Chapter 9 - Audit Risk

What is Audit Risk (AR / Acceptable Audit Risk)?

The risk that the auditor expresses an inappropriate audit opinion when financial statements are materially misstated. AAR represents the level of risk the auditor is willing to accept after completing the audit.

What is the Audit Risk Model formula?

PDR = AAR / (IR x CR) OR AAR = IR x CR x PDR. (Where AAR = Acceptable Audit Risk, IR = Inherent Risk, CR = Control Risk, PDR = Planned Detection Risk).

What is the Risk of Material Misstatement (RMM) formula?

RMM = Inherent Risk (IR) x Control Risk (CR). It represents the client-side risk that material misstatements exist in financial statements before considering audit procedures.

What is Planned Detection Risk (PDR)?

The risk that audit evidence for an audit objective will fail to detect misstatements exceeding tolerable misstatement. PDR determines the amount of substantive evidence the auditor must accumulate.

What is Acceptable Audit Risk (AAR) and what do AAR = 0% and AAR = 100% mean?

AAR is a measure of how willing the auditor is to accept that financial statements may be materially misstated after the audit is finished and an unqualified opinion was issued. AAR = 0% means absolute certainty (impossible); AAR = 100% means total uncertainty.

What are the 3 key factors that affect Acceptable Audit Risk (AAR)?

1. Degree to which external users rely on the statements (client size, public status, extensive liabilities) ; 2. Likelihood that client will experience financial difficulty / bankruptcy after audit ; 3. Management's integrity.

What is Inherent Risk (IR) in the Audit Risk Model?

The auditor's assessment of the susceptibility of an assertion to a material misstatement, assuming there are no related internal controls.

What are 8 key factors that affect the assessment of Inherent Risk (IR)?

1. Nature of client's business ; 2. Results of previous audits (prior errors) ; 3. Initial vs. repeat engagement ; 4. Related-party transactions ; 5. Non-routine transactions ; 6. Judgment/estimates required ; 7. Makeup of population ; 8. Susceptibility to misappropriation/fraud.

Can auditors change or control a client's Inherent Risk (IR)?

No. Inherent Risk is a function of the client's business environment and account characteristics. Auditors can only assess IR; they cannot change it.

What is Control Risk (CR) in the Audit Risk Model?

The auditor's assessment of the risk that a material misstatement will not be prevented, or detected and corrected, on a timely basis by the client's internal controls.

When does an auditor assess Control Risk (CR) at 100% (High)?

When internal controls are absent, poorly designed, or deemed ineffective, OR when testing internal controls is not cost-effective (substantive audit strategy).

What is Engagement Risk, and how does it differ from Audit Risk?

Engagement Risk is the risk that the auditor or audit firm will suffer financial or reputational damage due to a relationship with a client (e.g. lawsuit, adverse publicity), even if the audit report was correct.

What are 5 ways an audit firm can respond to high Engagement Risk?

1. Assign experienced staff ; 2. Conduct more thorough reviews ; 3. Lower Acceptable Audit Risk (AAR) ; 4. Set lower performance materiality ; 5. Decline or terminate the engagement.

What is the relationship between Acceptable Audit Risk (AAR) and Planned Detection Risk (PDR)?

Direct (Positive) Relationship. A lower AAR forces allowable PDR DOWN (requiring MORE audit evidence). A higher AAR allows PDR to go UP (requiring LESS evidence).

What is the relationship between Risk of Material Misstatement (RMM) and Planned Detection Risk (PDR)?

Inverse Relationship. Higher RMM (high IR or CR) forces allowable PDR DOWN (requiring MORE substantive evidence). Lower RMM allows PDR to go UP.

What is the relationship between Planned Detection Risk (PDR) and the required amount of audit evidence?

Inverse Relationship. A lower allowable PDR requires MORE persuasive, extensive audit evidence. A higher PDR requires LESS audit evidence.

In the Audit Risk Model, which risks are under the auditor's control versus the client's control?

Client-driven: Inherent Risk (IR) and Control Risk (CR). Auditor-driven: Acceptable Audit Risk (AAR) and Planned Detection Risk (PDR).

[ARM Calculation] If AAR = 5%, IR = 80%, and CR = 60%, calculate RMM and PDR.

RMM = 0.80 x 0.60 = 48% (0.48). PDR = AAR / RMM = 0.05 / 0.48 = 10.42% (0.1042).

[ARM Scenario 1] If AAR = High, IR = Low, CR = Low, what is PDR and how much evidence is needed?

PDR = High. Amount of evidence required = Low.

[ARM Scenario 2] If AAR = Low, IR = High, CR = High, what is PDR and how much evidence is needed?

PDR = Low. Amount of evidence required = High (strongest, most extensive substantive testing).

[ARM Scenario 3] What happens to PDR and planned evidence if the auditor discovers during testing that internal controls are less effective than originally assessed (CR increases from Medium to High)?

CR increases -> PDR decreases -> Auditor must accumulate MORE substantive evidence and expand sample sizes.

What are 3 limitations of the Audit Risk Model (ARM)?

1. Subjective assessments (difficult to measure IR and CR with exact precision) ; 2. Measurement difficulties in quantifying AAR ; 3. Model is a planning tool, not a guarantee against audit failure.

How does the Audit Risk Model apply at the completion of the audit?

If actual audit evidence shows misstatements exceed materiality or control failures were worse than expected, actual detection risk achieved is higher than planned, requiring additional audit testing or opinion modification.

How do Materiality and Risk work together in audit planning?

They are inverse: setting a lower materiality threshold increases audit risk and requires accumulating more audit evidence to obtain the same level of assurance.

[Practice Problem] An auditor assesses IR = 100% and CR = 100% for a client's inventory account. To maintain AAR = 5%, what must PDR be?

PDR = 0.05 / (1.00 x 1.00) = 5.0%. Since allowable PDR is extremely low (5%), the auditor must gather extensive substantive evidence.

When do Inherent Risk (IR) and Control Risk (CR) vary across an audit, and how does this compare to Acceptable Audit Risk (AAR)?

IR and CR vary across transaction cycles, account balances, and specific assertions. Acceptable Audit Risk (AAR) is set at the macro level for the financial statements / engagement as a whole.

[Kahoot! #3] Inherent Risk (IR) and Control Risk (CR) are ordinarily assessed by the auditor during planning and apply at what level (compared to Acceptable Audit Risk)?

Assessed at the detailed level for each major transaction cycle, account balance, and assertion (whereas Acceptable Audit Risk is set for the financial statements as a whole).

[Exam Review Problem 3 & 4 Prep] Short Answer: What is the exact sequence of events when Acceptable Audit Risk (AAR) is reduced from 5% to 1%?

1. Allowable PDR decreases [PDR = AAR / RMM] ; 2. Required substantive evidence increases ; 3. Nature of testing shifts to more reliable external evidence ; 4. Extent of testing expands (larger sample sizes) ; 5. Timing shifts to year-end.

[Exam Review Problem 3 & 4 Prep] Short Answer: If Control Risk (CR) is assessed at High (100%), what happens to Tests of Controls (TOC) and Substantive Testing?

Auditor performs ZERO Tests of Controls (TOC = 0). Control Risk remains at 100%, lowering allowable PDR and forcing all audit assurance onto expanded substantive tests (STOT, SAP, TDB).