Audit Planning, Risk, Materiality, and Evidence

Introduction

Stock auditing is the systematic examination of inventory records, physical quantities, valuation, custody arrangements, and related processes. In supply chains, inventory is especially exposed to error and shrinkage because it moves through purchasing, receiving, storage, production, transfer, picking, dispatch, returns, and disposal. A credible audit therefore does more than compare a book balance with a physical count. It evaluates whether the processes that create inventory information are designed and operated to prevent or detect loss, misstatement, and fraud.

A risk-based audit directs attention toward matters most likely to affect decisions made by management, owners, lenders, regulators, and other users. It combines professional judgment, materiality, process understanding, control evaluation, substantive testing, and reliable documentation. The auditor’s central question is not simply “Does the quantity agree?” but “What could cause the reported inventory position to be wrong, how likely is it, how significant would it be, and what evidence can support a conclusion?”

This chapter develops a planning framework for stock audits and shrinkage-control reviews. It treats inventory as both a financial-reporting balance and an operational resource. The approach is relevant to warehouses, retailers, manufacturers, distributors, e-commerce fulfilment networks, and third-party logistics providers.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the relationship among audit risk, inherent risk, control risk, and detection risk.
2. Set and apply materiality in an inventory audit.
3. Identify fraud indicators and map inventory processes and risks.
4. Design control tests and substantive procedures that respond to assessed risks.
5. Evaluate the reliability, relevance, sufficiency, and appropriateness of audit evidence.
6. Document an audit plan, findings, judgments, and conclusions professionally.
7. Critically assess the limitations of technology, sampling, and management representations.

1. The Risk-Based Audit Perspective

Traditional stock checking often focused on recounting selected items. A risk-based audit begins earlier: with the objectives of the process and the ways those objectives can fail. For inventory, relevant objectives commonly include:

• Existence: recorded inventory is physically present.
• Completeness: inventory owned or controlled by the entity is recorded.
• Rights and obligations: the entity owns the inventory or has appropriate rights to use it.
• Valuation: inventory is recorded at an appropriate amount, including provisions for obsolescence, damage, and net realisable value.
• Cut-off: receipts, transfers, sales, and returns are recorded in the correct period.
• Accuracy and classification: quantities, costs, locations, units of measure, and categories are correctly recorded.
• Safeguarding: access, movement, and disposal are controlled.
• Presentation and disclosure: inventory information is properly reported.

These objectives are related but not interchangeable. A warehouse may have accurate counts for items it holds while omitting goods held on consignment. Conversely, all owned inventory may be recorded, but at an overstated value because obsolete goods were not written down.

Audit risk model

Audit risk is the risk that the auditor expresses an inappropriate conclusion when the subject matter contains a material misstatement. A common planning model is:

where:

• AR = audit risk;
• IR = inherent risk, the susceptibility of an assertion to misstatement before considering controls;
• CR = control risk, the risk that a misstatement will not be prevented, detected, or corrected by internal control; and
• DR = detection risk, the risk that audit procedures will not detect a material misstatement.

The model is a conceptual planning relationship, not a precise mechanical calculator. The components are difficult to measure objectively, and the product should not be treated as proof that audit risk has been reduced to an exact percentage. Its practical implication is important: when inherent and control risks are high, the auditor must ordinarily reduce detection risk through stronger, more extensive, or better-timed procedures.

For example, high inherent risk may arise where inventory is high-value, portable, subject to rapid obsolescence, or priced using complex standard costs. High control risk may arise where warehouse access is unrestricted, cycle counts are not independently reviewed, and system adjustments are poorly authorized.

2. Materiality and Performance Materiality

Materiality concerns the size or nature of a misstatement that could influence the decisions of a reasonable user. It is not merely a percentage of inventory. A small amount may be material if it indicates fraud, breaches a covenant, causes a regulatory violation, or changes a reported profit trend.

At the financial-statement level, the auditor establishes overall materiality using professional judgment and an appropriate benchmark, such as profit before tax, revenue, total assets, or equity. The benchmark depends on the entity’s circumstances. A profit-oriented retailer may use normalized profit before tax; a loss-making start-up may require greater attention to revenue, assets, or liquidity.

Performance materiality is set below overall materiality to reduce the probability that the aggregate of uncorrected and undetected misstatements exceeds overall materiality. It is applied in designing procedures and evaluating identified errors. A further threshold may be established for clearly trivial misstatements, below which items need not ordinarily be accumulated unless qualitative factors make them significant.

Materiality should be allocated thoughtfully. High-risk locations, categories, or assertions may receive lower tolerable misstatement levels or more extensive testing. Allocation is not a simple division of overall materiality by the number of warehouses because inventory balances and risks differ substantially.

Quantitative measures used in shrinkage analysis

Operational teams often calculate shrinkage as:

and, where positive shrinkage represents an unexplained shortage:

The denominator must be clearly defined. It may be opening inventory, average inventory, throughput, or book quantity at the count date. These measures are useful for trend analysis but do not by themselves establish an audit misstatement. A difference may arise from timing, unit-of-measure errors, unposted receipts, damaged goods, or genuine theft. The rate is meaningful only when the population, period, valuation basis, and treatment of investigated differences are consistent.

3. Inherent Risk in Inventory Processes

Inherent risk is influenced by the nature of an activity before considering controls. Important drivers include:

Fraud risk deserves explicit consideration. Inventory can be overstated to improve profit, understated to conceal theft, or manipulated through false receipts, fictitious transfers, duplicate production, altered count sheets, and inappropriate capitalization of costs. Fraud indicators do not prove fraud; they signal the need for expanded procedures and professional skepticism.

Common indicators include unexplained gross-margin changes, repeated post-count adjustments, inventory held in inaccessible areas, unusually high quantities of damaged goods, missing sequential documents, shared user accounts, overrides by senior employees, pressure to meet targets, and differences concentrated around period-end.

4. Process Mapping and Risk-Control Matrices

A process map translates physical and information flows into an auditable structure. A basic inventory cycle may be represented as:

Figure: An inventory process map linking physical movements with reconciliation activities.

For each stage, the auditor identifies the risk, the relevant assertion, the control, the control owner, the evidence produced, and the planned test. A risk-control matrix might include the following:

A process map should include interfaces between departments and systems. Many failures occur at handoffs: purchasing to receiving, receiving to accounts payable, warehouse management systems to enterprise resource planning systems, or physical dispatch to invoicing.

5. Evaluating Internal Controls

Controls may be preventive or detective, manual or automated, entity-level or transaction-level. A control is relevant only if it addresses a defined risk and operates with sufficient precision. “A manager reviews inventory” is too vague for audit planning. The auditor should ask what is reviewed, against which criteria, how often, what exceptions are identified, and what evidence demonstrates resolution.

Tests of controls

A test of control assesses whether a control was suitably designed and operated effectively during the relevant period. Typical procedures include inspection, observation, inquiry, reperformance, and, for automated controls, examination of system configuration and access rights.

Inquiry alone is generally weak evidence because employees may describe expected practice rather than actual practice. Observation provides evidence at one point in time and may not prove consistent operation. Inspection of dated approval records, exception reports, and system logs is often stronger, but records may themselves be incomplete or manipulated. Reperformance is powerful where the auditor independently repeats the control, such as recalculating an ageing provision or matching receiving records to purchase orders.

Sampling should reflect the control’s frequency, expected deviation rate, population characteristics, and consequences of failure. If a control is central to the audit and deviations are found, the auditor must assess whether reliance remains justified and whether substantive procedures need to be expanded.

Automated controls can be reliable when system logic, interfaces, master data, and access management are properly controlled. However, reliance on an automated three-way match is weakened if users can override exceptions without review or if supplier, item, and unit-of-measure master data are poorly governed.

6. Substantive Procedures for Stock Audits

Substantive procedures are designed to detect material misstatements directly. They include tests of details and substantive analytical procedures.

Physical inventory observation

Attendance at a physical count enables the auditor to evaluate count instructions, observe counting discipline, perform independent test counts, identify damaged or obsolete items, note movements during the count, and obtain final count records. It does not mean the auditor counts every item or assumes responsibility for management’s count.

Planning should address count date, locations, third-party inventory, suspended movements, count teams, identification of slow-moving goods, tags or electronic records, and reconciliation from count date to reporting date. Test counts should be selected in both directions: from floor to records, which supports completeness, and from records to floor, which supports existence.

Reconciliation and roll-forward testing

Where the count date differs from the reporting date, the auditor reconciles intervening movements:

The signs depend on the entity’s convention and must be applied consistently. “Other adjustments” may include production, transfers, returns, write-offs, and currency or cost changes. The auditor should test significant movements rather than accept an unsupported roll-forward.

Cut-off testing

Select receiving and dispatch documents immediately before and after period-end. Trace them to inventory records, goods received notes, shipping records, invoices, and accounting entries. Particular attention is required when goods are in transit, held by carriers, subject to transfer terms, or delivered on consignment.

Valuation and obsolescence

Depending on the applicable reporting framework, inventory is generally measured at cost subject to a lower-of-cost-and-net-realisable-value principle, or another permitted basis. Cost may include purchase costs, conversion costs, and other costs incurred to bring inventory to its present location and condition, while abnormal waste, unnecessary storage, and unrelated administrative costs are generally excluded under common frameworks.

Net realisable value is an estimate of expected selling price in the ordinary course of business less costs of completion and costs necessary to make the sale. Audit procedures may include testing supplier invoices, production records, standard-cost calculations, price master data, subsequent sales, ageing reports, markdowns, damage reports, and management’s provision model.

Analytical procedures and data analytics

Useful analyses include shrinkage by location, product, shift, employee role, transaction type, and period; gross-margin trends; negative inventory balances; unusual adjustments; duplicate receipts; inventory movements at unusual times; and dormant or rapidly changing user accounts. Analytics identify outliers but do not automatically explain them. An anomalous result must be investigated with evidence.

7. Audit Evidence: Reliability and Sufficiency

Audit evidence is information used to support the auditor’s conclusions. Evidence must be sufficient in quantity and appropriate in quality. Appropriateness includes relevance and reliability.

Evidence is generally more persuasive when it is obtained directly by the auditor, comes from an independent external source, is documented contemporaneously, is consistent with other evidence, and is generated by a system with effective controls. External confirmations may support rights or quantities held by third parties, but confirmation responses can be incomplete or unreliable. Internally generated reports may be useful, but the auditor should test their accuracy and completeness before relying on them.

Evidence is evaluated cumulatively. A single signed checklist rarely proves that a control operated effectively. Conversely, a physical observation, system report, independent recount, subsequent sale, and supplier confirmation may together support a conclusion even though no individual item is conclusive.

Management representations are necessary in some audits but are not a substitute for other evidence where independent evidence should be available. The auditor should remain alert to contradictory evidence, missing records, restrictions on access, and explanations that change after challenge.

8. Documentation and the Audit Trail

Documentation should enable an experienced auditor, having no prior connection with the engagement, to understand the work performed, evidence obtained, significant judgments, results, and basis for the conclusion. A well-designed working-paper file commonly contains:

• engagement scope, objectives, locations, and reporting framework;
• materiality and risk assessment, including changes during the audit;
• process maps and risk-control matrices;
• count instructions and attendance records;
• sampling rationale and population definitions;
• test-count sheets and reconciliation schedules;
• control-test results and deviations;
• substantive test results and proposed adjustments;
• photographs or system extracts where permitted and properly controlled;
• evidence of review and resolution of exceptions; and
• final conclusions and communication of deficiencies.

Documentation should distinguish fact, explanation, judgment, and conclusion. It should record who performed and reviewed a procedure, when it was performed, what population was used, and how exceptions were resolved. Poor documentation creates audit risk even where the underlying work was adequate.

9. Illustrative Case: Northstar Distribution Centre

Background. Northstar Distribution is an illustrative national wholesaler with three warehouses. Its year-end inventory is CU 48 million, of which CU 19 million is concentrated in a high-value electronics category. Inventory is managed through a warehouse system interfaced with the general ledger. Management reports a 0.8% annual shrinkage rate, but the rate excludes unresolved count differences.

Problem. The auditor identifies a sharp increase in gross margin during the final quarter, frequent manual adjustments at the largest warehouse, and a material quantity of goods labelled “awaiting inspection.” Two supervisors share a system account. Management asserts that all adjustments are reviewed.

Analysis. Inherent risk is high because goods are portable, valuable, and rapidly obsolete. Control risk is high because shared accounts impair accountability, the inspection status can delay recognition of defects, and adjustment review is not supported by consistent evidence. The most relevant assertions are existence, completeness, valuation, cut-off, and rights.

Approach. The audit team:

1. maps receiving, inspection, storage, transfer, and dispatch processes;
2. tests access rights and obtains a population of all manual adjustments;
3. attends the year-end count at all three locations, increasing coverage at the largest site;
4. performs floor-to-sheet and sheet-to-floor test counts for high-value items;
5. tests receipts and dispatches immediately before and after year-end;
6. examines subsequent sales prices and ageing for electronics;
7. confirms inventory held by a repair contractor; and
8. reconciles count results to the ledger, investigating all significant differences.

The team finds that CU 310,000 of goods marked “awaiting inspection” are damaged and should be provided for. It also identifies CU 95,000 of receipts recorded after year-end but included in the count listing, and CU 60,000 of unsupported manual adjustments. Some differences are explained by timing, but the unsupported adjustments remain unresolved. The shared account is disabled and adjustment approval is redesigned to require individual credentials and documented investigation.

Outcome. Management records the valuation provision and corrects the cut-off error. The auditor reports a control deficiency concerning user access and adjustment governance, and increases substantive testing in the affected category. The reported shrinkage rate is recalculated to include unresolved differences and is presented separately from confirmed theft.

Learning points. The case illustrates that physical counting alone would not have detected all problems. A risk-based plan connected fraud indicators, process mapping, control testing, cut-off, valuation, evidence reliability, and governance remediation.

10. Governance, Ethics, Technology, and Limitations

Inventory audits have ethical dimensions. Auditors must preserve independence, confidentiality, professional skepticism, and integrity. Warehouse employees should not be accused of theft solely because an exception appears in data. Investigations must respect due process, privacy requirements, employment rules, and evidence-preservation principles. Access to video, biometric, location, or employee-performance data should be proportionate, authorized, and secured.

Technology can strengthen control through barcode scanning, radio-frequency identification, computer vision, perpetual inventory systems, segregation-of-duties analytics, and anomaly detection. Artificial intelligence may prioritize transactions or locations for review, but it does not eliminate the need to validate data quality, model assumptions, false positives, bias, explainability, cybersecurity, and human accountability. A predictive model trained on incomplete historical losses may reproduce blind spots rather than detect them.

Important limitations remain. Sampling creates sampling risk; non-sampling risk arises from poor judgment, misunderstanding, or failure to recognize an exception. Physical presence may not reveal concealed or inaccessible inventory. Confirmations may be ignored or manipulated. A low shrinkage rate can coexist with systematic overstatement if damaged or obsolete goods are not identified. Strong controls reduce, but do not eliminate, the possibility of collusion or management override.

Best practice is therefore to combine independent observation, process understanding, data analysis, control evaluation, substantive testing, and transparent communication. The audit plan should be revised when evidence changes the risk assessment. An audit is not a one-time count; it is an evidence-based evaluation of how inventory information is created, protected, measured, and reported.

Chapter Summary

A professional stock audit begins with objectives and risks rather than with a predetermined count sample. Inventory assertions include existence, completeness, rights, valuation, cut-off, accuracy, safeguarding, and presentation. The audit-risk model links inherent, control, and detection risk and helps determine the nature, timing, and extent of procedures.

Materiality guides the evaluation of misstatements, but qualitative factors such as fraud, covenant effects, and regulatory breaches can make small amounts significant. Process maps and risk-control matrices connect physical flows, information systems, assertions, controls, and audit responses. Control testing evaluates design and operation; substantive procedures directly investigate quantities, movements, costs, ageing, and cut-off.

Reliable evidence is relevant, sufficient, and appropriately persuasive. Documentation must show the population, procedure, result, judgment, reviewer, and conclusion. Technology and analytics can improve coverage, but their outputs require validation and human judgment. Finally, ethical conduct, independence, privacy, and professional skepticism are essential to credible shrinkage control and audit governance.

Key Terms

Audit risk: Risk that the auditor expresses an inappropriate conclusion on materially misstated information.

Inherent risk: Susceptibility to misstatement before considering controls.

Control risk: Risk that controls fail to prevent, detect, or correct a misstatement.

Detection risk: Risk that audit procedures fail to detect a material misstatement.

Materiality: Magnitude or nature of a misstatement capable of influencing users’ decisions.

Performance materiality: Amount set below overall materiality to reduce aggregate misstatement risk.

Shrinkage: Difference between recorded inventory and physical inventory, after considering valid explanations.

Existence: Assertion that recorded inventory is physically present.

Completeness: Assertion that inventory that should be recorded is included.

Rights and obligations: Assertion that the entity owns or controls the reported inventory.

Cut-off: Recording transactions in the correct accounting period.

Net realisable value: Expected selling price less completion and selling costs.

Control test: Procedure evaluating whether a control is suitably designed and operated effectively.

Substantive procedure: Procedure designed to detect material misstatement directly.

Test count: Auditor’s independent count used to compare physical quantities with records.

Process map: Visual or structured representation of activities, information, and control points.

Risk-control matrix: Schedule linking risks, assertions, controls, tests, and responses.

Audit evidence: Information supporting audit conclusions.

Professional skepticism: An alert, questioning attitude toward potentially contradictory evidence.

Management override: Circumvention of established controls by senior personnel.

Review Questions

Short Answer Questions

1. Distinguish inherent risk from control risk in an inventory audit.
2. Why is materiality not determined solely by a percentage of inventory value?
3. What is the purpose of performing both floor-to-sheet and sheet-to-floor test counts?
4. Identify two limitations of management representations as audit evidence.
5. Why should shared warehouse-system accounts be treated as a control concern?

Long Answer Questions

1. Explain how the audit-risk model influences the design of an inventory audit plan.
2. Describe how a process map and risk-control matrix can be developed for the receiving process.
3. Compare tests of controls with substantive procedures, using inventory examples.
4. Explain the evidence requirements for auditing inventory valuation and obsolescence.
5. Discuss the ethical, governance, and privacy issues involved in using AI and employee data for shrinkage detection.

Analytical / Application Questions

1. A company reports book inventory of 80,000 units and physical inventory of 78,800 units. Calculate the shrinkage rate using book quantity as the denominator. What additional evidence is needed before concluding that 1,200 units were stolen?
2. A warehouse has high-value portable goods, unrestricted access, frequent manual adjustments, and a year-end count performed by inexperienced staff. Assess the inherent and control risks and propose five audit responses.
3. A count is performed ten days before year-end. Explain how the auditor should reconcile the count to the reporting date and identify the principal cut-off risks.

Multiple Choice Questions with Answers

Question 1

Which risk represents the possibility that inventory is susceptible to misstatement before considering internal controls?

A. Audit risk

B. Inherent risk

C. Control risk

D. Detection risk

Correct Answer: B. Inherent risk

Question 2

Which procedure primarily tests the existence assertion?

A. Tracing receiving reports to the inventory ledger

B. Selecting ledger items and locating them physically

C. Reviewing supplier contracts for consignment terms

D. Comparing inventory costs with subsequent selling prices

Correct Answer: B. Selecting ledger items and locating them physically

Question 3

Book inventory is 50,000 units and physical inventory is 49,000 units. Using book quantity as the denominator, the shrinkage rate is:

A. 0.5%

B. 1.0%

C. 2.0%

D. 49.0%

Correct Answer: B. 1.0%

Question 4

When inherent risk and control risk are assessed as high, the auditor will generally seek to:

A. Increase acceptable detection risk

B. Reduce substantive testing

C. Reduce detection risk through stronger procedures

D. Ignore qualitative materiality factors

Correct Answer: C. Reduce detection risk through stronger procedures

Question 5

Which is the strongest example of a substantive valuation procedure?

A. Asking the warehouse manager whether goods are obsolete

B. Inspecting whether count teams signed attendance sheets

C. Comparing selected inventory costs with subsequent sales prices and selling costs

D. Confirming that a supervisor attended a training session

Correct Answer: C. Comparing selected inventory costs with subsequent sales prices and selling costs

Question 6

What is the principal purpose of performance materiality?

A. To replace overall materiality

B. To reduce the likelihood that aggregate misstatements exceed overall materiality

C. To determine the physical count date

D. To measure employee productivity

Correct Answer: B. To reduce the likelihood that aggregate misstatements exceed overall materiality

Question 7

Which evidence characteristic concerns whether evidence supports the particular assertion being tested?

A. Relevance

B. Volume

C. Convenience

D. Seniority

Correct Answer: A. Relevance

Question 8

A floor-to-sheet test count primarily helps identify:

A. Unrecorded physical inventory

B. Overstated supplier invoices

C. Unauthorized user access

D. Incorrect depreciation expense

Correct Answer: A. Unrecorded physical inventory

Question 9

Which condition is a fraud indicator requiring further investigation rather than automatic proof of fraud?

A. A documented independent recount

B. Repeated unexplained manual inventory adjustments

C. A reconciled goods-received report

D. A properly approved purchase order

Correct Answer: B. Repeated unexplained manual inventory adjustments

Question 10

If a count occurs before year-end, the auditor should primarily:

A. Ignore movements after the count

B. Replace the count with management representation

C. Reconcile intervening receipts, issues, transfers, and adjustments to year-end

D. Assume all movements are cut off correctly

Correct Answer: C. Reconcile intervening receipts, issues, transfers, and adjustments to year-end