Assessing audit risks
Audit risk is the heart of AA. Section B planning questions commonly give you a page about a company and ask you to "describe audit risks and explain the auditor's response to each". The requirement is predictable, yet it is often answered badly: students list business problems instead of risks to the financial statements, or give vague responses such as "discuss with management". This lesson teaches the theory precisely, then shows the layout markers reward in a full worked scenario, with materiality calculated from the figures.
Audit risk and its components
Audit risk is the risk that the auditor gives the wrong opinion, typically an unmodified one, on financial statements that are in fact materially misstated. It has two parts: the risk of material misstatement, which exists in the client before the audit starts, and detection risk, which the auditor controls.
| Component | Meaning | Who controls it | Example |
|---|---|---|---|
| Inherent risk | How likely an assertion is to be materially misstated, before taking any controls into account | No one: it comes from the nature of the item and the business | A complex estimate such as a legal provision; inventory that may be obsolete |
| Control risk | The risk that the entity's internal control fails to stop a material misstatement, or to find and correct it in time | The client's management | No reconciliation of the payables ledger to supplier statements |
| Detection risk | The risk that the auditor's work fails to find a material misstatement that exists | The auditor | Too small a sample; poorly designed procedures; inexperienced staff |
Inherent risk and control risk together make up the risk of material misstatement (RMM). The auditor cannot change RMM, only assess it. So the auditor manages audit risk through detection risk: the higher the RMM, the lower detection risk must be, which means more, better-targeted and better-timed substantive work.
Detection risk itself has two parts: sampling risk (the sample is not representative) and non-sampling risk (for example, choosing the wrong procedure or misreading the evidence).
Assessing the risk of material misstatement: ISA 315 (Revised 2019)
ISA 315 (Revised 2019) Identifying and Assessing the Risks of Material Misstatement requires RMM to be assessed at two levels:
- the financial statement level: risks that affect the statements as a whole and many assertions, such as weak management integrity, going concern doubts or a poor control environment;
- the assertion level: risks for particular classes of transactions, account balances and disclosures, such as the valuation of inventory or the completeness of payables.
At the assertion level, inherent risk and control risk are assessed separately. Inherent risk is assessed on a spectrum from low to high, using the inherent risk factors:
| Inherent risk factor | Example |
|---|---|
| Complexity | Revenue from contracts with several performance obligations |
| Subjectivity | Estimates such as provisions, impairments and fair values |
| Change | A new accounting system, new products, acquisitions, new standards |
| Uncertainty | Outcomes that cannot be measured precisely, such as a pending court case |
| Susceptibility to misstatement due to management bias or other fraud risk factors | Profit-based bonuses; loan covenants; pressure to meet market expectations |
A significant risk is one where inherent risk is assessed close to the upper end of the spectrum, or one the ISAs say must be treated as significant (such as fraud risks). Significant risks need special audit attention.
If the auditor does not plan to test the operating effectiveness of controls, control risk is assessed so that RMM equals inherent risk. Finally, the auditor stands back and considers whether any material class of transactions, balance or disclosure not yet identified as significant should be.
Materiality and performance materiality: ISA 320
A misstatement, or an omission, is material if, on its own or added to others, it is large enough, or of such a kind, that it could reasonably be expected to change the economic decisions users make with the financial statements. Materiality is a matter of judgement and depends on both size and nature: a small misstatement can be material by nature, for example an error in directors' remuneration or one that turns a profit into a loss or breaches a loan covenant.
ISA 320 Materiality in Planning and Performing an Audit requires the auditor to set:
- materiality for the financial statements as a whole, usually as a percentage of a benchmark that users focus on;
- lower materiality for particular items where smaller misstatements would matter to users, such as related party transactions or directors' pay;
- performance materiality, a lower working threshold set below overall materiality, so that the misstatements the auditor misses, added to those found but left uncorrected, are unlikely to total more than materiality. The higher the risk, the lower it is set.
ISA 320 does not fix percentages. The ranges commonly used in practice, and in AA answers, are:
| Benchmark | Typical range |
|---|---|
| Profit before income taxes | 5% to 10% |
| Revenue | 0.5% to 1% |
| Total assets | 1% to 2% |
Materiality is set at planning, revised if new information emerges (for example, final figures differ from the draft), and used to plan the extent of testing and to evaluate misstatements found.
Responding to the risks: ISA 330
ISA 330 The Auditor's Responses to Assessed Risks requires two kinds of response.
- Overall responses to financial statement level risks: emphasising scepticism to the team, assigning more experienced staff or experts, more supervision, adding unpredictability to the procedures, and changing the nature, timing or extent of work, for example testing at the year end instead of at an interim date.
- Further audit procedures at the assertion level: tests of controls, where the auditor plans to rely on controls or substantive procedures alone cannot give enough evidence; and substantive procedures, which are required for every material class of transactions, balance and disclosure, whatever the assessed risk. For a significant risk, the substantive procedures must respond specifically to it, and must include tests of detail if no controls are tested.
Writing an audit risk in the exam
A well-written audit risk has three parts: the fact from the scenario, the financial statement area and assertion affected, and the effect, for example that the balance may be overstated. The response is a specific procedure that addresses that risk.
| Weak answer | Strong answer |
|---|---|
| "The company has a new system, which is a risk. Response: discuss with management." | "Balances transferred to the new system in September may be incomplete or inaccurate, so receivables and inventory may be misstated. Response: agree the closing balances on the old system to the opening balances on the new one, and investigate differences." |
Worked example
Sokoto Cement Co (a fictional company) manufactures cement. You are planning the audit for the year ending 31 December 20X6. Draft figures: revenue $48.0 million (20X5: $45.0 million), profit before income taxes $3.6 million and total assets $30.5 million.
Part 1: materiality.
| Benchmark | Draft figure $'000 | Range | Materiality range $'000 |
|---|---|---|---|
| Profit before income taxes | 3,600 | 5% to 10% | 180 to 360 |
| Revenue | 48,000 | 0.5% to 1% | 240 to 480 |
| Total assets | 30,500 | 1% to 2% | 305 to 610 |
Profit is the measure the bank (through its covenant) and the directors (through their bonus) focus on, and it is not close to break-even, so profit before income taxes is the appropriate benchmark. Because this year carries several higher risks, materiality is set at the lower end: 5% × $3,600,000 = $180,000. The firm sets performance materiality at 50% to 75% of materiality depending on risk; with higher risk it chooses 60%: 60% × $180,000 = $108,000.
Part 2: audit risks and responses. You have learned:
- On 1 September 20X6 the sales, receivables and inventory records moved to a new accounting system; balances were transferred partly by manual input.
- In October a competitor launched a cheaper product, and sales of Sokoto's premium cement have fallen sharply. Premium cement inventory is held at a cost of $1.2 million.
- In March 20X6 Sokoto took out a $10 million bank loan, repayable in five equal annual instalments starting in March 20X7. It requires interest cover of at least four times.
- $2.3 million spent refurbishing the main kiln has been capitalised in full.
- The directors receive a bonus of 3% of profit before income taxes.
- Trade receivables have risen from $5.9 million to $8.6 million (46%), while revenue rose 6.7%. One major customer, owing $1.1 million, is in financial difficulty.
| Audit risk | Explanation | Auditor's response |
|---|---|---|
| Data transfer to the new system | Manual input may have introduced errors or omissions, so receivables, inventory and revenue may be misstated (completeness and accuracy) | Agree closing balances on the old system to opening balances on the new one, investigate differences, and test the controls over the new system and the data transfer |
| Valuation of premium cement inventory | Falling demand may push net realisable value below cost; the $1.2m balance (material, over $180,000) may be overstated | Compare cost with post-year-end selling prices less costs to sell; review aged inventory reports; discuss write-down plans with management |
| Classification and covenant of the new loan | $2m (one instalment) falls due within 12 months and must be current, with $8m non-current; a covenant breach would affect going concern and disclosure | Agree terms to the loan agreement and a bank confirmation; check the split; recalculate interest cover; review the disclosures |
| Kiln refurbishment capitalised | Some of the $2.3m may be repairs that restore rather than enhance the kiln, so property, plant and equipment and profit may be overstated | Obtain a breakdown and inspect invoices; expense amounts that maintain the asset; capitalise only those that improve or extend its life |
| Profit-based bonus | Directors have an incentive to overstate profit, through cut-off, aggressive estimates or manual journals (fraud risk) | Brief the team to be sceptical; test journals near the year end; test revenue and expense cut-off; review estimates for bias |
| Receivables growth and a struggling customer | Receivables grew far faster than revenue; the $1.1m debt may be irrecoverable, so receivables may be overstated (valuation), and some revenue may not have occurred | Review the aged receivables listing and after-date cash; assess the expected credit loss allowance for the $1.1m customer; send confirmations to a sample of customers |
Common mistakes
- Describing a business risk ("sales of premium cement have fallen") without saying how the financial statements could be misstated.
- Giving responses that are not procedures, such as "be careful" or "discuss with management" on its own.
- Stating a balance "may be misstated" without saying overstated or understated, or which assertion is affected.
- Saying the auditor can reduce inherent or control risk. The auditor can only assess them and adjust detection risk.
- Calculating materiality and then not using it: compare the amounts in the scenario with it to show which are material.
Exam technique
Use a table with one risk per row. Start each risk with the fact from the scenario, then name the balance, the assertion and the direction of the misstatement, and make the response a procedure that addresses that risk. Quantify where you can, for example against materiality or as a change on last year. Look for risks across the whole of both main statements, not in one area only.
Study with AI
I am studying ACCA Audit and Assurance (AA), sub-area B3: audit risk and materiality.
Write a one-page scenario for a fictional manufacturing company with draft figures
(revenue, profit before income taxes, total assets in $) and six audit risks. Ask me to
calculate a materiality range and describe each audit risk with the auditor's response
in a table. Then mark my answer, pointing out any risk that is really a business risk.AI assistants can produce risks that are not financial statement risks, or responses that are not procedures: check every answer against these notes before you rely on it.
Lecturer's note: The test of a real audit risk is a single question: which number in the financial statements could be wrong, and in which direction? If you cannot name the balance and say "overstated" or "understated", you have described a business problem, not an audit risk. Ask that question of every paragraph in the scenario, and the explanation and the response almost write themselves.
Key points
- Audit risk is the risk of an inappropriate opinion; it combines the risk of material misstatement (inherent and control risk) with detection risk.
- ISA 315 (Revised 2019) assesses risk at financial statement and assertion levels, rates inherent risk on a spectrum using the inherent risk factors, and identifies significant risks.
- Materiality (ISA 320) depends on size and nature; common ranges are 5% to 10% of profit before income taxes, 0.5% to 1% of revenue and 1% to 2% of total assets; performance materiality is set lower.
- ISA 330 requires overall responses to financial statement level risks, and substantive procedures for every material item, with specific responses to significant risks.
- A good exam answer states the fact, the balance, the assertion and the direction of misstatement, then a specific procedure.
Quick check
- A company has revenue of $62 million, profit before income taxes of $4.1 million and total assets of $38 million. Calculate the materiality range based on profit before income taxes.
- Which component of audit risk does the auditor control?
- A company has capitalised $400,000 of staff training costs as an intangible asset. Materiality is $250,000. State the audit risk.
Answers
- 5% × $4,100,000 = $205,000; 10% × $4,100,000 = $410,000. The range is $205,000 to $410,000.
- Detection risk. Inherent risk and control risk exist in the entity and can only be assessed.
- Training costs cannot be recognised as an intangible asset under IAS 38 Intangible Assets, because the entity does not control the benefit of trained staff. Intangible assets and profit may be overstated by $400,000, which exceeds materiality of $250,000 and is therefore material.