ACCA Audit and Assurance Study Notes: Chapter 5 - Risk

Objectives and Performance Objectives (PER)

  • Syllabus Objectives Covered:
    • B2b: Explain the need to plan and perform audit engagements with an attitude of professional scepticism and to exercise professional judgement.
    • B3: Assessing audit risks.
    • B4: Understanding the entity and its environment and the applicable financial reporting framework.
  • Practical Experience Requirement (PER):
    • Performance Objective 18 (PO18): Prepare for and plan the audit and assurance process. Plan and control the engagement process, including the initial investigation. Plan and monitor the audit programme legally and ethically.

Overview of Audit Risk and Framework

Risk Assessment Framework

  • Primary Objective of the Auditor:
    • According to ISA 200 Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with ISAs (paragraph 17), the overarching obligation of the auditor is to obtain sufficient appropriate evidence to reduce audit risk to an acceptably low level.
  • Definition of Audit Risk:
    • Audit risk is defined under ISA 200 (paragraph 13c) as the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated.
    • Specifically, this occurs when an unmodified audit opinion is issued on financial statements containing material misstatements.
  • Consequences of an Inappropriate Audit Opinion:
    • Potential legal litigation brought against the audit firm by intended users relying on misstated financial statements.
    • Disciplinary proceedings and sanctions initiated by professional accountancy bodies.
    • Severe long-term damage to the professional reputation and commercial viability of the audit practice.

The Audit Risk Equation and Its Components

Audit Risk Structure

  • Structure of Audit Risk:
    • Audit risk consists of two overarching elements: the risk of material misstatement (RMM) and detection risk.
    • The formal mathematical relationship among the components is expressed as:     Audit Risk=Risk of Material Misstatement×Detection Risk\text{Audit Risk} = \text{Risk of Material Misstatement} \times \text{Detection Risk}Audit Risk=Inherent Risk×Control Risk×Detection Risk\text{Audit Risk} = \text{Inherent Risk} \times \text{Control Risk} \times \text{Detection Risk}
  • Locus of Control and Auditor Influence:
    • Inherent Risk and Control Risk are inherent to the client entity, its operational environment, industry, and management controls. The auditor has no direct power to alter or influence inherent risk or control risk.
    • Detection Risk is the only component directly manageable and controlled by the auditor.
    • To reduce overall audit risk to an acceptably low level when inherent risk and control risk (RMM) are assessed as high, the auditor must actively manage and lower detection risk.
  • Strategies to Lower Detection Risk:
    • Assigning more experienced and specialized audit personnel to the engagement team.
    • Expanding the range, scope, and depth of audit procedures.
    • Increasing sample sizes tested across transaction classes and account balances.

Identifying and Categorising Misstatements

  • Definition of Misstatement:
    • ISA 450 Evaluation of Misstatements Identified During The Audit (paragraph 4a) defines a misstatement as a difference between the reported amount, classification, presentation, or disclosure of a financial statement item and the amount, classification, presentation, or disclosure required for the item to be in accordance with the applicable financial reporting framework. Misstatements arise from either error or fraud.
  • Mandate under ISA 315 (Revised 2019):
    • Paragraph 11 specifies that the objective of the auditor is to identify and assess the risks of material misstatement, whether due to fraud or error, at both the financial statement level and the assertion level, thereby providing a basis for designing and implementing responses to assessed risks.
  • Operational Benefits of Conducted Risk Assessments:
    • Identifies specific areas within the financial statements where material misstatements are most likely to occur early in the planning process.
    • Enables auditors to design targeted, risk-specific audit procedures.
    • Facilitates an efficient, focused, and effective audit execution.
    • Reduces the probability of issuing an incorrect audit opinion to an acceptably low level.
    • Minimises firm exposure to regulatory sanctions, litigation, and reputational harm.
  • Three Categories of Misstatement (ISA 450, A6):
    1. Factual Misstatements: Misstatements about which there is no factual doubt.
    2. Judgemental Misstatements: Differences resulting from accounting estimates that the auditor considers unreasonable, or the selection/application of accounting policies that the auditor considers inappropriate.
    3. Projected Misstatements: The auditor's best estimate of total misstatement in a population, calculated by projecting misstatements identified in audit samples across the whole population.

Detailed Breakdown of Inherent, Control, and Detection Risks

  • Inherent Risk:
    • Definition (ISA 200, paragraph 13ni): The susceptibility of an assertion about a class of transaction, account balance, or disclosure to misstatement that could be material, before consideration of any related controls.
    • Qualitative Inherent Risk Factors (ISA 315 Revised 2019, A7): Complexity, Subjectivity, Change, Uncertainty, and Susceptibility to misstatement due to management bias.
    • Inherent Risk Scenarios across Account Balances:
    • Property, Plant, and Equipment (PPE):
      • Overstated if ongoing repair and maintenance expenses are improperly capitalised as asset expenditure.
      • Overstated if asset useful lives are extended without justified engineering or economic reasoning, thereby understating annual depreciation.
      • Overstated if assets ordered but undelivered at the reporting date are included in the balance sheet.
      • Understated if valid capital asset expenditure is incorrectly expensed in the income statement.
    • Provisions and Liabilities:
      • Overstated if no present legal or constructive obligation exists at the reporting date.
      • Overstated if a cash outflow payment is not probable.
      • Understated if an inappropriately low or optimistic estimate of the obligation is recorded.
    • Intangible Assets:
      • Overstated if basic research costs are capitalised rather than expensed as incurred.
      • Overstated if amortisation charges are omitted on commercialised development projects yielding active revenues.
      • Overstated if required impairment losses are not recognized for impaired intangibles.
      • Understated if valid development expenditures meeting capitalisation criteria are expensed.
    • Revenue:
      • Overstated if revenue is recognized before contract performance obligations have been completely satisfied.
  • Control Risk:
    • Definition (ISA 200, paragraph 13nii): The risk that a misstatement that could occur and that could be material will not be prevented, or detected and corrected, on a timely basis by the entity's internal controls.
    • Essential Control Activities: System authorisations, segregation of duties, regular account reconciliations, physical asset protection, and access controls.
    • Impact: Effective internal controls catch or prevent misstatements before financial statement preparation; weak or absent controls elevate control risk and increase misstatement likelihood.
  • Detection Risk:
    • Definition (ISA 200, paragraph 13e): The risk that the procedures performed by the auditor to reduce audit risk to an acceptably low level will not detect a misstatement that exists and that could be material.
    • Components of Detection Risk:
    1. Sampling Risk (ISA 530, paragraph 5c): The risk that the auditor's conclusion based on a tested sample differs from the conclusion that would be reached if the entire population were subjected to the same audit procedure.
    2. Non-sampling Risk (ISA 530, paragraph 5d): The risk that the auditor reaches an erroneous conclusion for any reason not related to sample size, such as applying inappropriate procedures or failing to recognize a misstatement.
  • Audit Approach Adjustments to Assessed Risk (ISA 330, A1):
    • Re-emphasising the critical application of professional scepticism to the engagement team.
    • Assigning senior or technical specialist staff to high-risk or complex audit areas.
    • Modifying the nature, timing, extent, direction, supervision, and review of audit procedures.
    • Incorporating elements of unpredictability in selecting audit testing samples and techniques.
    • Updating overall audit strategy, performance materiality levels, control testing scope, and substantive procedure depth.

Professional Scepticism and Judgement

  • Definition (ISA 200, paragraph 13l):
    • Professional scepticism is defined as an attitude that includes a questioning mind, being alert to conditions which may indicate possible misstatement due to fraud or error, and a critical assessment of audit evidence.
  • Core Application Requirements (ISA 200, A20):
    • Remaining alert to audit evidence that directly contradicts other audit evidence.
    • Identifying information that calls into question the reliability of documents or inquiry responses.
    • Identifying operational or financial conditions that indicate possible fraud.
    • Recognising circumstances suggesting the need for audit procedures beyond those required by ISAs.
  • Practical Illustrations of Exercising Professional Scepticism:
    • Scenario 1 (Overdue Customer Debt):
    • Context: A client's customer is 66 months overdue on standard 1010-day payment terms. The Finance Director (FD) claims no allowance or write-off is needed due to prior non-default history.
    • Sceptical Procedure: The auditor must seek independent, corroborative evidence (e.g., post-year-end bank statements showing cash received or customer correspondence). Relying solely on management inquiry or written management representations is insufficient due to management bias to protect reported profits.
    • Scenario 2 (Pending Unfair Dismissal Lawsuit):
    • Context: An ex-employee sues the client. The FD states legal advice indicates the employee will lose, so no financial provision is created.
    • Sceptical Procedure: The auditor should inspect formal correspondence from the legal advisor or send a direct, external legal confirmation to obtain independent third-party evidence.

Materiality and Performance Materiality

  • Standard Definitions:
    • ISA 320 Materiality in Planning and Performing an Audit (paragraph 2): Misstatements, including omissions, are considered material if they, individually or in the aggregate, could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements.
    • IFRS 18 Presentation and Disclosure in Financial Statements: Information is material if omitting, misstating or obscuring it could reasonably be expected to influence the decisions that the primary users of general-purpose financial statements make on the basis of those financial statements.
  • Quantitative Materiality Benchmarks:
    • Revenue: 12%−1%\frac{1}{2}\% - 1\%
    • Profit Before Tax (PBT): 5%−10%5\% - 10\%
    • Total Assets: 1%−2%1\% - 2\%
    • Exam Rule: Always apply the lowest boundary of the benchmark (12%\frac{1}{2}\% revenue, 5%5\% PBT, 1%1\% total assets) to assess whether an item is material.
  • Qualitative Materiality (Material by Nature):
    • Items affecting regulatory compliance.
    • Breaches of loan covenants.
    • Adjustments converting a reported net profit into a net loss.
    • Adjustments turning a net asset position into net liabilities.
    • Related-party transactions involving directors (salaries, perks, loans).
    • Narrative disclosures on legal disputes or going concern uncertainties.
  • Practical Application Illustration - Murray Co Materiality Calculation:
    • Financial Extracts:
    • Revenue: $21,960,000\$21,960,000
    • Total Assets: $9,697,000\$9,697,000
    • Profit Before Tax: $1,048,000\$1,048,000
    • Benchmark Calculations:
    • Revenue range (12%−1%\frac{1}{2}\% - 1\%): $110,000−$220,000\$110,000 - \$220,000
    • Profit Before Tax range (5%−10%5\% - 10\%): $52,000−$105,000\$52,000 - \$105,000
    • Total Assets range (1%−2%1\% - 2\%): $97,000−$194,000\$97,000 - \$194,000
    • Materiality Analysis:
    • Revenue is generally avoided unless profit figures are distorted or unrepresentative.
    • The overlap range between PBT and Total Assets yields $97,000−$105,000\$97,000 - \$105,000.
    • Setting preliminary materiality at $97,000\$97,000 (1%1\% of assets, representing 9%9\% of PBT) represents a prudent choice for a first-year audit on draft accounts, driving higher testing sample sizes.
  • Performance Materiality (ISA 320, paragraph 9):
    • Definition: The amount set by the auditor at less than materiality for the financial statements as a whole to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole.

Entity Understanding and Risk Assessment Procedures

What the Auditor Should Understand

  • Risk Assessment Procedures (ISA 315, paragraph 14):
    • Inquiries with management, internal audit, and key operational staff.
    • Analytical procedures on financial and non-financial data.
    • Observation of client operations and internal control executions.
    • Inspection of strategic plans, manuals, board minutes, and contracts.
  • Required Scope of Entity Understanding:
    • Entity and Environment: Organisational complexity, ownership, governance structures, business model, IT infrastructure integration (legacy systems, outsourcing), regulatory environment, and financial performance measures.
    • Financial Reporting Framework: Appropriateness and consistency of accounting policies.
    • Internal Control System: Control environment, risk assessment process, monitoring mechanisms, information systems, and control deficiencies.

Sources of Information

  • Key Information Sources:
    • Auditor's prior personal experience on the engagement.
    • Audit firm resources (engagement partner, prior year working papers, technical experts).
    • Client sources (management discussions, physical observations, website, product brochures).
    • External sources (Companies House, industry databases, trade press).

Analytical Procedures and Key Formulas

  • Definition (ISA 520, paragraph 4):
    • Evaluations of financial information through analysis of plausible relationships among both financial and non-financial data, and investigation of identified fluctuations, inconsistent relationships, or unexpected values.
  • Stages of Audit Execution:
    1. Preliminary Analytical Procedures: Mandatory under ISA 315 during initial risk assessment.
    2. Substantive Analytical Procedures: Optional under ISA 500 to obtain substantive evidence.
    3. Final Analytical Procedures: Mandatory under ISA 520 at engagement completion to assess overall consistency.
  • Comprehensive Audit Formula Reference:
    • Profitability Ratios:     Gross Profit Margin=Gross ProfitSales Revenue×100%\text{Gross Profit Margin} = \frac{\text{Gross Profit}}{\text{Sales Revenue}} \times 100\%Operating Profit Margin=Operating ProfitSales Revenue×100%\text{Operating Profit Margin} = \frac{\text{Operating Profit}}{\text{Sales Revenue}} \times 100\%
    • Efficiency Ratios:     Receivables Collection Period=Trade ReceivablesRevenue×365 days\text{Receivables Collection Period} = \frac{\text{Trade Receivables}}{\text{Revenue}} \times 365\,\text{days}Payables Payment Period=Trade PayablesCost of Sales×365 days\text{Payables Payment Period} = \frac{\text{Trade Payables}}{\text{Cost of Sales}} \times 365\,\text{days}Inventory Holding Period=InventoryCost of Sales×365 days\text{Inventory Holding Period} = \frac{\text{Inventory}}{\text{Cost of Sales}} \times 365\,\text{days}Asset Turnover=RevenueTotal Assets\text{Asset Turnover} = \frac{\text{Revenue}}{\text{Total Assets}}
    • Liquidity Ratios:     Current Ratio=Current AssetsCurrent Liabilities\text{Current Ratio} = \frac{\text{Current Assets}}{\text{Current Liabilities}}Quick Ratio=Current Assets−InventoryCurrent Liabilities\text{Quick Ratio} = \frac{\text{Current Assets} - \text{Inventory}}{\text{Current Liabilities}}
    • Investor / Financing Ratios:     Gearing=BorrowingsShare Capital+Reserves\text{Gearing} = \frac{\text{Borrowings}}{\text{Share Capital} + \text{Reserves}}ROCE=Profit Before Financing and Income TaxShare Capital+Reserves+Borrowings\text{ROCE} = \frac{\text{Profit Before Financing and Income Tax}}{\text{Share Capital} + \text{Reserves} + \text{Borrowings}}
  • Data Analytics Case Scenario - Beau Boutique Analysis:
    • Property, Plant, and Equipment (PPE):
    • Observations: Capital expenditure surged between January and March 20X5 while repairs and maintenance costs plunged. Total asset upgrade cost was $10,600\$10,600 versus a budgeted $10,000\$10,000.
    • Identified Audit Risk: Repairs and maintenance expenditure was misclassified and incorrectly capitalised as PPE.
    • Inventory Aging Analytics:
    • 0−1800 - 180 Days Range: Active lines; low valuation risk.
    • 181−240181 - 240 Days Range (15%15\% of total inventory): Inventory due to be discounted in September. Audit procedure required to verify if Net Realisable Value (NRV) drops below cost.
    • 241+241+ Days Range (10%10\% of total inventory): Obsolete inventory unlikely to be sold; requires full write-off to avoid material asset overstatement.

Exam Focus: Distinguishing Audit Risk from Business Risk

  • Key Distinction:
    • Business Risks relate to operational, financial, or commercial events that threaten client commercial profitability or operational viability.
    • Audit Risks relate directly to financial statement misstatements (overstatement/understatement of balances, class of transactions, or disclosures) causing an inappropriate audit opinion.
  • Key Guidelines for Structuring Exam Answers:
    1. Identify the factual scenario trigger from the case text.
    2. Specify the exact account balance and assertion affected (e.g., valuation of trade receivables, completeness of trade payables).
    3. Clearly state the direction of financial misstatement (overstated or understated).
    4. Formulate an actionable auditor response directly targeting the misstatement risk.

Detailed Solutions to Test Your Understanding (TYU) 1 to 6

Test Your Understanding 1: Murray Co Case Study

  • Audit Risk 1: First-year audit engagement (new client).
    • Risk Explanation: Lack of cumulative audit knowledge increases detection risk; opening balances may contain undetected material misstatements.
    • Auditor Response: Devote additional time and resources to understand client processes; perform substantive testing on opening balances and agree them to prior signed accounts; contact predecessor auditor to review working papers.
  • Audit Risk 2: Inventory stored at third-party warehouses.
    • Risk Explanation: Potential inability to verify physical existence and condition, increasing risk over inventory existence and completeness.
    • Auditor Response: Attend third-party physical inventory counts; inspect independent service auditor reports on warehouse internal controls; obtain direct external confirmations from third parties.
  • Audit Risk 3: Work-in-Progress (WIP) Ergometers taking one week to build.
    • Risk Explanation: WIP valuation involves subjective completion estimates, risking misstatement of inventory.
    • Auditor Response: Review and challenge percentage of completion assumptions; agree costs to raw material invoices, timesheets, and payroll records; recalculate overhead inclusions.
  • Audit Risk 4: Refurbishment of ergometer assembly line.
    • Risk Explanation: Repairs expenditure may be improperly capitalised as PPE, or capital expenditure expensed, causing asset misstatement.
    • Auditor Response: Review cost invoices to verify nature of expenditure; trace capital expenditures to the asset register and repair costs to the profit and loss account.
  • Audit Risk 5: Direct website integration with accounting system recording automated consumer sales.
    • Risk Explanation: System interface failures could omit web orders, leading to understated revenue.
    • Auditor Response: Perform test data testing on website transaction flows; trace orders through to dispatch documents, sales invoices, and ledger postings.
  • Audit Risk 6: Capitalisation of website development costs.
    • Risk Explanation: Research costs may be capitalized instead of expensed, violating IAS 38 Intangible Assets and overstating assets.
    • Auditor Response: Review breakdown of development costs against IAS 38 capitalisation criteria; expense non-qualifying research costs.
  • Audit Risk 7: Falling retailer sales and staff redundancies.
    • Risk Explanation: Going concern uncertainties may not be adequately disclosed, or required redundancy provisions under IAS 37 may be understated.
    • Auditor Response: Review cash flow forecasts and going concern assumptions; inspect post-year-end sales performance; test post-year-end redundancy payments against recorded provisions.
  • Audit Risk 8: Retail customers struggling with payments.
    • Risk Explanation: Receivables may be overstated if irrecoverable debts are not provided for or written off.
    • Auditor Response: Perform post-year-end cash receipts testing; review aged receivables ledgers; discuss overdue accounts with management.
  • Audit Risk 9: Target stock exchange listing next year.
    • Risk Explanation: Management incentive to bias or window-dress accounts to present inflated assets and profits.
    • Auditor Response: Maintain heightened professional scepticism; rigorously test management estimates and judgemental accounting areas.

Test Your Understanding 2: Murray Co Analytical Procedures

  • Analytical Findings and Risks:
    • Revenue Growth (+12%+12\% from $19,580k\$19,580\text{k} to $21,960k\$21,960\text{k}): Inconsistent with falling retail sales; indicates revenue overstatement risk prior to public listing.
    • Gross Profit Margin (12.8%12.8\% to 15.5%15.5\%): Increase suggests revenue overstatement or cost of sales understatement.
    • Operating Expenses (Static at $2,012k\$2,012\text{k}): Highly suspicious during period of activity expansion; indicates understated operating expenses.
    • Inventory Holding Period (2828 days to 4141 days): Suggests accumulating obsolete stock, overstating inventory.
    • Receivables Collection Period (2020 days to 3434 days): Highlights non-collectibility of retailer debts, overstating receivables.
    • Payables Payment Period (2626 days to 2828 days): Slight increase aligns with potential cost of sales understatement.

Test Your Understanding 3: Hook Co Case Study

  • Audit Risk 1: New audit client.
    • Risk Explanation: Elevated detection risk and opening balance misstatement risk.
    • Auditor Response: Increase planning procedures; verify opening balances against prior audited accounts.
  • Audit Risk 2: Material Work-in-Progress (WIP) balance.
    • Risk Explanation: Subjective WIP valuation risks overstating inventory.
    • Auditor Response: Attend inventory count; review stage of completion assumptions; recalculate WIP cost build-up.
  • Audit Risk 3: Fast-changing technology market (smartphones/MP3s).
    • Risk Explanation: Rapid obsolescence risks overstating inventory relative to lower NRV.
    • Auditor Response: Review aged inventory ledgers; compare carrying values against post-year-end selling prices.
  • Audit Risk 4: Key customer providing 70%70\% of revenue.
    • Risk Explanation: Severe going concern risk if customer is lost, requiring financial statement disclosures.
    • Auditor Response: Review customer contract terms, correspondence, and evaluate going concern forecasts.
  • Audit Risk 5: $1,000,000\$1,000,000 spent on 'snore-o-meter' app with delayed launch.
    • Risk Explanation: Non-qualifying development/research costs may be capitalized under IAS 38, overstating intangibles.
    • Auditor Response: Inspect project budgets, technical feasibility studies, and test expenditure against IAS 38 criteria.
  • Audit Risk 6: Stock exchange listing target in Q4.
    • Risk Explanation: Management bias to artificially inflate financial results.
    • Auditor Response: Apply elevated professional scepticism; perform cut-off procedures and test judgemental accounting choices.

Test Your Understanding 4: Materiality Definition and Assessment

  • Detailed Definition: Materiality is defined under ISA 320 as information whose omission, misstatement, or obscuration could reasonably be expected to influence the economic decisions of users taken based on the financial statements.
  • Assessment Factors: Both quantitative size (benchmarks such as 5%5\% PBT or 1%1\% total assets) and qualitative nature (director transactions, covenant compliance) must be considered, alongside user information needs, cumulative aggregation of small errors, and performance materiality thresholds.

Test Your Understanding 5: Multiple Choice Solutions

  1. Correct Answer: D
    • Explanation: Option D correctly defines audit risk in terms of financial statement misstatement (understated provisions). Options A, B, and C describe business risks.
  2. Correct Answer: A
    • Explanation: Payables payment period for a 10-month period (Jan-Oct = 304 days) is calculated as Payables/Cost of Sales×304\text{Payables} / \text{Cost of Sales} \times 304.
  3. Correct Answer: B
    • Explanation: Recalculation is a mathematical accuracy test, not an evaluation of relationships (analytical procedure).
  4. Correct Answer: D
    • Explanation: Revenue growth represents a percentage trend, whereas Acid test, Inventory turnover, and Gross profit margin are financial ratios.
  5. Correct Answer: C
    • Explanation: Overvaluing closing inventory reduces cost of sales, artificially inflating gross profit margin.

Test Your Understanding 6: Multiple Choice Solutions

  1. Correct Answer: B
    • Explanation: Financial statements can be materially misstated through omissions of required balances or narrative disclosures.
  2. Correct Answer: C
    • Explanation: External confirmation is a substantive procedure, not listed under ISA 315 as a risk assessment procedure.
  3. Correct Answer: A
    • Explanation: Applying 5%5\% to $3m\$3\text{m} PBT yields $150,000\$150,000 (Income Statement materiality); applying 1%1\% to $50m\$50\text{m} Total Assets yields $500,000\$500,000 (Balance Sheet materiality).
  4. Correct Answer: D
    • Explanation: Performance materiality is set below overall materiality to reduce the probability that aggregate uncorrected/undetected misstatements exceed overall materiality.
  5. Correct Answer: C
    • Explanation: Professional scepticism requires a questioning mind and critical evaluation, not complete disbelief or total mistrust of management.

Chapter Summary

Chapter 5 Summary Diagram

  • Audit Risk Structure: Audit Risk=Risk of Material Misstatement(Inherent Risk×Control Risk)×Detection Risk\text{Audit Risk} = \text{Risk of Material Misstatement} (\text{Inherent Risk} \times \text{Control Risk}) \times \text{Detection Risk}.
  • Risk Identification: Achieved through obtaining entity understanding and conducting preliminary analytical procedures.
  • Core Attitudes: Maintaining professional scepticism through an open, questioning mind and critical evidence appraisal.
  • Materiality Application: Calculated by size (12%−1%\frac{1}{2}\% - 1\% Revenue, 1%−2%1\% - 2\% Assets, 5%−10%5\% - 10\% Profit) or evaluated by qualitative nature.