue adjustments.

Negative sales.

High volume of credit notes.

Unusual discounts.

Revenue without supporting delivery evidence.

Customer disputes over invoices.

Duplicate invoices.

Before concluding your work, ask yourself:

Was revenue earned?

Was it recorded in the correct period?

Is it supported by sufficient evidence?

Does it comply with the organization's accounting policy?

Can I defend my conclusion with evidence?

Revenue is more than a number.

It tells the story of an organization's performance.

Your responsibility as an auditor is to ensure that story is complete, accurate, and supported by evidence.

29/07/2026

AUDIT INVESTIGATION FILE

10 Fraud Red Flags Every Auditor Should Never Ignore

Most frauds don't begin with millions. They begin with small warning signs that people overlook.

Great auditors don't just identify fraud. They recognise the red flags before fraud grows into a major loss.

Here are ten warning signs every auditor should investigate.

🚩 I. Employees Who Refuse to Take Leave
Sometimes, an employee avoids annual leave because they don't want anyone else performing their duties.

Ask yourself
• Who performs their work when they're absent?

• Is there proper supervision?

This may indicate hidden irregularities.

🚩 II. Frequent Manual Journal Entries
Manual adjustments are sometimes necessary.

However, frequent or unexplained manual entries deserve closer attention.

Review
• Who posted them?

• Who approved them?

• Why were they necessary?

🚩 III. Missing Supporting Documents
Every transaction should have supporting evidence.

Missing invoices.
Missing receipts.
Missing approvals.
These should never be ignored.

🚩 IV. Lifestyle That Doesn't Match Income
Auditors should never make accusations based on appearances.

However, significant unexplained lifestyle changes may justify additional review when combined with other risk indicators.

Evidence not assumptions must guide your work.

V. Repeated Payments to the Same Supplier

Review for
• Duplicate invoices

• Split purchases

• Unusual payment frequency

• Vendor concentration

Patterns often reveal hidden risks.

🚩 VI. Excessive Override of Controls
When policies are repeatedly bypassed with the explanation:

"Management approved it."

Pause and investigate.
Frequent overrides weaken internal controls.

🚩 VII. Round Figure Transactions
Payments ending in exact figures repeatedly may deserve additional scrutiny, especially where supporting documentation is weak.

🚩 VIII. Delayed Bank Reconciliations
Late reconciliations create opportunities for

• Errors

• Misappropriation

• Unauthorised transactions

Timely reconciliation is a key preventive control.

🚩 IX. Unusual Activity Near Period-End

Pay attention to
• Sudden spikes in revenue

• Large inventory adjustments

• Unusual expenses

• Significant journal entries

These may affect financial reporting.

🚩 X. Employees Performing Multiple Incompatible Duties
If one person can

✔ Initiate

✔ Approve

✔ Record

✔ Reconcile

the same transaction. The risk of fraud increases significantly.

Segregation of duties remains one of the strongest internal controls.

A red flag is not proof of fraud. It is an indicator that additional audit procedures may be necessary.

Professional skepticism means asking questions, gathering evidence, and reaching conclusions based on facts—not suspicion.

Fraud rarely announces itself. It usually leaves clues. The auditor's responsibility is to recognise those clues early and investigate them objectively.

I hope this helps
Auditribe Cares 🌹

29/07/2026

DAY 27 OF 100 AUDIT LESSONS

One lesson that changed the way I work is this:

Never be afraid to say, "I don't know."

When I first joined audit, I felt pressured to have all the answers.

If a process owner asked me a question I couldn't answer, I felt embarrassed.

I thought admitting I didn't know would make me look inexperienced.

But I was wrong.

One day, during an audit, I was asked a technical question about a process I wasn't familiar with.

Instead of pretending, I simply said,

"I don't know the answer yet, but I'll find out and get back to you."

I went back, spoke to my senior, did my research, and returned with the correct answer.

That experience taught me something I'll never forget.

People don't lose respect for you because you don't know everything.

They lose respect when you pretend to know and end up giving the wrong answer.

Audit is a profession of continuous learning.

No matter how many years you have spent in this career, there will always be something new to learn.

New systems.

New regulations.

New risks.

New industries.

The day you believe you know everything is the day you stop growing.

Today, I am comfortable saying,

"Let me confirm that."

"I'll look into it."

"Can you explain that process to me?"

Those simple statements have helped me learn faster than pretending ever could.

Lesson 27 of 100: You don't have to know everything. You just have to be willing to learn.

Confidence is not pretending to have all the answers.

Confidence is being humble enough to learn the ones you don't know.

That mindset has made me a better auditor, and I believe it will make you a better one too.

29/07/2026

🚨 THE RED FLAG SERIES – DAY 3

Inventory Red Flags Every Auditor Should Never Ignore

Inventory is one of the most vulnerable assets in any organisation.

Why?

Because it can be stolen, damaged, misplaced, become obsolete, or be manipulated to hide losses.

A small weakness in inventory controls today can become a major financial loss tomorrow.

Here are 8 inventory red flags every auditor should look out for.

1. Frequent Inventory Adjustments

Occasional adjustments may be normal.

However, frequent stock increases or decreases without a clear explanation could indicate poor record keeping, theft, or manipulation.

2. Negative Inventory Balances

If the system shows negative stock, it is a sign that transactions are not being recorded accurately or promptly.

This should never be ignored.

3. High Levels of Obsolete or Slow-Moving Inventory

Products that remain in the warehouse for long periods tie up cash and may eventually become unusable.

Ask:

Why has this inventory not moved?

Is there a plan to dispose of or use it?

4. Differences Between Physical Count and System Records

When the physical stock count does not match the inventory records, investigate the cause.

Possible reasons include:

Recording errors

Theft

Unauthorised issues

Weak inventory controls

5. Unrestricted Access to the Warehouse

If too many people have access to the warehouse, accountability becomes difficult.

Access should be restricted to authorised personnel only.

6. Missing or Poorly Documented Stock Movements

Every receipt, transfer, and issue of inventory should be supported by proper documentation.

Missing documents increase the risk of unauthorised stock movements.

7. Delays in Conducting Stock Counts

Regular stock counts help detect errors and losses early.

When stock counts are repeatedly postponed, problems can remain hidden for months.

8. Damaged Inventory Kept With Good Stock

Damaged, expired, or rejected items should be clearly identified and stored separately.

Mixing them with usable inventory can lead to inaccurate records, production issues, and financial misstatements.

Remember

Inventory does not disappear on its own.

When inventory records do not match reality, there is always a reason.

Your responsibility as an auditor is to identify that reason through evidence, not assumptions.

Sometimes the issue is a simple recording error.

Other times, it may reveal a much bigger control weakness.

29/07/2026

HOW TO PROTECT YOUR BUSINESS FROM MISTAKES AND FRAUD USING INTERNAL CONTROL

Starting a business is exciting, isn’t it? You’ve got an idea, a plan, and the determination to make it work.

But let me tell you something critical: no matter how small or new your business is, you need internal controls. I know, it might sound like something only big corporations worry about, but trust me, it’s essential for every startup.

Let’s take a journey today to understand what internal controls are, why they matter, and how you can build them into your startup’s foundation. I’ll keep it simple

What Are Internal Controls?
Internal controls are the systems, processes, and procedures businesses put in place to ensure
that:
1. Operations run smoothly.
2. Assets are safeguarded from theft or misuse.
3. Financial records are accurate and reliable.
4. Compliance with laws and regulations is maintained.

Think of internal controls as the rules of the game. They make sure everyone on your team is playing
fair and working towards the same goal. Without them, even a small mistake or worse, intentional
fraud can derail your business.

Why Are Internal Controls Important for Startups?

You might be thinking, “My business is small; do I really need this?” The answer is a big YES! Here’s
why:

1. Protecting Your Assets
Let me share a real-life example. A small tech startup entrusted their accountant with
managing finances. Since no one else reviewed the bank statements, the accountant
embezzled over $50,000 before anyone noticed. It nearly sank the business. If they’d had
internal controls, like regular financial reviews, this could’ve been avoided.

2. Preventing Errors
Mistakes happen. Maybe an invoice is entered twice, or a supplier is overpaid. These small
errors can add up to big losses over time. Internal controls help catch and correct these
issues before they spiral out of control.

3. Building Trust with Investors
Investors love startups with solid systems in place. Why? Because it shows you’re serious about managing money and minimizing risks. Good internal controls make your business more attractive to potential investors.

Core Internal Controls Every Startup Should Have

Here are some basic internal controls every startup can implement no matter the size or industry.

1. Segregation of Duties
This means dividing responsibilities so no single person has control over all parts of a process.
Example: If one employee handles cash deposits, make sure another employee reviews and
reconciles the bank statements. This reduces the risk of fraud and errors.

2. Regular Financial Reviews
Always, always review your financial records. Check your bank statements, invoices, and expense
reports regularly.

3. Inventory Management
If you sell products, track your inventory closely. Use software or even a simple spreadsheet to
record purchases, sales, and stock levels.

4. Approval Processes
Make sure big decisions require approval from more than one person. This could include approving
expenses, signing contracts, or making purchases over a certain amount.

5. Secure Your Data
Startups often overlook cybersecurity, but it’s crucial. Protect sensitive customer and financial data
with passwords, encryption, and regular backups.

6. Whistleblower Mechanism
Create a safe way for employees to report unethical behavior. It could be a simple suggestion box or
an anonymous email system.

How to Start Building Internal Controls

I know this might sound overwhelming, but building internal controls doesn’t have to be
complicated. Here’s a step-by-step guide:

1. Start Small: Focus on the basics like financial reviews and inventory tracking.
2. Involve Your Team: Train your employees on the importance of internal controls and their
role in the process.
3. Use Technology: Leverage affordable tools like accounting software (e.g., QuickBooks,
Wave) and inventory apps.
4. Regularly Review: Set aside time monthly or quarterly to review your controls and make
improvements.
5. Seek Advice: If you’re unsure, consult an accountant or internal auditor for guidance.

Auditribe

29/07/2026

HOW TO RESPOND TO AN AUDIT OBSERVATIONS

One of the most frustrating moments for an auditor is not finding a control weakness.

It is receiving a management response that says absolutely nothing.

After spending days or even weeks reviewing processes, testing controls, gathering evidence, and carefully documenting observations, the auditor submits a report expecting meaningful feedback.

Instead, the response says:

"Noted."

Or worse:

"We will look into it."

That is not a response.

That is an escape route.

The truth is, an audit observation only creates value when management responds effectively.

A brilliant audit report means very little if the response does not lead to action.

Over the years, I have noticed that many managers are experts in running operations but struggle when it comes to responding to audit observations.

Some become defensive.

Some take the findings personally.

Some rush to close the issue without fully understanding the problem.

And some provide responses so vague that nobody knows what will happen next.

The purpose of a management response is not to argue with auditors.

It is not to impress auditors.

It is not to make the issue disappear.

The purpose is to demonstrate that the organization understands the risk and is committed to addressing it appropriately.

A strong management response should contain five important elements.

1. Agreement or Disagreement

The first step is simple.

Do you agree with the observation?

Or do you disagree?

There is nothing wrong with disagreeing if you have valid facts and evidence.

In fact, healthy professional discussions often improve the quality of audit reports.

However, if you disagree, explain why.

Do not simply write:

"We disagree."

That helps nobody.

Explain the facts, provide supporting evidence, and clearly state your position.

For example:

Good response:

"Management partially agrees with the observation. While the control was operating during the review period, documentation was not consistently maintained, creating the appearance of non-compliance."

Poor response:

"We disagree."

One response creates understanding.

The other creates confusion.

2. Identify the Root Cause

This is where many responses fail.

They focus on the symptom instead of the cause.

Imagine an auditor observes repeated late reconciliations.

The issue is not simply that reconciliations were late.

The real question is:

Why were they late?

Was staffing insufficient?

Was training inadequate?

Was the process poorly designed?

Was there a system limitation?

Without understanding the root cause, the same problem will likely happen again.

A good response might say:

"The root cause was insufficient segregation of duties and limited staff availability during month-end activities."

A poor response would say:

"Staff were late."

One identifies the underlying issue.

The other merely repeats the observation.

3. Define the Corrective Action

This is the most important part.

What exactly will management do to address the issue?

The action should be specific.

Clear.

Measurable.

Practical.

Avoid vague statements such as:

"We will improve the process."

Improve it how?

When?

Who will do it?

What will change?

A stronger response would say:

"A formal reconciliation checklist will be introduced, reviewed by the Finance Manager, and completed before monthly financial close."

Now everyone understands the plan.

4. Assign a Responsible Person

One of the fastest ways for corrective actions to fail is when nobody owns them.

When everyone is responsible, nobody is responsible.

Every action should have a clearly identified owner.

Someone who will drive implementation and provide updates.

For example:

"The Finance Manager will oversee implementation and monitor compliance."

This creates accountability.

Without accountability, recommendations often remain on paper.

5. Provide a Timeline

A corrective action without a deadline is simply a wish.

Every response should specify when the action will be completed.

Not someday.

Not soon.

Not as soon as possible.

A specific date or timeframe.

For example:

"The corrective action will be fully implemented by 30 September 2026."

A timeline allows progress to be monitored and demonstrates commitment.

Now let us compare two real-world examples.

Audit Observation:

Purchase orders were not consistently approved before purchases were made.

Poor Management Response:

"We acknowledge the issue and will improve controls going forward."

This response sounds professional.

But if you look closely, it tells us almost nothing.

What caused the issue?

What controls will be improved?

Who will implement them?

When will they be completed?

Nobody knows.

Now look at this.

Good Management Response:

"Management agrees with the observation. The root cause was inadequate awareness of approval requirements among department supervisors. Mandatory procurement training will be conducted for all supervisors, and the procurement system will be configured to prevent processing without prior approval. The Head of Procurement will be responsible for implementation. All actions will be completed by 31 August 2026."

Now that is a response.

It addresses the issue.

It explains the cause.

It provides a solution.

It assigns ownership.

And it sets a deadline.

Everything an auditor needs to know is there.

The best organizations do not view audit observations as attacks.

They view them as opportunities.

An audit observation is not the end of a conversation.

It is the beginning of improvement.

When management responds thoughtfully, risks are reduced.

Controls become stronger.

Processes become more efficient.

And trust between auditors and management grows.

The next time you receive an audit observation, remember this:

The quality of your response says as much about your leadership as the quality of the process being audited.

Because finding a problem is important.

But taking responsibility for fixing it is what truly moves an organization forward.

What is the worst management response to an audit observation that you have ever seen?

25/03/2026