Exam 2 Essay Questions

What is the difference between acceptable audit risk and audit risk? When is each assessed during the audit phase (if at all)? 

  • Acceptable audit risk is the level of risk an auditor is willing to accept that the financial statements contain a material misstatement after the audit is completed. Audit risk is the risk that the auditor issues an inappropriate opinion when the financial statements contain a material misstatement.


  • Acceptable audit risk is assessed during the audit planning phase, while audit risk is considered throughout the audit as the auditor assesses risks, performs procedures, and evaluates evidence to ensure the risk is reduced to an acceptably low level.

What is the difference between a known misstatement and a likely misstatement? Give an example of each.

  • Known misstatement: misstatements where the error is exactly known (from audit procedures)

    • Cash balance on the books compared to the actual bank statement not being equal.

  • Likely misstatement: misstatements where we project the error onto the population using sample procedures or differ with management about assumptions

    • AR balances projected based on sampling for the entire population

    • Allowance for doubtful accounts (estimating which amount of AR is not going to be collectible)

      • Management estimates this at 50M

      • Auditors estimate this at 80M

Risk assessment procedures are used for what purpose? List out the risk assessment procedures, give examples of each, and know the role they all together play in the audit. 

  • Risk assessment procedures are used to identify and assess the risks of material misstatement in the financial statements due to fraud or error and help the auditor understand the company and its internal controls.

The four main procedures are:

  1. Inquiry: Asking management and employees questions about the business. Example: Asking management about financial difficulties or changes in accounting procedures.

  2. Analytical procedures: Examining financial and nonfinancial data for unusual trends or relationships. Example: Comparing this year's revenue with last year's and investigating a large increase.

  3. Observation and inspection: Observing activities and examining documents and records. Example: Observing an inventory count or inspecting sales invoices.

  4. Discussion among audit team members: Discussing potential risks and how fraud or errors could occur. Example: Discussing whether revenue could be recorded before it is earned.

Together, these procedures help the auditor understand the company, identify areas at risk of material misstatement, and plan appropriate audit procedures. They guide the auditor on where to focus the audit but do not provide sufficient evidence on their own to support the final audit opinion.

What is the audit risk model? When and what does the auditor assess when determining each of the risks?

  • The audit risk model helps auditors assess the risk of material misstatement and determine how much audit evidence is needed. The formula is:

AAR= IR *CR * PDR

  • Acceptable Audit Risk (AAR): Assessed during initial audit planning. The auditor determines how much risk they are willing to accept that a material misstatement exists.

    • A company experiencing financial difficulties may have lower acceptable audit risk.

  • Inherent Risk (IR): Assessed during planning as the auditor learns about the company and its business environment. It is the likelihood of material misstatement before considering internal controls.

    • Example: Inventory may be misstated because of theft or obsolescence.

  • Control Risk (CR): Assessed during risk assessment after the auditor understands the company's internal controls. It is the risk that controls will fail to prevent, detect, or correct a material misstatement. The auditor tests controls when relying on them.

  • Planned Detection Risk (PDR): Determined during planning after assessing the other risks. It is the risk that audit procedures will fail to detect an existing material misstatement. The auditor adjusts the nature, timing, and extent of testing accordingly.

What is the fraud triangle? List the 3 components of the fraud triangle and give an example of each. Can fraud exist if one part of the triangle is missing?

  • Incentives & Pressures

    • Reason to commit the fraud

    • I will not pass the class

  • Opportunity

    • Ability to commit the fraud

    • Able to cheat

  • Attitudes/Rationalization

    • Why its ok (justify)

    • I cannot afford taking the class again / he was a bad professor

  • *without all 3, it cannot be fraud (if one is missing no fraud; can really only limit a & b)

Auditors must respond to fraud at 3 levels as opposed to two for error. What are the levels for fraud and error? Why does fraud require the third level? Use examples where possible.

  • Overall (financial statements can be wrong overall) [error & fraud]

    • Financial statements are wrong overall

  • Assertion (financial statements can be wrong on an assertion) [error & fraud]

    • One of the 5 assertions is wrong

  • Management override [only fraud]

    • Fraud is intentional whereas errors are not.

    • Fraud with management override works around internal controls (management designs the controls so they know how to work around them)