ISA 315: Audit Risk & Inherent Risk Spectrum

Audit Risk Overview and Definition

  • Definition of Audit Risk: Audit Risk is defined as the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated (e.g., issuing an unmodified opinion on overstated accounts).

  • Audit Risk Model Equations:

    • Audit Risk (AR)=Risk of Material Misstatement (RMM)×Detection Risk (DR)\text{Audit Risk (AR)} = \text{Risk of Material Misstatement (RMM)} \times \text{Detection Risk (DR)}
    • Audit Risk (AR)=[Inherent Risk (IR)×Control Risk (CR)]×Detection Risk (DR)\text{Audit Risk (AR)} = [\text{Inherent Risk (IR)} \times \text{Control Risk (CR)}] \times \text{Detection Risk (DR)}

Components of Audit Risk

  • Inherent Risk (IR):

    • Core Category: Entity Nature.
    • ISA 315 Definition: The susceptibility of an assertion to a material misstatement before consideration of any related internal controls.
    • Responsibility: Belongs to the Client's Business / Environment and is outside the auditor's direct control.

  • Control Risk (CR):

    • Core Category: Internal Controls.
    • ISA 315 Definition: The risk that a misstatement will not be prevented, or detected and corrected, on a timely basis by the entity's internal controls.
    • Responsibility: Belongs to Client Management and is driven by control design and operational gaps.

  • Detection Risk (DR):

    • Core Category: Auditor Testing.
    • ISA 315 Definition: The risk that auditor procedures fail to detect a material misstatement. Made up of Sampling Risk and Non-Sampling Risk.
    • Responsibility: Under Auditor Direct Control and managed via sample size selection and test design.

The 5 Inherent Risk Factors (ISA 315 Revised)

Under revised ISA 315, auditors assess where an assertion lies on the spectrum of inherent risk by evaluating 5 key inherent risk factors:

  • 1. Complexity (Factor 1):

    • Description: Arises when transactions or calculations are intricate and difficult to process or understand.
    • ACCA AA Exam Examples: Complex financial instruments, intricate revenue recognition structures (IFRS 15), or business combinations.

  • 2. Subjectivity (Factor 2):

    • Description: Arises from management bias or management judgment where no exact objective value exists.
    • ACCA AA Exam Examples: Accounting estimates such as inventory Net Realizable Value (NRV) provisions (IAS 2), legal provisions (IAS 37), or asset impairment models.

  • 3. Change (Factor 3):

    • Description: Arises from updates in events, operations, accounting standards, or legal environment over time.
    • ACCA AA Exam Examples: Implementation of a new IT / accounting system during the year or adopting a new IFRS standard.

  • 4. Uncertainty (Factor 4):

    • Description: Arises when outcomes depend on unknown future events or lack sufficient historical data.
    • ACCA AA Exam Examples: Pending legal disputes, warranty claims estimation, or assessing going concern feasibility.

  • 5. Susceptibility to Misstatement Due to Management Bias / Fraud Factors (Factor 5):

    • Description: Susceptibility to intentional or unintentional bias, management override, or fraud incentives.
    • ACCA AA Exam Examples: Profit-based management bonuses, pressure to meet bank loan covenants, or earnings manipulation at year-end.

Detection Risk Breakdown and Matrix

  • Sampling Risk: The risk that the auditor's sample leads to a different conclusion than testing 100% of the population.

  • Non-Sampling Risk: The risk of reaching an incorrect conclusion due to human error, inappropriate audit tests, or misinterpreting evidence.

  • Inverse Relationship:

    • As Risk of Material Misstatement (RMM = Inherent Risk ×\times Control Risk) increases, the auditor must reduce acceptable Detection Risk.
    • Required Auditor Actions: The auditor reduces acceptable Detection Risk by:
    • Increasing sample sizes.
    • Assigning senior auditors.
    • Performing substantive procedures closer to year-end.