Audit Risk, Materiality, and Planning

Introduction

An audit is not an examination of every transaction. It is a systematic process through which an auditor obtains sufficient appropriate evidence to form an opinion on whether financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework. Because evidence is obtained on a test basis and because accounting estimates and human judgments are involved, an audit cannot provide absolute assurance. Audit planning therefore requires the auditor to identify risks, determine what could be materially misstated, and design procedures that reduce audit risk to an acceptably low level.

This chapter introduces the practical foundations of audit risk, materiality, audit objectives, and audit planning. It is intended for certificate-level learners who need to understand not only definitions, but also how these ideas guide the work performed on an audit engagement.

Learning Objectives

By the end of this chapter, you should be able to:

• explain the purpose and components of audit risk;
• apply the audit risk model in simple planning situations;
• distinguish inherent risk, control risk, and detection risk;
• identify risks of material misstatement at financial-statement and assertion levels;
• establish a reasonable preliminary materiality amount;
• formulate basic audit objectives and procedures;
• prepare a simple audit plan and audit program; and
• recognise the professional, ethical, and practical limitations of audit planning.

1. The Nature and Purpose of Audit Planning

Audit planning is the process of developing an overall audit strategy and a detailed approach for obtaining evidence. Planning begins before substantive testing and continues throughout the engagement. It helps the auditor to:

1. focus attention on areas where material misstatement is most likely;
2. assign appropriate staff and time;
3. coordinate the work of the audit team;
4. determine the nature, timing, and extent of audit procedures;
5. identify matters requiring professional judgment; and
6. document the basis for important audit decisions.

Planning does not mean that every procedure is fixed permanently at the beginning. If new evidence changes the auditor’s assessment of risk, the audit plan must be revised. For example, an unexpected increase in obsolete inventory may require additional valuation testing even if that work was not included in the original program.

A useful distinction is:

• Audit strategy: the broad direction, scope, timing, and resources of the audit.
• Audit plan: the more detailed description of how the strategy will be implemented.
• Audit program: a list of specific procedures to be performed, including their purpose, timing, and extent.

2. Audit Risk and Reasonable Assurance

2.1 Meaning of audit risk

Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. For example, an unmodified opinion may be issued even though the statements contain a material error that the auditor failed to detect.

Audit risk is not the same as business risk. Business risk concerns the possibility that the entity will fail to achieve its objectives. Audit risk concerns the possibility that the auditor’s opinion will be wrong. Business problems can increase audit risk, but the two concepts should not be confused.

An auditor seeks to reduce audit risk to an acceptably low level, not to zero. Absolute assurance is generally impossible because of sampling, the use of judgment, limitations in internal control, persuasive rather than conclusive evidence, and the possibility of fraud involving collusion or management override.

2.2 The audit risk model

The traditional audit risk model expresses the relationship as follows:

where:

The model is a planning relationship rather than a precise mechanical measurement. Risk percentages are often estimates based on professional judgment, prior experience, industry knowledge, inquiries, analytical procedures, and tests of controls.

The model assumes that the components are related multiplicatively for planning purposes. It is most useful for showing that when inherent risk and control risk are high, the auditor must generally accept a lower level of detection risk by performing more effective or extensive procedures.

If the auditor uses an estimated acceptable audit risk and assessed inherent and control risks, planned detection risk can be expressed as:

This rearrangement is appropriate only when the risk assessments are expressed on a consistent scale and the denominator is not zero. The result is a planning estimate, not a guarantee that the actual detection risk will equal the calculated amount.

2.3 Components of the model

Inherent risk. Inherent risk arises from the nature of an account, transaction, or assertion, before considering controls. Cash is susceptible to theft; complex financial instruments may be difficult to value; and management estimates may be affected by uncertainty. A simple, routine account may have lower inherent risk than a highly judgmental account.

Factors that may increase inherent risk include:

• complexity or unusual transactions;
• significant accounting estimates;
• rapid changes in technology or markets;
• pressure to meet earnings targets;
• susceptibility of assets to theft;
• related-party transactions; and
• prior-period errors or restatements.

Control risk. Control risk reflects the possibility that the entity’s internal controls will fail to prevent or detect a material misstatement. A well-designed control may still have high control risk if it is not implemented or does not operate consistently. Examples include inadequate segregation of duties, lack of review of journal entries, weak password controls, and failure to reconcile bank accounts.

Detection risk. Detection risk is the risk that the auditor’s procedures fail to detect a misstatement. It is the component most directly influenced by the auditor. Detection risk can be reduced through larger samples, more persuasive evidence, better timing, experienced staff, independent confirmations, physical inspection, and appropriately designed substantive procedures. It cannot be eliminated entirely.

2.4 Simple application of the model

Suppose the auditor sets acceptable audit risk at 5%, assesses inherent risk at 80%, and assesses control risk at 50%. Planned detection risk is:

The auditor should therefore plan procedures capable of keeping detection risk at approximately 12.5% or lower. If control risk were assessed at 80% instead of 50%, planned detection risk would become:

The lower planned detection risk implies more persuasive audit evidence. These calculations do not prove that a particular sample size is correct; sampling decisions also depend on population size, expected error, tolerable error, and the quality of available evidence.

3. Financial Statement Risks and Assertions

3.1 Risk of material misstatement

The risk of material misstatement is the risk that the financial statements contain a material misstatement before the audit is performed. It is commonly viewed as the combination of inherent risk and control risk. The auditor identifies this risk at two levels:

• Financial-statement level: risks affecting the statements as a whole, such as weak management integrity, inadequate accounting staff, or serious going-concern uncertainty.
• Assertion level: risks relating to particular classes of transactions, account balances, and disclosures.

A good risk assessment links each identified risk to an assertion and to a planned audit response.

3.2 Management assertions

Assertions are representations, explicit or otherwise, made by management in the financial statements. The main assertions include:

The same account can involve several assertions. For example, accounts receivable may be overstated because fictitious balances were recorded, because genuine balances are not recoverable, or because credit notes were omitted. These involve existence, valuation, completeness, and cut-off in different ways.

3.3 Risk identification procedures

At the planning stage, the auditor normally performs procedures such as:

• inquiries of management and relevant employees;
• inspection of minutes, contracts, budgets, and prior financial statements;
• analytical procedures, including comparisons and ratio analysis;
• observation of operations and internal control activities;
• discussion with the previous auditor, where permitted;
• consideration of changes in the business, industry, and regulation; and
• evaluation of information obtained from internal audit or specialists.

Analytical procedures may reveal unusual relationships. For example, sales may increase by 25% while cash collections fall and receivables increase by 60%. This does not prove that revenue is misstated, but it indicates that revenue occurrence, cut-off, and receivable valuation deserve attention.

4. Materiality

4.1 Meaning and purpose

Information is material if omitting, misstating, or obscuring it could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements. Materiality depends on both size and nature.

An amount may be material because of its size, but a smaller amount may be material because of its nature. Examples include an illegal payment, a related-party transaction, a breach of a loan covenant, or an error that changes a reported profit into a loss.

Materiality is applied when:

• planning and performing the audit;
• assessing identified misstatements; and
• forming the audit opinion.

Materiality is not a substitute for professional judgment, and it is not a safe limit below which every error can be ignored.

4.2 Overall materiality and performance materiality

Overall materiality is the threshold for the financial statements as a whole. It represents the level at which misstatements, individually or in aggregate, could reasonably influence users.

Performance materiality is set below overall materiality to reduce the probability that the aggregate of uncorrected and undetected misstatements exceeds overall materiality. It is used in designing audit procedures and sample sizes.

The relationship is normally:

A further threshold may be established for clearly trivial misstatements. Such a threshold is not the same as overall materiality and should not be used to justify ignoring potentially important qualitative matters.

4.3 Establishing a preliminary amount

Materiality is determined using professional judgment. A common starting method is to select an appropriate benchmark and apply a reasonable percentage. Possible benchmarks include profit before tax, revenue, total assets, or equity. The appropriate benchmark depends on the entity and the needs of financial-statement users.

For illustration only, suppose a stable profit-oriented entity has profit before tax of $500,000 and the auditor uses 5% as a preliminary benchmark percentage:

If performance materiality is set at 75% of overall materiality:

The 5% and 75% figures are illustrative, not universal rules. Professional standards do not prescribe one percentage suitable for every entity. A small percentage of revenue may be more appropriate where profit is volatile or close to zero. Materiality should be reconsidered if actual results differ substantially from the estimates used in planning.

4.4 Misstatements and aggregation

The auditor accumulates identified misstatements, except those clearly trivial, and evaluates whether they are material individually or in aggregate. A misstatement below overall materiality may still be significant when combined with other errors or when it affects a sensitive disclosure or legal requirement.

The auditor also considers uncorrected misstatements from prior periods. Management may correct errors, but the auditor must still evaluate the effect of corrected and uncorrected errors on the financial statements and the audit opinion.

5. From Risks to Audit Objectives and Procedures

An audit objective states what the auditor seeks to establish. A procedure states how evidence will be obtained. These must not be confused.

For example:

• Objective: obtain evidence that recorded inventory exists and is properly valued.
• Procedures: attend the inventory count, perform test counts, inspect selected items, and compare cost with recent selling prices or other valuation evidence.

A procedure should be linked to a risk and an assertion. The following examples illustrate this relationship:

The nature, timing, and extent of procedures depend on assessed risk. High-risk areas generally require more persuasive evidence, more experienced personnel, closer supervision, or testing nearer to the reporting date.

6. Preparing a Simple Audit Plan

A practical audit plan should document at least the following matters:

1. Engagement characteristics: reporting framework, period under audit, locations, entities, and expected report date.
2. Understanding of the entity: business model, industry, ownership, accounting systems, and regulatory environment.
3. Preliminary analytical procedures: major trends, ratios, and unexpected balances.
4. Materiality: overall materiality, performance materiality, and the basis for selecting them.
5. Risk assessment: significant risks, affected accounts, assertions, and relevant controls.
6. Planned responses: tests of controls, substantive analytical procedures, tests of details, and use of specialists.
7. Timing and staffing: interim work, year-end work, inventory attendance, review responsibilities, and deadlines.
8. Communication: matters to communicate to management and those charged with governance.
9. Documentation and follow-up: working papers, unresolved matters, and review notes.

A plan should be sufficiently specific to guide the team but flexible enough to respond to new information.

A simple audit program

An audit program converts the plan into action. A basic program for trade receivables might include:

1. obtain the receivables listing and agree its total to the general ledger;
2. test the mathematical accuracy of the listing;
3. select balances for external confirmation;
4. investigate differences and non-responses using alternative procedures;
5. inspect subsequent cash receipts for selected balances;
6. review aged balances and evaluate the allowance for expected credit losses;
7. test sales and receipts around year-end for cut-off;
8. investigate credit notes issued after year-end;
9. consider related-party and disputed balances; and
10. document exceptions, conclusions, and proposed adjustments.

The program should identify the preparer, reviewer, date, sample selected, evidence obtained, exceptions found, and conclusion reached. A checklist showing only ticks, without evidence or conclusions, is not an adequate audit working paper.

7. Illustrative Case: Bright Office Supplies Ltd.

This is a fictional illustrative case.

Background

Bright Office Supplies Ltd. sells stationery and computer accessories to small businesses. Its year-end is 31 December. Revenue increased from $2.0 million to $2.8 million during the year, while trade receivables increased from $300,000 to $540,000. The company introduced an online sales platform in November and hired a new finance manager. Inventory includes several discontinued printer models.

Problem

The audit team must identify significant risks, set preliminary materiality, and prepare a short audit plan. Profit before tax is $420,000. The auditor selects profit before tax as the initial benchmark because the company is profit-oriented and profits are reasonably stable.

Analysis

Using an illustrative 5% benchmark:

Assume the auditor sets illustrative performance materiality at 70%:

Risk analysis includes:

• Revenue: rapid growth and a new online system create occurrence and cut-off risks. There may also be incomplete processing between the online platform and the accounting system.
• Receivables: receivables increased much faster than revenue, creating valuation and existence concerns.
• Inventory: discontinued products create a valuation risk because their selling prices may be below cost.
• Information technology: changes to the online platform may cause interface or access-control failures.
• Management override: unusual manual journal entries near year-end should be considered because rapid growth may create pressure to report strong results.

Approach and solution

The audit team should first document the systems used for online sales and identify controls over order approval, dispatch, invoicing, returns, and data transfer. It should test selected controls if reliance is intended; otherwise, it should plan stronger substantive procedures.

For revenue, the team should select transactions before and after year-end and agree them to customer orders, dispatch records, invoices, and accounting entries. For receivables, it should confirm selected balances, inspect subsequent receipts, investigate non-responses, and review the allowance. For inventory, auditors should attend the count, perform test counts, identify discontinued items, and compare recorded costs with subsequent selling prices and management’s write-down assessment.

The team should also test manual journals posted near year-end, review unusual users and access rights in the online system, and reconcile platform sales reports to the general ledger.

Outcome

Suppose testing identifies $12,000 of revenue recorded in January but included in December, and $16,000 of obsolete inventory carried above recoverable value. Individually, the inventory error is below the $21,000 overall materiality amount, but the two errors total $28,000 and exceed overall materiality. The auditor should request adjustment and consider whether additional misstatements may exist. If management refuses to correct material misstatements, the auditor must evaluate the effect on the audit opinion.

Learning points

The case demonstrates that materiality is assessed in aggregate, risk assessment must be linked to assertions, and unusual growth does not prove fraud but does justify targeted procedures. It also shows why technology-related controls and year-end cut-off testing are important in an online sales environment.

8. Limitations, Ethics, and Contemporary Practice

Audit planning involves judgment and therefore has limitations. Risk assessments may be affected by incomplete information, management bias, changing conditions, or unreliable internal records. A strong control environment reduces risk but does not guarantee accurate reporting. Similarly, analytical procedures identify unusual relationships but do not by themselves establish that a balance is correct.

Auditors must maintain professional skepticism. This means having an alert mind and critically assessing evidence, particularly when evidence is contradictory or obtained from an interested party. Independence and confidentiality are essential. An auditor should not reduce testing merely because management is trusted, nor should materiality be used to conceal fraud, illegal acts, or sensitive disclosures.

Technology increasingly affects audit planning. Data analytics can examine complete populations for unusual journal entries, duplicate payments, unusual transaction times, or unexpected trends. Artificial intelligence may help classify documents or identify anomalies, but its output requires validation. The auditor remains responsible for evaluating relevance, reliability, bias, completeness, and the sufficiency of evidence. A system-generated exception is not automatically a misstatement, and an absence of an exception is not proof that no misstatement exists.

Best practices include documenting the reasoning behind risk and materiality judgments, updating the plan when conditions change, linking every major risk to a clear response, supervising junior staff, reviewing contradictory evidence, and recording conclusions rather than merely listing procedures.

Chapter Summary

Audit risk is the possibility that an auditor expresses an inappropriate opinion on materially misstated financial statements. The traditional model, AR = IR × CR × DR, explains the relationship among audit risk, inherent risk, control risk, and detection risk. Inherent risk arises from the nature of an item, control risk arises from failures in internal control, and detection risk arises from ineffective audit procedures.

Auditors identify risks at the financial-statement and assertion levels. Assertions such as occurrence, completeness, existence, valuation, cut-off, and rights and obligations provide a framework for designing audit procedures. Materiality concerns whether an omission, misstatement, or obscured information could influence users’ decisions. Overall materiality guides the audit as a whole, while performance materiality is set lower to reduce the risk that aggregate errors exceed overall materiality.

A sound audit plan connects the entity’s risks to objectives, procedures, staffing, timing, and documentation. An audit program then specifies the practical procedures to be performed. Planning is continuous: new evidence may require revised risk assessments and additional work. Professional skepticism, independence, ethical judgment, and careful documentation remain essential, even when technology and data analytics are used.

Key Terms

Audit risk: Risk that the auditor expresses an inappropriate opinion on materially misstated financial statements.

Inherent risk: Susceptibility of an assertion to misstatement before related controls are considered.

Control risk: Risk that internal controls fail to prevent, detect, or correct a material misstatement.

Detection risk: Risk that audit procedures fail to detect an existing material misstatement.

Risk of material misstatement: Risk that financial statements are materially misstated before the audit is performed.

Materiality: Importance of information to users’ economic decisions.

Overall materiality: Materiality level established for the financial statements as a whole.

Performance materiality: Amount set below overall materiality to reduce aggregation risk.

Assertion: Management’s representation embodied in the financial statements.

Occurrence: Assertion that a recorded transaction or event took place.

Completeness: Assertion that all items that should be recorded are recorded.

Existence: Assertion that an asset, liability, or equity interest exists.

Valuation: Assertion that an item is recorded at an appropriate amount.

Cut-off: Assertion that transactions are recorded in the correct reporting period.

Audit strategy: Overall direction, scope, timing, and resources of an audit.

Audit plan: Detailed approach for implementing the audit strategy.

Audit program: List of specific audit procedures to be performed.

Professional skepticism: An alert and questioning evaluation of audit evidence.

Substantive procedure: Procedure designed to detect material misstatements at the assertion level.

Test of controls: Procedure designed to evaluate whether controls operated effectively.

Review Questions

Short Answer Questions

1. What is audit risk, and why can it not normally be reduced to zero?
2. Distinguish inherent risk from control risk.
3. What is the purpose of performance materiality?
4. State four management assertions.
5. Distinguish an audit plan from an audit program.

Long Answer Questions

1. Explain the audit risk model and discuss how a high control-risk assessment affects planned audit procedures.
2. Explain how an auditor identifies and evaluates financial-statement-level and assertion-level risks.
3. Discuss the factors that influence the selection of a materiality benchmark.
4. Explain how audit objectives, assertions, risks, and procedures are connected.
5. Describe the main contents of a simple audit plan and explain why planning must be updated during the engagement.

Analytical / Application Questions

1. A company reports profit before tax of $600,000. Using an illustrative 5% benchmark and 75% performance-materiality factor, calculate overall materiality and performance materiality. Explain why the percentages are not universal rules.
2. An entity has rapid revenue growth, a large increase in receivables, and weak controls over credit approvals. Identify two likely assertions at risk and propose one audit procedure for each.
3. An auditor assesses acceptable audit risk at 4%, inherent risk at 70%, and control risk at 60%. Calculate planned detection risk using the audit risk model and explain what the result implies for audit evidence.

Multiple Choice Questions with Answers

Question 1

Which component of the audit risk model is most directly influenced by the auditor’s procedures?

A. Inherent risk

B. Control risk

C. Detection risk

D. Business risk

Correct Answer: C. Detection risk

Question 2

If acceptable audit risk is 5%, inherent risk is 80%, and control risk is 50%, planned detection risk is:

A. 6.25%

B. 12.5%

C. 20%

D. 40%

Correct Answer: B. 12.5%

Question 3

Which assertion asks whether all transactions that should have been recorded are included?

A. Occurrence

B. Completeness

C. Existence

D. Valuation

Correct Answer: B. Completeness

Question 4

A transaction recorded in December actually occurred in January. Which assertion is most directly affected?

A. Cut-off

B. Rights and obligations

C. Classification

D. Existence

Correct Answer: A. Cut-off

Question 5

Profit before tax is $400,000. Using an illustrative 5% benchmark, preliminary overall materiality is:

A. $8,000

B. $20,000

C. $40,000

D. $80,000

Correct Answer: B. $20,000

Question 6

Why is performance materiality set below overall materiality?

A. To eliminate all audit risk

B. To reduce the risk that aggregate misstatements exceed overall materiality

C. To determine the statutory tax rate

D. To replace substantive testing

Correct Answer: B. To reduce the risk that aggregate misstatements exceed overall materiality

Question 7

Which procedure best addresses the valuation of potentially uncollectible receivables?

A. Inspect subsequent cash receipts

B. Review the entity’s logo

C. Count warehouse shelves

D. Read the board’s attendance register

Correct Answer: A. Inspect subsequent cash receipts

Question 8

Which document normally lists the specific audit procedures to be performed?

A. Audit program

B. Sales invoice

C. Bank reconciliation

D. General ledger

Correct Answer: A. Audit program

Question 9

An amount below overall materiality may still be material because of its:

A. Font size only

B. Qualitative nature

C. Transaction number only

D. Physical location

Correct Answer: B. Qualitative nature

Question 10

If inherent risk and control risk are assessed as high, the auditor will generally need to:

A. Accept higher detection risk

B. Perform less testing

C. Obtain more persuasive audit evidence

D. Ignore internal controls

Correct Answer: C. Obtain more persuasive audit evidence