AUD 689 – Audit Risk and Materiality (Topic 5)

Course: AUD 689 – Audit & Assurance Services

Topic Focus: Audit Risk and Materiality

These foundational concepts are crucial for auditors to effectively evaluate the inherent uncertainties and the potential significance of financial statement errors or omissions, ensuring a reliable audit opinion.

1. Learning Objectives

Comprehend the dual concepts of risk and materiality and how they are applied during an audit engagement. This involves understanding their definitions, interrelationships, and practical implications in various audit phases.

Develop skills to identify, assess, and respond to audit risk, including understanding its components (Inherent, Control, and Detection Risk) and how they influence the nature, timing, and extent of audit procedures.

2. Audit Risk

2.1 Definition of Audit Risk & Acceptable Audit Risk (AAR)

Audit Risk (AR): Risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated.

• Classic phrasing: risk of issuing an unqualified opinion when a material misstatement exists (i.e., giving a clean bill of health to financial statements that are, in fact, misleading).

Planning Imperative: Auditors must plan and perform procedures to reduce AR to an acceptably low level. This means that even after completing the audit, there will always be some residual risk, but it must be managed to a level that is tolerable for the auditor and stakeholders.

Acceptable Audit Risk (AAR):

• Measure of how much residual risk the auditor is willing to live with after the audit is complete. A lower AAR implies that the auditor is less willing to risk giving an incorrect opinion, leading to a more rigorous audit.

• Inverse relationship with amount of evidence gathered.

  • AAR decreases ⇒ evidence must increase to compensate for the heightened sensitivity to risk. For example, if the auditor is very risk-averse, they will demand more persuasive evidence.

Natural Limitations: AR can never be driven to $0$ due to inherent limitations of an audit, such as the use of sampling (testing less than $100\%$ of transactions), the reliance on professional judgment, and practical time/cost constraints. Thus, reasonable assurance, not absolute assurance, is the goal.

2.2 Auditor’s High-Level Response to Risk

Assess Risk of Material Misstatement (RMM). This involves understanding the client’s business, industry, and control environment to identify areas prone to misstatement. It’s a combination of Inherent Risk and Control Risk.

Design Procedures proportionate to assessed risk:

• High risk ⇒ extended procedures (e.g., larger samples, additional confirmations from third parties, more extensive corroboration of management assertions).

• Low risk ⇒ normal procedures (standard audit tests and procedures deemed adequate for typical risk levels).

Evaluate Evidence: After performing the planned procedures, the auditor assesses whether the evidence gathered is sufficient and appropriate, and whether the initial risk assessments remain valid. This is an iterative process.

Issue Audit Report accordingly. The final report reflects the auditor's opinion based on the evidence, concluding whether the financial statements are presented fairly in all material respects.

2.3 The Audit Risk Model

Formula: $AR = IR \times CR \times DR$

This multiplicative model illustrates how the components of audit risk interact:

• IR (Inherent Risk) – susceptibility of an assertion to material misstatement ignoring controls. This is the risk before considering the client's internal controls. For example, complex financial instruments might have high inherent risk.

• CR (Control Risk) – risk that client’s internal controls fail to prevent, detect, or correct a misstatement. This assesses the effectiveness of the client's internal control system in mitigating risks. Weak controls lead to higher control risk.

• DR (Detection Risk) – risk that auditor’s substantive procedures fail to detect a misstatement that made it past IR & CR barriers. This is the only component of the model directly controlled by the auditor. If IR and CR are high, DR must be set low to maintain an acceptable AR.

Sampling vs. Nonsampling aspects:

• DR contains sampling risk (the chance that the auditor's sample is not representative of the population, leading to an incorrect conclusion about the population) & nonsampling risk (the risk that the auditor makes an error not related to sampling, such as applying inappropriate audit procedures, misinterpreting audit evidence, or failing to recognize a misstatement).

2.4 Factors Creating Audit Uncertainty

Sampling – auditors rarely test $100\%$ of population. Conclusions about the entire population are drawn from a sample, which inherently carries sampling risk.

Human Limitations in Internal Control – errors, carelessness, override by management, collusion among employees, and communication breakdowns can undermine even well-designed internal controls.

Persuasive vs. Conclusive Evidence – many audit conclusions are drawn on persuasive evidence (e.g., confirmations, analytical procedures) rather than absolute proof. Rarely is absolute proof obtainable in an audit setting.

2.5 Inherent Risk Concept & Illustration

IR is industry/business-specific. It depends on the nature of the business and its operational environment.

Example: Inventory in electronics (high obsolescence risk due to rapid technological changes, multiple inventory sites, and diverse product lines) ⇒ high IR. Payroll (routine, automated, well-defined processes) ⇒ lower IR, assuming standard operations.

Key Point: IR is assessed without considering internal controls (those are evaluated separately under CR). It's the susceptibility of an account balance or class of transactions to misstatement assuming no internal controls are in place to mitigate that susceptibility.

2.6 Inherent Risk Levels

Financial-Statement (Entity) Level: Risks that broadly affect the entire financial statements and many assertions (e.g., management integrity issues, economic downturns affecting the entire company).

Account-Balance / Transaction Level: Risks specific to individual accounts, classes of transactions, or disclosures (e.g., valuation of a complex derivative, completeness of revenue recognition for a specific type of contract).

Higher IR ⇒ more evidence must ultimately be accumulated. This is because a higher inherent risk indicates a greater likelihood of material misstatement existing before considering controls, requiring more robust audit procedures.

2.7 Entity-Level IR Factors (1)

Nature of Business, Size, Locations

• E.g., an electronics manufacturer faces more obsolete inventory risk due to fast-changing technology and potentially diversified, geographically spread inventory locations than a simpler business model, such as a steel fabricator which deals with more stable inventory.

Management Integrity & Competence

• A dominant CEO with little oversight, or frequent management changes within key financial roles, can be significant warning signs suggesting a higher risk of management override or misstatements.

Unusual Pressures

• Tight deadlines for financial reporting, aggressive market expectations (e.g., needing to meet specific earnings targets), or a desire to obtain financing can create temptation to misstate revenue or expenses.

2.8 Entity-Level IR Factors (2)

Industry Conditions

• Intense competitive threats, declining industry profitability, or adverse trends (e.g., changes in customer preferences) can incentivize management to manipulate financial numbers to present a better picture to stakeholders.

Initial vs. Repeat Engagement

• First-year audits generally start with higher IR due to the auditor's lack of cumulative knowledge about the client's operations, industry practices, and internal controls compared to recurring engagements.

Economic / Regulatory Environment

• Volatile legislation, significant changes in accounting standards (e.g., new IFRS or US GAAP pronouncements), or complex tax rules can elevate IR by increasing the complexity of financial reporting and the potential for non-compliance or error.

2.9 Account-Level IR Factors (1)

Prior-Year Misstatements – if problems (e.g., errors in inventory valuation, revenue recognition issues) occurred in previous periods and root causes weren’t effectively addressed, they are more likely to recur.

Related-Party Transactions – transactions with related parties (e.g., management, affiliates) often lack arm’s-length bargaining, increasing the manipulation risk and complexity of valuation and disclosure.

Non-Routine / Complex Deals – e.g., major asset disposals, complex sale-leasebacks, or significant business combinations are often subject to highly complex accounting rules and significant management judgment, increasing the risk of misstatement.

2.10 Account-Level IR Factors (2)

Judgment-Heavy Estimates

• Accounts requiring significant management judgment and estimation, such as the allowance for doubtful debts, estimates of useful life for depreciable assets, warranty obligations, or fair value measurements, are inherently prone to higher risk due to their subjective nature.

Other Considerations:

• Complexity: The inherent complexity of transactions or calculations (e.g., derivatives, deferred taxes).

• Need for specialists: Requirement for auditor or client specialists (e.g., actuaries, valuation experts) highlights high-risk areas.

• Susceptibility to theft: Assets that are easily portable and valuable (e.g., cash, high-end electronics inventory) have a higher inherent risk of theft.

• System quality: Reliance on new or unproven IT systems can introduce systemic risks.

• Year-end cut-off transactions: Transactions near the reporting period end (e.g., sales cut-off, purchases cut-off) carry a higher risk of being recorded in the wrong period.

2.11 Transaction vs. Account-Balance Testing (Definitions)

Transaction Level: Tests whether the processing of events (e.g., a sample of $30$ January disbursements) is complete, accurate, and properly classified based on the company's established policies and accounting principles. These tests focus on controls over specific transaction flows.

Account-Balance Level: Tests the existence, rights/obligations, valuation, completeness, and presentation/disclosure assertions related to ending balances (e.g., physical inventory count & Net Realizable Value (NRV) tests for inventory, bank confirmations for cash).

IR Tendency: Inherent risk is generally higher when the auditor expects many misstatements could occur due to the nature of the transactions or accounts, and where internal controls are known to be weak or absent, or are designed ineffectively.

2.12 Control Risk & Internal Control Limitations

ISA 400.5 definition: risk that a misstatement that could occur in an assertion about a class of transaction, account balance or disclosure and that could be material, will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control system. The effectiveness of internal controls directly impacts Control Risk.

Effective Controls ⇒ Although effective controls cannot eliminate all risks, they significantly reduce the likelihood of misstatements going undetected, leading to lower CR.

Auditor Must gain an understanding of the system: Auditors need to understand the design and implementation of internal controls to assess CR. This involves inquiry, observation, inspection of documents, and walkthroughs.

Inherent Control Limitations:

• Cost–benefit trade-offs: Management may deem certain controls too expensive relative to the benefit of reduced risk.

• Focus on routine not non-routine transactions: Controls are typically designed for recurring transactions, leaving non-routine or unusual transactions more vulnerable.

• Human error: Mistakes, fatigue, or misunderstanding can lead to control failures.

• Collusion: Two or more individuals working together can circumvent controls that rely on segregation of duties.

• Management overrides: Management, particularly senior management, can deliberately bypass established controls.

• Obsolescence: Controls designed for old processes may become ineffective when processes or systems change.

2.13 Evaluating Control Risk

General Level: Does management value controls? Evidence includes the existence and effectiveness of budgeting processes, an internal audit function, enterprise risk management frameworks, and the oversight provided by an active and independent audit committee. A strong tone at the top indicates a lower general control risk.

Specific Level: Are procedure-level controls designed & implemented well for each cycle (e.g., revenue cycle, purchasing cycle)? This involves assessing controls over specific transactions (e.g., authorization, reconciliation, documentation) to determine if they prevent or detect misstatements.

End Note: If controls are ineffective ⇒ CR will be high. This necessitates the auditor to perform more extensive substantive procedures (leading to lower Detection Risk) to compensate for the higher control risk.

2.14 Detection Risk (DR) Fundamentals

DR is auditor-controlled via nature, timing, and extent of substantive tests. It's the only component of Audit Risk that the auditor can directly influence through their audit strategy and execution.

Objective: Choose a DR level such that $AR$ stays acceptably low given assessed $IR$ and $CR$. If IR and CR are high, the auditor must compensate by setting a low DR, requiring more rigorous testing. Conversely, if IR and CR are low, a higher DR can be tolerated, allowing for less extensive testing.

Planning levers: These are the tools auditors use to manage Detection Risk:

• Quality of audit planning, direction, supervision: Thorough planning, effective supervision of engagement team members, and detailed review of work performed reduce the risk of audit failures.

• Nature of procedures: This refers to the type of audit procedures performed, e.g., external confirmations (more reliable) vs. internal documentation (less reliable).

• Timing of procedures: Performing procedures at year-end (more reliable for balance sheet accounts) vs. interim periods (requires roll-forward procedures).

• Extent of procedures: This relates to the sample sizes chosen for testing (e.g., larger sample sizes increase the likelihood of detecting misstatements, thus lowering DR).

2.15 Detection Risk – Practical Guidance

Substantive tests & analytical procedures must be designed for reasonable assurance that material misstatements are caught. This involves a combination of tests of details (e.g., vouching, tracing) and analytical procedures (e.g., ratio analysis, trend analysis).

Relationship Recap:

• High $IR$ & $CR$ (high RMM) ⇒ low $DR$ (auditor needs to find more misstatements) ⇒ more evidence (extensive substantive procedures).

Competence & Due Care: Low-skill audit teams, inadequate training, or carelessness in performing procedures or evaluating evidence significantly raise Detection Risk, as the audit firm is more likely to miss existing misstatements.

2.16 Audit Risk Matrix (Qualitative Illustration)

This matrix helps visualize trade-offs between the components of RMM (IR and CR) and the required level of Detection Risk to maintain an Acceptable Audit Risk. A lower Detection Risk always implies more substantive audit work.

2.17 Component Relationship Illustration (Payroll vs. Inventory)

Payroll Cycle:

• IR: Low (Payroll transactions are typically routine, highly automated, and occur frequently, making them less susceptible to inherent misstatement).

• CR: Low (Most entities have strong, well-designed internal controls over payroll processing due to its routine nature, high volume, and regulatory compliance requirements).

• AAR: Low (Acceptable audit risk is generally maintained at a consistently low level across most audit areas).

• DR: High (Given low IR and low CR, the auditor can tolerate a higher detection risk, meaning less extensive substantive testing is required for payroll).

Inventory Cycle:

• IR: High (Inventory is often complex, involves multiple locations, diverse valuation methods, and is susceptible to obsolescence and theft. This presents a higher inherent risk).

• CR: High (Internal controls over inventory might be weak due to decentralized operations, manual counts, or lack of proper segregation of duties, leading to higher control risk).

• AAR: Low (Acceptable audit risk remains low).

• DR: Low (Given high IR and high CR, the auditor must set detection risk very low, implying the need for extensive evidence to compensate for the high RMM).

  • This requires extensive evidence from procedures like physical inventory counts, confirmations with third-party warehouses, and cut-off tests to ensure all inventory transactions are recorded in the correct period.

2.18 Evidence Relationships

Inverse:

• Audit Risk ↓ ⇒ Evidence ↑. To reduce the overall risk of an inappropriate opinion, the auditor must gather more evidence.

• Detection Risk ↓ ⇒ Evidence ↑. To reduce the risk of missing a material misstatement, the auditor must perform more rigorous and extensive substantive procedures.

Direct:

• Inherent Risk ↑ ⇒ Evidence ↑. If the inherent susceptibility to misstatement is high, more evidence is needed to confirm the accuracy of the accounts.

• Control Risk ↑ ⇒ Evidence ↑. If internal controls are weak, the auditor cannot rely on them to prevent or detect misstatements, and thus must gather more direct substantive evidence.

2.19 Interaction of Materiality & Audit Risk

Inverse Relationship: Lower materiality threshold ⇒ higher AR for a fixed amount of evidence. If the threshold for what constitutes a material misstatement decreases, then more errors become material. With the same amount of audit evidence, the auditor’s risk of missing a material misstatement (AR) naturally increases because the net of potential misstatements to detect has expanded.

Illustration:

• Materiality decreases from $RM1{,}000{,}000$ to $RM100{,}000$. This means misstatements that were previously deemed immaterial ($RM100{,}000$ to $RM999{,}999$) now become material.

• With same evidence, the risk of missing misstatements between those amounts rises. The auditor's existing procedures were designed with the higher materiality in mind and may not be sufficient to detect misstatements in the newly material range.

• Auditor must gather additional evidence to keep AR unchanged. To maintain the same level of acceptable audit risk with a lower materiality threshold, the auditor must perform more extensive or more precise audit procedures.

3. Materiality

3.1 Materiality Definition & Concept

A misstatement is material if it would probably influence the judgment of a reasonable financial statement user. This means that if a user, armed with full knowledge of the misstatement, would make a different economic decision, then the misstatement is material.

Professional Judgment: No bright-line rule. Materiality is determined by professional judgment, taking into account both quantitative factors (e.g., size of the misstatement) and qualitative factors (e.g., nature of the misstatement, impact on trends, compliance with covenants). It’s not solely based on a numerical threshold.

3.2 Steps in Applying Materiality

Preliminary Judgment – set an overall materiality figure (also known as Planning Materiality or Overall Materiality) for the financial statements as a whole. This is typically done during the planning phase of the audit and serves as a benchmark for evaluating aggregate misstatements.

Allocate / Determine Tolerable Misstatement for each account or class of transactions. Tolerable misstatement (also known as performance materiality) is an amount less than overall materiality, allocated to specific accounts to ensure that the sum of misstatements in individual accounts does not exceed overall materiality. It provides a margin for error.

Estimate Likely Misstatements detected + projected. The auditor identifies actual misstatements found during testing and projects these misstatements to the entire population. These identified and projected misstatements are then compared to the preliminary judgment of materiality (Step 1) to determine if the financial statements are materially misstated.

3.3 Key Principles of Materiality

Relative, not Absolute: $RM1{,}000{,}000$ may be huge for a small firm (e.g., representing a significant portion of their profit), but trivial for a multinational corporation like IBM (where it might be less than $0.01\%$ of revenue). The context of the entity's size and nature is critical.

Primary Bases often used: Materiality is commonly set as a percentage of a relevant financial base. Common bases include Profit before tax (PBT), net sales/revenue, total assets, or equity. The choice of base depends on the nature of the entity and what is most relevant to its financial statement users.

Sources of Misstatement: Misstatements can arise from Error (unintentional mistakes) and Fraud (intentional misstatements). Fraudulent misstatements typically carry a heavier qualitative weight, even if quantitatively small, due to their implications for management integrity and control effectiveness.

Auditor’s duty: Ensure financial statements are free of material misstatement or require adjustment. The ultimate objective is for the auditor to provide an opinion on whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework.

3.4 Practical Rationale & Sampling

Perfect accuracy impossible; concept of materiality legitimizes sampling. Given cost and time constraints, it's impractical and often unnecessary to test every transaction. Materiality allows auditors to focus on areas where misstatements would matter to users.

Misstatements below materiality may exist yet FS can still be FAIRLY stated. The auditor's opinion is about fair presentation in all material respects. It doesn't guarantee absolute accuracy, only that any undetected misstatements are individually or in aggregate below the materiality threshold.

Materiality is sometimes expressed as a percentage of chosen base. This helps standardize the preliminary calculation of materiality and provides a quantitative starting point.

3.5 Quantitative Benchmarks & Qualitative Adjustments

Common quantitative rule-of-thumb: $3\%$–$5\%$ of different financial bases serves as a starting point. These percentages are guides, not strict rules. Potential bases include:

• Total assets.

• Total revenue.

• Income before tax (PBT).

• Gross profit.

• A three-year average of PBT, especially for companies with volatile earnings.

Adjust downward when qualitative red flags present: The initial quantitative materiality may be lowered if certain qualitative factors suggest a higher risk or a greater need for precision in the audit:

• First-year engagement: Greater uncertainty or lack of familiarity with the client.

• Control weaknesses: Higher risk of undetected errors due to ineffective internal controls.

• Management turnover: Instability in key financial roles may increase risk.

• High market pressure: Pressure to meet earnings forecasts can incentivize aggressive accounting.

• Fraud risk: Any indicators of potential fraud necessitate a lower materiality.

• Bankruptcy risk: Financial distress increases the importance of even small misstatements to creditors and investors.

3.6 Example Numeric Guidelines

(No authoritative standard – for illustration only.)

These percentages are commonly observed practices but are not mandated by auditing standards. They serve as a starting point for auditor judgment, which must then be refined based on specific circumstances.

3.7 Qualitative Factors That Override Numbers

Fraud vs. Error: A fraudulent $RM50{,}000$ inventory overstatement may be considered more material than an unintentional $RM100{,}000$ error. Fraud reflects on management integrity and the control environment, which are crucial qualitative considerations.

Contractual Obligations: A misstatement that causes a breach of a debt covenant (e.g., failure to meet a working capital ratio requirement), even if for a small quantitative amount, can be highly material because it can trigger severe consequences like loan default.

Trend Distortion: A small misstatement that, if corrected, would flip a 5-year earnings growth pattern into a decline, or change reporting from a profit to a loss, is qualitatively material because it distorts key performance indicators.

Disclosure Compliance: Certain items require disclosure regardless of their magnitude (e.g., related-party transactions, contingencies, significant accounting policy changes). Failure to disclose these can be a material misstatement, even if financially small.

3.8 Professional Judgment Statement (Example Policy 1)

Guideline:

• Combined misstatements > $10\%$ of chosen base ⇒ materially misstated. This suggests a strong likelihood that the financial statements as a whole are not fairly presented.

• < $5\%$ ⇒ presumed immaterial (unless qualitative issues). If the aggregate misstatements fall below this threshold, they are generally considered immaterial, assuming no significant qualitative factors suggest otherwise.

• $5\%$–$10\%$ ⇒ gray zone requiring heightened judgment. This range requires the auditor to carefully consider all qualitative factors and the specific context of the entity before concluding on materiality. Additional audit work might be necessary in this range.

3.9 Professional Judgment Statement (Example Policy 2)

Income Statement misstatements: evaluate vs. $5\%$–$10\%$ of PBT. Profit Before Tax is a common base for income statement items because it's a key measure of profitability that users focus on. The percentage range allows for professional judgment.

Balance Sheet misstatements:

• Current assets / liabilities: $5\%$–$10\%$ of current assets or current liabilities. These provide insights into liquidity and short-term financial health.

• Total assets: $3\%$–$6\%$ of total assets. Total assets provide a broad measure of the company's size and resource base.

Multiple bases may be relevant; auditor selects those most meaningful to users. The auditor might use different bases for different types of accounts or even apply a blend of these to arrive at an appropriate materiality threshold, always keeping in mind what would most influence the decisions of financial statement users.

3.10 End of Topic 5 (Summary)

Audit Risk and Materiality are interwoven concepts guiding audit planning, evidence gathering, and reporting. They are fundamental to an effective and efficient audit, shaping the entire audit process from beginning to end.

Risk Model (IR, CR, DR) quantifies uncertainty; Materiality sets the threshold for significance. The risk model helps auditors assess and manage the various components of audit risk, while materiality dictates the level of precision required in the audit.

Effective audits balance these through prudent professional judgment, rigorous procedures, and an understanding of client context. The auditor must constantly exercise professional skepticism and judgment to navigate the complexities of audit risk and materiality, tailoring procedures to the specific circumstances of each client.