As I understand it, the CPA firm reports as to whether the financial statements fairly represent the financial position of the business being audited.
You’re right it is not a risk assessment. It is reporting as to whether the financial statements are accurate. The financial statements could show bad indicators, such as a bad ratio of assets to liabilities.
I hit send too soon. I meant to add there could be red flags on different Financial calculations that one does with the financial statements. But if all the calculations are accurate, that’s all the auditors can really verify and vouch for.