audit risk

As the examiner says – “An auditor’s response does NOT HAVE to be a DETAILED audit procedure, rather an APPROACH the audit team will take to address the identified risk.”
The key here is that you are specifically responding to the IDENTIFIED risk.

At the “audit planning stage” the auditor is concerned with planning the “nature, timing and extent” of procedures that respond to the assessed risk. Where risks are high:
– the NATURE of procedures will tend to be more substantive (where you wouldn’t expect to be able to rely on controls) – and focus on external sources of evidence (e.g. 3rd parties) rather than internal
– TIMING is more likely to be on or after the reporting date (i.e. a y/e or final audit procedure)
– substantive procedures are likely to be more EXTENSIVE – i.e. larger samples.

But you could have identified risks for which the response would be (or include) to tests controls. E.g. in perpetual inventory system with no full y/e count (M/J19) – the auditor would plan tests of controls to be satisfied that differences in counts during the year are investigated and records appropriately adjusted). The timing of TOCs would obviously be timed before the y/e.

You will see in response answers that there can be quite a lot of “discuss/inquire … (for more information about the risk)”. This (alone) would be very poor as a substantive procedure (because the answer is internal and oral it would require confirmation/corroboration).