Audit Strategy, Planning, Materiality and Risk Assessment

Introduction and context

Audit quality is shaped long before substantive testing begins. An auditor who accepts an engagement without understanding its commercial context, reporting risks, information systems and governance arrangements may perform many procedures yet fail to obtain appropriate evidence. Audit strategy and planning provide the structure through which professional judgement is converted into a coherent, efficient and defensible audit.

This chapter considers the relationship between overall audit strategy, detailed audit planning, materiality, risk assessment and audit responses. It is grounded in the principles of International Standards on Auditing (ISAs), particularly ISA 300 (Planning an Audit of Financial Statements), ISA 315 (Identifying and Assessing the Risks of Material Misstatement), ISA 320 (Materiality in Planning and Performing an Audit), ISA 330 (The Auditor’s Responses to Assessed Risks), ISA 240 (Fraud), ISA 570 (Going Concern), ISA 550 (Related Parties), ISA 600 (Group Audits) and ISA 701 (Key Audit Matters, where applicable).

Planning is not a preliminary administrative exercise. It is a continuing process that begins before fieldwork, develops as evidence is obtained and ends only when the audit is completed and evaluated.

Learning objectives

By the end of this chapter, the reader should be able to:

• distinguish an overall audit strategy from a detailed audit plan;
• determine and apply materiality and performance materiality;
• obtain an appropriate understanding of the entity and its environment;
• identify and assess risks of material misstatement, including significant risks;
• apply the audit risk model critically rather than mechanically;
• design responses that address assessed risks at both financial-statement and assertion levels;
• allocate audit resources according to risk, materiality and evidence requirements; and
• evaluate limitations, ethical issues and the effects of technology on audit planning.

1. The architecture of audit planning

1.1 Overall audit strategy

The overall audit strategy establishes the scope, timing and direction of the audit. It answers questions such as:

• What entities, locations, components and reporting periods are within scope?
• What financial reporting framework applies?
• What level of reliance, if any, may be placed on internal controls?
• Which areas require specialist knowledge?
• When will interim and final procedures be performed?
• What staffing, supervision and review arrangements are necessary?

The strategy is high-level. It does not list every test, but it provides the framework within which the detailed audit plan is developed.

1.2 Detailed audit plan

The audit plan translates the strategy into procedures. It normally specifies the nature, timing and extent of risk assessment procedures, tests of controls and substantive procedures. It also identifies the relevant financial statement assertions and the evidence expected to support conclusions.

The distinction is important. A strategy may state that revenue recognition is a high-risk area requiring senior involvement and specialist support. The plan then determines procedures such as contract inspection, cut-off testing, analytical procedures, confirmation and testing of manual journal entries.

1.3 Planning as an iterative process

Planning is revised when new information emerges. For example, an apparently simple receivables balance may become high risk when confirmations reveal disputed invoices. Similarly, a planned reliance on controls may be abandoned if walkthroughs and tests show that controls are not operating consistently. Changes must be documented, communicated to the engagement team and reflected in the revised audit plan.

2. Understanding the entity and its environment

ISA 315 requires the auditor to obtain an understanding sufficient to identify and assess risks of material misstatement. The understanding should be sufficiently deep to explain how misstatements could arise, not merely to describe the business.

2.1 Areas of understanding

The auditor considers:

1. Industry and external environment. This includes regulation, competition, technological change, economic conditions, supply-chain dependence, interest rates and foreign exchange exposure.
2. Nature of the entity. Ownership, governance, organisational structure, financing, subsidiaries, investments and sources of revenue are relevant.
3. Accounting policies. Attention is given to unusual, complex, newly adopted or judgement-sensitive policies.
4. Objectives and strategies. Expansion targets, debt covenants, planned disposals and performance-linked remuneration may create incentives for misstatement.
5. Measurement and review of performance. Budgets, key performance indicators and management reports may reveal pressure or unusual trends.
6. Internal control. The auditor considers the control environment, risk assessment process, information system, control activities and monitoring.
7. Information technology. Automated controls, interfaces, access rights, data integrity and system changes may affect audit risk.

2.2 Sources of knowledge

Useful sources include prior-year working papers, board minutes, management accounts, budgets, contracts, regulatory correspondence, internal audit reports, meetings with management and those charged with governance, site visits, observation, analytical procedures and inquiries of operational personnel.

Inquiry alone is insufficient where corroborating evidence is reasonably available. For example, management may state that inventory is slow-moving only in a small proportion of locations; inventory ageing reports and sales data should be examined to corroborate that statement.

2.3 Analytical procedures during planning

Planning analytics help the auditor identify unusual relationships and changes. Examples include:

• gross margin by product and location;
• days sales outstanding compared with prior periods;
• payroll cost per employee;
• inventory turnover;
• revenue by month and sales channel; and
• cash flows compared with reported profit.

Analytical procedures do not prove that a balance is correct. They identify matters requiring investigation and help direct audit effort.

3. Materiality: a professional judgement

Materiality reflects the importance of information to users’ decisions. Information is material if omitting, misstating or obscuring it could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements.

Materiality has both quantitative and qualitative dimensions. A small amount may be material because it changes a profit into a loss, breaches a debt covenant, affects regulatory capital, conceals an unlawful transaction or masks a related-party relationship. Conversely, a large but clearly immaterial classification error may have limited influence if it does not affect decisions, although aggregation and presentation still require attention.

3.1 Planning materiality

The auditor establishes materiality for the financial statements as a whole. A benchmark is selected based on users’ needs and the entity’s circumstances. Common benchmarks include profit before tax for a profit-oriented entity, revenue for entities with volatile profits, total assets for asset-based entities and expenditure for not-for-profit organisations.

There is no universally correct percentage. A percentage is only a starting point for judgement. The auditor considers stability of the benchmark, ownership structure, financing, industry practice and the needs of users.

3.2 Performance materiality

Performance materiality is set below materiality for the financial statements as a whole. Its purpose is to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds overall materiality. It is not a mechanical fixed percentage and may differ across account balances or classes of transactions where risks differ.

3.3 Specific materiality

Specific materiality may be established for particular classes of transactions, account balances or disclosures where users are likely to focus on them. Examples include directors’ remuneration, related-party transactions, segment information, regulatory disclosures and covenant compliance.

3.4 Clearly trivial threshold

The auditor also establishes an amount below which misstatements are clearly trivial and need not be accumulated. “Clearly trivial” does not mean merely smaller than materiality; it means plainly inconsequential, individually and in aggregate, to the financial statements.

3.5 Illustrative calculation

Assume a manufacturing company has stable profit before tax of CU12 million. After considering users and circumstances, the auditor selects 5% as an appropriate starting point:

If performance materiality is set at 70% after considering moderate control risk:

If the clearly trivial threshold is set at CU30,000, misstatements below that amount are not accumulated unless qualitative factors make them important. These figures are illustrative, not prescribed rules. The assumptions are that profit is a relevant and stable benchmark and that the selected percentages reflect professional judgement.

4. Risk assessment and the audit risk model

The objective of risk assessment is to identify and assess risks of material misstatement at the financial-statement and assertion levels.

4.1 Components of audit risk

Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. The traditional model is:

where:

• AR = audit risk;
• IR = inherent risk, the susceptibility of an assertion to misstatement before considering related controls;
• CR = control risk, the risk that a misstatement will not be prevented, or detected and corrected, on a timely basis by internal control; and
• DR = detection risk, the risk that audit procedures will not detect a misstatement that exists and could be material.

The model is a conceptual planning aid, not a precise statistical equation. Its components are not fully independent, risks are difficult to measure numerically and professional standards require an approach based on identified risks rather than a formula alone.

4.2 Inherent risk

Inherent risk increases with complexity, subjectivity, uncertainty, change and susceptibility to fraud. Examples include:

• fair values based on unobservable inputs;
• provisions involving uncertain legal outcomes;
• revenue arrangements with multiple performance obligations;
• estimates dependent on forecasts;
• transactions with related parties; and
• significant transactions outside the normal course of business.

The auditor assesses inherent risk before considering controls and considers where the risk lies on a spectrum from lower to higher.

4.3 Control risk

Control risk is assessed through understanding and, where reliance is intended, testing relevant controls. A well-designed control may nevertheless fail because of poor implementation, override, collusion, inadequate segregation of duties or changes in personnel and systems.

4.4 Detection risk and audit response

Detection risk is affected by the nature, timing and extent of audit procedures. It can be reduced by using more experienced staff, increasing sample sizes where appropriate, performing procedures closer to year-end, testing more persuasive evidence and introducing unpredictability. Detection risk cannot be reduced to zero because audits have inherent limitations.

A simplified planning relationship is:

This rearrangement is useful only as a conceptual illustration. Risk assessments should not be treated as objectively measurable percentages unless a properly designed quantitative methodology supports such estimates.

4.5 Financial-statement-level and assertion-level risks

Financial-statement-level risks affect the financial statements broadly. Examples include weak management integrity, ineffective governance, severe liquidity pressure and inadequate accounting personnel. Such risks influence the overall audit response, staffing, supervision and professional scepticism.

Assertion-level risks relate to classes of transactions, account balances and disclosures. Assertions include existence, occurrence, completeness, accuracy, cut-off, classification, rights and obligations, valuation and presentation.

5. Significant risks

A significant risk is an assessed risk of material misstatement that, in the auditor’s judgement, requires special audit consideration. It commonly arises from:

• fraud risk;
• significant non-routine transactions;
• complex accounting;
• high estimation uncertainty;
• unusual related-party transactions; or
• transactions involving management judgement and override.

The designation is not based only on the size of an account. A small related-party transaction may be significant because of its nature. For significant risks, the auditor obtains an understanding of relevant controls and designs responses specifically addressing the risk.

ISA 240 presumes a fraud risk in revenue recognition unless that presumption is rebutted and documented. Management override is also a pervasive fraud risk. Typical responses include testing journal entries, reviewing accounting estimates for bias and evaluating the business rationale for significant unusual transactions.

6. Designing audit responses

6.1 Responses at the overall level

Overall responses may include assigning senior personnel, increasing supervision, incorporating unpredictability, using specialists, extending work to additional locations and modifying the nature or timing of procedures. Where the control environment is weak, the auditor may reduce planned reliance on controls and increase substantive work.

6.2 Responses at assertion level

The auditor designs procedures that address the assessed risk and relevant assertion. For example:

6.3 Tests of controls and substantive procedures

Tests of controls evaluate whether controls operated effectively during the relevant period. They are appropriate when the auditor intends to rely on controls or when substantive procedures alone cannot provide sufficient appropriate evidence.

Substantive procedures comprise tests of details and substantive analytical procedures. Even where controls are effective, substantive procedures are generally required for material classes of transactions, balances and disclosures. The nature and extent depend on assessed risk, materiality, expected misstatement and the persuasiveness of available evidence.

7. Resource allocation and audit efficiency

Risk-based allocation does not mean ignoring low-risk balances; it means calibrating work to the likelihood and consequence of misstatement. High-risk areas may receive senior staff, more review time, specialists and procedures performed at or near year-end. Routine, low-risk areas may be addressed through efficient sampling and analytical procedures.

For group audits, the group engagement team determines component significance, communicates instructions, evaluates component auditors and considers whether evidence is sufficient at group level. Shared service centres and automated systems may permit centralised testing, but only after understanding how controls operate across locations.

Time budgets should support quality rather than pressure the team to omit necessary work. Commercial considerations must not override the auditor’s responsibility to obtain sufficient appropriate evidence.

8. Applied case: Northstar Mobility plc

Background

Northstar Mobility plc, an illustrative listed manufacturer of electric delivery vehicles, has grown rapidly through online sales and a new foreign subsidiary. Revenue increased by 32%, while operating cash flow declined. Management bonuses depend on reported revenue and adjusted operating profit. The company also capitalised substantial development expenditure and holds battery inventory subject to rapid technological obsolescence.

Problem

The engagement team must develop the audit strategy and determine whether revenue, development costs, inventory and going concern require special attention.

Analysis

The industry is technologically volatile and competitive. Revenue growth creates an incentive to record sales prematurely. Online sales involve multiple delivery terms, customer acceptance provisions and rights of return. Development costs require judgement about technical feasibility and future economic benefits. Battery inventory may become obsolete if new models are introduced. Declining operating cash flow and expansion financing indicate possible liquidity pressure.

The team identifies the following risks:

• revenue occurrence and cut-off: high inherent risk and presumed fraud risk;
• development asset valuation and classification: high estimation uncertainty;
• inventory valuation: high risk because of obsolescence;
• foreign subsidiary consolidation: risk of translation and intercompany errors;
• going concern: risk requiring focused evaluation; and
• management override: pervasive fraud risk.

Approach and solution

The strategy assigns an experienced revenue specialist, an IT auditor to evaluate the online order system, and a valuation specialist for development assets where necessary. Interim work includes walkthroughs of order-to-cash and capitalisation controls. Final work includes testing transactions around year-end, inspecting proof of delivery, examining credit notes after year-end and confirming selected customer balances.

For development assets, the team tests project records, technical feasibility approvals, budgets and post-year-end commercial evidence. For inventory, it attends counts, tests count accuracy, analyses ageing and compares carrying amounts with subsequent selling prices. For going concern, it evaluates forecasts, financing facilities, covenant compliance, sensitivity analysis and management’s mitigation plans.

Journal-entry testing focuses on unusual revenue entries, entries posted late, entries made by senior users and entries affecting estimates or unusual accounts. The team communicates the identified significant risks and planned responses to those charged with governance.

Outcome

Testing identifies a pattern of sales recorded before customer acceptance and obsolete batteries carried at cost. Management corrects the revenue and inventory misstatements. The revised cash-flow forecast also reveals a covenant breach requiring disclosure and discussion of material uncertainty related to going concern. The audit opinion and reporting to governance reflect the corrected information and the auditor’s conclusions.

Learning points

The case demonstrates that risk assessment must connect business facts to assertions and procedures. Growth, incentives, technology and liquidity are not audit conclusions by themselves; they are indicators that guide evidence gathering. It also shows why planning must remain dynamic as audit evidence changes the risk assessment.

9. Ethics, governance and regulatory considerations

Professional scepticism requires a questioning mind and critical assessment of evidence. Familiarity, self-interest, intimidation and advocacy threats may impair judgement, especially where the auditor has served the client for many years or faces fee pressure. Independence safeguards, partner rotation where required, consultation and engagement quality review are therefore relevant to planning.

Those charged with governance should receive timely communication about the planned scope, significant risks, materiality-related matters where appropriate, identified deficiencies and significant changes to the audit plan. Governance communication improves accountability but does not transfer responsibility for the audit to the audit committee.

Documentation should enable an experienced auditor with no previous connection to understand the significant matters, procedures performed, evidence obtained and conclusions reached. Documentation created after the fact, without a sound contemporaneous record, weakens audit defensibility.

10. Technology, data analytics and contemporary developments

Data analytics can examine complete populations rather than small samples, identify unusual combinations of attributes and visualise transaction flows. Machine-learning tools may prioritise transactions for investigation, but they do not replace professional judgement. Risks include incomplete data extraction, incorrect system interfaces, biased algorithms, inappropriate thresholds, cyber compromise and poor explainability.

The auditor should establish data lineage, validate the population, reconcile extracted data to the general ledger and investigate exceptions. An exception is not necessarily a misstatement; it is an indicator requiring appropriate follow-up.

Remote and hybrid audits create additional risks concerning observation of inventory counts, secure communication, evidence authenticity and team coordination. Cloud systems and automated controls require attention to access management, change controls, cybersecurity and service-organisation reports.

Challenges and limitations

Audit planning involves uncertainty. Materiality cannot be reduced to a formula, risk models are imperfect, management representations may be biased and evidence may be contradictory. Sampling creates a risk that a representative conclusion is not reached; analytical procedures may miss unusual transactions; and controls can be overridden or colluded around.

The auditor must therefore combine professional judgement, sufficient appropriate evidence, critical evaluation and effective supervision. A detailed plan is not a substitute for alertness. Nor is a high volume of documentation evidence of a high-quality audit.

Best-practice principles

A robust planning process should:

1. begin with users’ information needs and the entity’s business model;
2. link identified risks to assertions and planned procedures;
3. distinguish inherent risk from control risk;
4. set materiality using informed judgement and revisit it when circumstances change;
5. give special attention to fraud, estimates, related parties, going concern and unusual transactions;
6. involve specialists and information-technology expertise when needed;
7. allocate experienced personnel to high-risk areas;
8. communicate significant matters to the engagement team and governance bodies;
9. document the reasoning behind significant judgements; and
10. revise the strategy when evidence contradicts initial expectations.

Chapter Summary

Audit strategy establishes the scope, timing and direction of an engagement, while the detailed audit plan specifies procedures addressing assessed risks. Effective planning depends on a meaningful understanding of the entity, its environment, internal control, technology, objectives and incentives.

Materiality is a user-focused professional judgement with quantitative and qualitative dimensions. Overall materiality, performance materiality, specific materiality and the clearly trivial threshold serve different purposes. The audit risk model, AR = IR × CR × DR, provides a conceptual framework for understanding how inherent and control risks influence the acceptable level of detection risk, but it is not a mechanical substitute for judgement.

Risk assessment operates at financial-statement and assertion levels. Significant risks require special consideration and tailored responses. Audit procedures may include tests of controls, substantive analytical procedures and tests of details. Resource allocation should reflect risk, complexity, materiality and the need for specialist knowledge. Ethical behaviour, independence, professional scepticism, governance communication and high-quality documentation are essential throughout the process. Technology can improve coverage and insight, but data quality, cybersecurity, algorithmic bias and explainability must be controlled.

Key Terms

Audit strategy: The high-level framework establishing the scope, timing and direction of an audit.

Audit plan: The detailed description of planned risk assessment, control and substantive procedures.

Materiality: The importance of an omission, misstatement or obscuring of information to users’ decisions.

Performance materiality: An amount below overall materiality used to reduce the risk that aggregate misstatements exceed overall materiality.

Clearly trivial threshold: An amount below which misstatements are plainly inconsequential.

Inherent risk: Susceptibility of an assertion to material misstatement before related controls.

Control risk: Risk that internal control fails to prevent or detect and correct a material misstatement.

Detection risk: Risk that audit procedures fail to detect an existing material misstatement.

Audit risk: Risk of expressing an inappropriate opinion on materially misstated financial statements.

Significant risk: An assessed risk requiring special audit consideration.

Assertion: A representation about recognition, measurement, presentation or disclosure in financial statements.

Professional scepticism: A questioning mind and critical assessment of audit evidence.

Substantive procedure: An audit procedure designed to detect material misstatement at assertion level.

Test of controls: A procedure evaluating whether a control operated effectively.

Inherent risk spectrum: The range from lower to higher levels of susceptibility to misstatement.

Going concern: The assumption that an entity will continue operating for the foreseeable future.

Management override: Deliberate circumvention of controls by management.

Audit evidence: Information used by the auditor in reaching conclusions.

Data lineage: The traceable path by which data is created, transformed, extracted and used.

Review Questions

Short Answer Questions

1. Distinguish an overall audit strategy from a detailed audit plan.
2. What is performance materiality, and why is it set below overall materiality?
3. Identify four areas included in the auditor’s understanding of an entity and its environment.
4. Define inherent risk and control risk.
5. Why is revenue recognition commonly treated as a fraud-risk area?

Long Answer Questions

1. Explain how an auditor should determine and document materiality, including qualitative considerations.
2. Discuss the audit risk model and explain why it should not be applied as a purely mechanical calculation.
3. Explain the relationship between significant risks, financial-statement-level risks and assertion-level risks.
4. Discuss how audit strategy and resource allocation should change when an entity has weak controls and significant estimation uncertainty.
5. Evaluate the benefits and limitations of using data analytics in audit planning and risk assessment.

Analytical / Application Questions

1. A company reports stable profit before tax of CU20 million. The auditor selects 4% as a planning benchmark and sets performance materiality at 65% of overall materiality. Calculate both amounts and explain why the percentages require professional judgement.
2. An online retailer records a large increase in sales during the final three days of the year, while returns increase sharply in January. Identify the likely assertions and design appropriate audit responses.
3. A borrowing covenant may be breached, management has capitalised large development costs and inventory turnover has deteriorated. Develop an audit strategy addressing materiality, significant risks, staffing, specialist involvement and going-concern procedures.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the overall audit strategy?

A. It lists every individual invoice selected for testing.

B. It establishes the overall scope, timing and direction of the audit.

C. It records only management’s representations.

D. It replaces the need for a detailed audit plan.

Correct Answer: B. It establishes the overall scope, timing and direction of the audit.

Question 2

Which factor most directly increases inherent risk?

A. A simple, routine transaction processed by a stable system.

B. A fully automated control that has operated consistently.

C. A fair-value estimate based on highly subjective assumptions.

D. A bank confirmation received directly by the auditor.

Correct Answer: C. A fair-value estimate based on highly subjective assumptions.

Question 3

What is the principal purpose of performance materiality?

A. To determine the audit fee.

B. To eliminate all audit risk.

C. To reduce the risk that aggregate undetected and uncorrected misstatements exceed overall materiality.

D. To identify the entity’s accounting framework.

Correct Answer: C. To reduce the risk that aggregate undetected and uncorrected misstatements exceed overall materiality.

Question 4

If profit before tax is CU20 million and the selected benchmark is 4%, planning materiality is:

A. CU80,000

B. CU500,000

C. CU800,000

D. CU8,000,000

Correct Answer: C. CU800,000

Question 5

Which is an assertion-level risk?

A. Weak ethical culture throughout the organisation.

B. A risk that inventory is overstated because obsolete items are not written down.

C. A shortage of experienced audit staff.

D. A limitation on the audit firm’s office space.

Correct Answer: B. A risk that inventory is overstated because obsolete items are not written down.

Question 6

Which matter commonly requires special audit consideration as a significant risk?

A. A routine stationery purchase with effective controls.

B. A complex, unusual transaction with substantial management judgement.

C. A clearly trivial rounding difference.

D. A transaction supported by direct external evidence and no unusual features.

Correct Answer: B. A complex, unusual transaction with substantial management judgement.

Question 7

Under the conceptual audit risk model, audit risk equals:

A. Inherent risk plus control risk plus detection risk.

B. Inherent risk multiplied by control risk multiplied by detection risk.

C. Control risk divided by inherent risk.

D. Detection risk minus inherent risk.

Correct Answer: B. Inherent risk multiplied by control risk multiplied by detection risk.

Question 8

Which procedure is most directly relevant to testing the completeness of trade payables?

A. Inspecting subsequent cash payments and unmatched receiving reports.

B. Confirming only selected customer balances.

C. Recalculating depreciation on buildings.

D. Observing the payroll approval process.

Correct Answer: A. Inspecting subsequent cash payments and unmatched receiving reports.

Question 9

Which statement about planning analytical procedures is correct?

A. They prove that all account balances are correct.

B. They are used only after the audit opinion is issued.

C. They help identify unusual relationships and areas requiring investigation.

D. They remove the need to understand the entity’s business model.

Correct Answer: C. They help identify unusual relationships and areas requiring investigation.

Question 10

Which is an appropriate response to a high-risk automated revenue system?

A. Ignore information technology because the system is automated.

B. Use IT expertise, test relevant controls and perform substantive procedures over revenue and cut-off.

C. Accept management’s written representation without further work.

D. Reduce audit work because automation guarantees accuracy.

Correct Answer: B. Use IT expertise, test relevant controls and perform substantive procedures over revenue and cut-off.