UNIT 7: AUDIT PLANNING
Key unit competence: To be able to execute audit planning and risk
assessment
Introductory activity
Look the above picture, then answer the following questions:
1. What do you understand by audit planning2. How do we call those activities around audit planning?
7.1. Audit planning
Learning activity 7.1
Look at the above image, then answer the following questions:
1. Why the audit work must be planned?
2. What do you mean by audit strategy?
3. State the general areas the auditor must consider when setting auditstrategy
7.1.1. Meaning and objective of audit planning
a) Meaning of audit planning
Audit planning means developing a general strategy and a detailed approach for
the expected nature, timing and extent of the audit. The auditor plans to performthe audit work in an efficient and timely manner.
b) The importance of audit planning
An effective and efficient audit relies on proper planning procedures. The
planning process is covered in general terms by ISA 300 states that the auditor
shall plan the audit so that the engagement is performed in an effective manner.Audits are planned to:
– Help the auditor devote appropriate attention to important areas of the
audit;
– Help the auditor identify and resolve potential problems on a timely
basis;
– Help the auditor properly organise and manage the audit so it is
performed in an effective manner;
– Assist in the selection of appropriate team members and assignment
of work to them;
– Facilitate the direction, supervision and review of work;
– Assist in coordination of work done by auditors of components and
experts.Audit procedures should be discussed with the client’s management, staff and/
or audit committee in order to co-ordinate audit work, including that of internal
audit. However, all audit procedures remain the responsibility of the external
auditors.
A structured approach to planning:
Step 1: updating knowledge of the client and assessing risks
Step 2: Ensuring that ethical requirements are met, including independence.
Step 3:establishing the overall audit strategy that sets the scope, timing anddirection of the audit and guides the development of the audit plan:
– Idendify the characteristics of the engagement that define its scope;
– Ascertain the reporting objectives to plan the timing of the audit andnature of communications required;
– Consider significant factors in directing the team’s efforts;
– Consider results of preliminary engagement activities;
– Ascertain nature, timing and extent of resources necessary to performthe engagement.
Step 4: Preparing the detailed audit approach
Step 5: Making administrative decision such as staffing and budgets.
7.1.2. Audit planning strategies
a) planning strategies
Audit strategy sets the scope, timing and the direction of the audit, and guides
the development of the more detailed audit plan.The audit strategy is the keyplanning document. It considers general areas of planning such as:
• The timetable for reporting, key dates and statutory obligations;
• Reporting framework and scope of the audit;
• Initial materiality levels;
• Preliminary risk assessment.
• Audit team members and skills required;
• Arrangements for directing, supervising and reviewing the work of auditteam members;
• Consider the need for the service of experts;
• Location of client premises and travel/accommodation requirements.
Any changes made during the audit engagement to the overall audit strategy
or audit plan, and the reasons for such changes, shall be included in the auditdocumentation.
Audit needs to be planned to ensure that:
• Appropriate attention is devoted to the important areas of the audit;
• Potential problems are identified (and resolved) on a timely basis;
• Work is completed effectively and efficiently;
• Appropriate staff are engaged on the audit team and, the proper tasksare assigned to the members of the audit team;
• Assisting with the direction and supervision of the audit team andreview their work;
• Assisting with the coordination of work done by experts.
The establishment of the audit strategy involves:
In many audit firms, the audit engagement partner would create the audit
strategy, with the audit managers then being responsible for using the strategy
and then produce the detailed audit plan. This division of roles does, however,
vary from firm to firm and it is not unusual for an audit manager to contribute tothe audit strategy document.
b) Changes to the overall audit strategy and audit plan
The auditor shall update and change the overall audit strategy and the audit planwhere necessary during the course of the audit work.
An accurate record of changes to the audit strategy must be maintained in order
to explain the general approach finally adopted for the audit. Any changes to the
audit strategy or the audit plan and the reasons for them must be included in theaudit documentation.
c) Audit programmes
The audit manager will typically use the audit plan as a basis for drawing up
checklists or similar documents for audit staff to use in gathering audit evidence
during the fieldwork stage of the audit. Audit programmes are schedules of
audit procedures to be carried out by audit staff to obtain sufficient appropriateaudit evidence.
Each account area (eg non-current assets, inventory, receivables etc) will have
its own audit programme and each member of the team is likely to be assigned
responsibility for carrying out the audit procedures for one or more account
areas. Audit programmes may be designed with reference to specific audit
objectives; this ensures that audit work is focused and that sufficient appropriateaudit evidence is gathered and documented.
d) Audit matters
Audits should be carried out by staff with appropriate skills and experience.
• Audit team
ISA 220 for Quality control for an audit of financial statements considers the
issue of assignment of engagement teams. The audit engagement partner
(sometimes called the reporting partner) must take responsibility for the quality
of the audit to be carried out (ISA 220: para. 8). He/she should assign staff withnecessary competencies to the audit team (ISA 220: para. 14).
Some audits are wholly carried out by a sole practitioner (an accountant who
practises on his/her own) or a partner.
More commonly, however, the engagement partner will take overall responsibility
for the conduct of the audit and will sign the auditor’s report. The engagement
partner will delegate aspects of the audit work such as the detailed testing tothe staff of the firm. The usual hierarchy of staff on an audit assignment is:
The engagement partner is responsible for ensuring that:
• An appropriate level of professional scepticism is applied by audit staffin the conduct of the audit; and
• There is proper communication both within the audit team and with theaudited entity.
Achieving these two objectives is likely to involve holding a planning meeting with
the audit staff on the assignment to discuss the risks of material misstatement
that could arise in the financial statements and making them aware of historicalissues on the audit.
Ensuring communication between client staff and audit staff will be more difficult
as the audit engagement partner is unlikely to visit the client site during the audit.
However, given that the audit partner has a responsibility here, he/she must
take appropriate steps. What these should be will depend on the individual
circumstances of the audit. The audit engagement partner should consider thefollowing:
– Keeping in regular contact with both audit and client staff during theaudit to assess the level of communication between them;
– Attending the site during the audit to facilitate better communication
if he/she feels that it is necessary.Fostering lines of communication
between client staff and audit staff during the period between auditsto ensure a good working relationship is built up between them;
– The availability of audit staff throughout the engagement (taking intoaccount conflicting audit deadlines, holidays and study leave).
• Dealing with client staff
An important skill that all staff chosen for the audit assignment should have
is the ability to deal with the client staff with whom they come into contact.
Discussions with staff operating the system should be conducted in a manner
which promotes professional relationships between auditing and operationalclient staff.
Relationships with the client will be enhanced if auditors aim to provide a high
quality service that caters for the needs of the client. However, more specific
people skills will also be needed. Negotiation skills and interviewing skills areparticularly important.
Auditors should also be trying to understand what managers and staff want
from the audit and how hostility to the time they have to spend dealing with
auditors can be overcome. This does not mean agreeing with management and
staff on every issue, but it does mean enabling the auditors to understand whydifficulties have arisen and how those difficulties can be overcome.
7.1.3. Limitations of audit planning
Even though the audit plan has a number of advantages, it is not free fromlimitations. Some of the major disadvantages of audit plan are as follows:
• Rigitity
An audit plan follows a standard approach and set patterns. This may stifle
flexibility and initiative, therefore dampening professional judgement of the
parties involved. Rigidity also makes the process too mechanistic undermining
the audit staffs’liabilities, creativity and talents. This will consequently leave themwith less freedom in performing their task and also technically challenged.
• Overlooking audit staffs’capabilities
A plan will make the audit process automated and will loose the sense of
responsibility for the audit staff. It can potentially decrease initiative and
inventiveness, with less application of staff talents and abilities. They therefore
do not reinforce the plan with any improvements, which will lower it future
effectiveness. The automation also leaves the staff performing their task withnormality, which can cause boredom.
The strategies and pocedures adopted from an audit may not be in accordance
with a client’s standards. An auditor will likely need to prepare a new procedural
plan that meets the need of the client: in some cases, this backtracking may
cause the client to loose faith and /or trust in the auditor. Staff may also feel
manipulated since they will have to participate in the preparation of the newplan, which can very significantly from the audit standards..
• Constant update
An audit plan needs to change regularly, usually each year to keep it current with
the changing economic environment and business structures. If this change is
not done, the plan may turn out to be too rigid in nature and its application in an
audit process may be in-effective and out-dated. This updating requires more
time and resource devotion to the plan, which would be better used in anotherproductive activities.
Application activity 7.1
1. Explain the difference between the audit strategy and the audit plan
2. Identify seven key items of information likely to be contained in anaudit strategy document.
7.2. Materiality in Auditing
Learning activity 7.2
Observe the above picture, then answer the following questons:
1. What do you mean by a material misstatement?
2. Explain the difference between the overall materiality and performancemateriality.
7.2.1. Meaning and methods of calculating materiality inauditing
a) Meaning of materiality
Materiality in Auditing is defined as the benchmark used to obtain
reasonableassurance that an audit does not detectany material misstatementthatcan significantlyimpact the usability of financial statements.
The auditor is required to determine the materiality level for the financial
statements as a whole, as well as performance materiality, at the planning stage.
The calculation or estimation of materiality should be based on the auditor’s
experience and judgment. The materiality chosen should be reviewed throughoutthe audit.
Materiality relates to the level of misstatement that affects the decisions of usersof the accounts.
Misstatements are considered to be material if they, individually or in aggregate,could reasonably be expected to influence the economic decisions of users.
Judgments about materiality are made in the light of surrounding circumstances,
and are affected by the size and nature of a misstatement or a combination of
both. Judgments about matters that are material to users of financial statements
are based on a consideration of the common financial information needed usersas a group.
The practical implication of this is that the auditor must be concerned with
identifying ‘material’ errors, omissions and misstatements of transactions,
account balances and disclosures. Both the amount (quantity) and nature
(quality) of misstatements need to be considered (e.g., lack of disclosureregarding ongoing litigation is likely to be considered material).
Materiality provides a threshold or cut-off point rather than being a primaryqualitative characteristic which information must have to be useful.
E.g. If a company has a profit of FRW 100Millions, a misstatement of FRW1Million
is unlikely to be significant. If a company has a profit of FRW 10Millions, a
misstatement of FRW 1Million will have a more significant impact on the readersof the accounts.
During planning, the auditor must establish materiality for the financial statementsas a whole, but must also set performance materiality levels.
The concept of materiality is applied by the auditor both in planning and
performing the audit, and in evaluating the effect of identified misstatements on
the audit and of uncorrected misstatements, if any, on the financial statementsand in forming the opinion in the auditor’s report.
Materiality considerations during audit planning are extremely important. The
assessment of materiality at this stage should be based on the most recent and
reliable financial information and will help to determine an effective and efficientaudit approach. Materiality assessment will help the auditors to decide:
• How many and what items to examine;
• Whether to use sampling techniques;• What level of error is likely to lead to a modified audit opinion.
The resulting combination of audit procedures should help to reduce detectionrisk to an appropriately low level.
b) Determining materiality for the financial statements as a whole
Determining materiality for the financial statements as a whole involves the
exercise of professional judgment. Because many users of financial statements
are primarily interested in the profitability of the company, materiality is oftenthought in terms of a value associated with the level of profit before tax.
For example, if profit before tax was FRW 40,000,000, auditors might consider
that all matters in the financial statements equal to 5% of FRW 40,000,000 (i.e.FRW 2,000,000) will be important to users.
However, auditors should avoid thinking of materiality solely in these terms. For
example, some users might be more concerned with asset values or specific
matters in the financial statements rather than ‘value’ at all. Consequently,
auditors may have a monetary guide to what is important to users, but they
should also use their professional judgment at all times to consider what isimportant to users.
In addition, certain types of errors should be investigated even if they are small inmonetary terms, because, as stated above, they are important for other reasons.
• Recurring errors as these may indicate weaknesses in the accounting
system
• Errors that would mean breaches of statutory requirements
• Critical point errors, for example, those that change a loss into profit
• Conceptual errors, errors that involve breaches in the accountingrequirements
At the planning stage, auditors will set a ‘value level’ for planning materiality
based on draft financial information available to them. However, this should be
reviewed as the audit progresses and as any changes are made to the financialinformation.
Generally, a percentage is applied to a chosen benchmark as a starting point
for determining materiality for the financial statements as a whole. The followingfactors may affect the identification of an appropriate benchmark:
• Elements of the financial statements (e.g. assets, liabilities, equity,
revenue, expenses)
• Whether there are items on which users tend to focus
• Nature of the entity, industry and economic environment
• Entity’s ownership structure and financing
• Relative volatility of the benchmark
• The following benchmarks and percentages may be appropriate in thecalculation of materiality for the financial statements as a whole.
c) Determining performance materiality
Consider what would happen if this materiality for the financial statements as a
whole was applied directly to, for example, different accounts balances (such as
receivables, inventory etc.). It could be that a number of balances (or elements
making up those balances) are untested or dismissed on the grounds they are
immaterial. However, a number of errors or misstatements could exist in thoseuntested balances, and these could aggregate to a material misstatement.
For this reason, the auditor is required to set performance materiality levels,
which are lower than the materiality for the financial statements as a whole and
this means a lower is applied during testing. The risk of misstatements which
could add up to a material misstatement is therefore reduced. As we can see inthe key terms below, performance materiality really has two definitions
Performance materiality is the amount or amounts set by the auditor at less than
materiality for the financial statements as a whole to reduce an appropriately
low level of the probability that the aggregate of uncorrected and undetectedmisstatements exceeds materiality for the financial statements as a whole.
Performance materiality also refers to the amount or amounts set by the auditor
at less than the materiality level or levels for particular classes of transactions,account balances or disclosures.
This indicates the auditor sets a level or levels of materiality lower than overall
materiality for the purposes of performing procedures in general (for example ona low risk area) and this is just to account for aggregation.
However, an even lower level is set for certain balances, transactions or
disclosures where there is an increased risk (for example, the auditor will set
a lower performance materiality level for bank balances if he/she considers
bank balances to be a sensitive area). Lower levels are also set if qualitativeconsiderations (discussed below) necessitate it.
Determining performance materiality is very much dependent on the auditor’s
professional judgment. In summary it is affected by:
• The nature and extent of misstatements identified in prior audits;
• The auditor’s understanding of the entity;• Result of risk assessment procedures.
7.2.2. Difference between materiality in government andin private sector
Materiality in governmental audit is different from materiality in private sectorauditing for several reasons.
Most importantly, due to the format of state and local government financial
statements under GAAP (general accepted accounting principles), the AICPA
(American institute of certified public accountant) audit guide for state and
local governments requires auditors to consider materiality by “opinion unit”
rather than for the financial statements taken as a whole. The guide definesopinion unit as follows:
Government-wide level
• Government activities;
• Business activity( nature of business);• Discretely presented component units in the aggregate.
Fund levels:
• General fund (always a major fund)
• Other major funds determined for government funds or enterprise
funds. Each major fund is an opinion unit. If there are no major funds,
then there will be only two opinion units. The general fund and thenremaining fund information; and
• Remaining fund information, consisting of all other non-major
governmental and enterprise funds, internal service fund type, and
fiduciary fund type. (this will generally always be present, although
the individual components and size will change between governmentalentities.)
This functionally decreases materiality for state and local government financial
statements by an order of magnitude compared to materiality for private
company financial statements. Due to the unique concept of materiality, theauditor’s report expresses an opinion in relation to each opinion unit.
Moreover, the primary users of government financial statements are different:
the citizens and the parliament in the public sector versus investors in the private
sector. It is important to identify the primary users since materiality reflects the
auditors judgment of the needs of users in relation to the information in thefinancial statements.
Finally, in government auditing, the political sensitivity to adverse media exposure
often concerns the nature rather than the size of an amount, such as illegal acts,bribery, corruption and related-party transactions.
Qualitative considerations of materiality are therefore different in private
sector auditing, in which qualitative consideration are focused on the effect on
earnings per share, executive bonuses or other risks that are not applicable togovernments.
Qualitative materiality refers to the nature of a transaction or amount and includes
many financial and non financial items that, independent of the amount, mayinfluence the decisions of users of the financial statements.
While rules of thumb mentioned in the section above are commonly applied
to state and local government financial statements, government auditors may
also use different means to quantify materiality such as total cost or net cost
( expenses less revenues or expenditure less receipts). In a cash accountingenvironment, total expenditures is often used as a benchmark.
7.2.3. Roles of materiality of an error in auditing
The importance of materiality of an error in auditing is that:
• It influnces the auditor’s time budget on specific items;
• It dictates the auditor’s plan;
• It influences the auditor’s plan;
• It determines the amount of audit evidence to be gathered;
• It is required by the professional body ICPAR (Institute of CertifiedPublic Accountants of Rwanda) as an incidental objective.
Application activity 7.2
1. Which measures of a client’s business is an auditor likely to use when
setting a level of materiality:
a) For a client that has a stable asset base and steady revenue over
the last few years but has only made a small pre-tax profit this
year owing to a large one-off expense?
b) For a client where the outside shareholders have expressedconcern over declining profits over the last few years?
2. Profit before tax at Rilla Ltd is FRW10, 000,000.
Which one of the following balances are the auditors unlikely to plan
to test in detail?
a) Receivable FRW 5, 000,000
b) Bank FRW 450,000
c) Dirctor’s bonus of FRW 400,000d) Addition to non-current assets FRW 2,000,000
7.3. The entity and its environment
Learning activity 7.3
Observe the above image then answer the following questions:
1. What does the above image show?
2. What information do you think the auditor wants to know when he/she asks himself/herself the questions in the image?
7.3.1. The entity and its environment
The auditor is required to obtain an understanding of the entity and its environment
in order to be able to assess the risks of material misstatement and direct his/her audit approach accordingly.
ISA 315 states that ‘the auditor shall perform risk assessment procedures
to provide a basis for the identification and assessment of risks of materialmisstatement at the financial statement and assertion levels.
a) Why?
The reasons the auditor is to obtain the understanding of the entity and its
environment are very much bound up with assessing risks and exercising audit
judgment. We shall look at these aspects more in the next two topics of thisUnit.
b) What?
ISA 315 sets out a number of requirements about what the auditors mustconsider in relation to obtaining an understanding of the business.
c) How?
ISA 315 sets out the risk assessment procedures that the auditor must use
to obtain the understanding. The auditor does not have to use all of these for
each area, but the ISA requires that risk assessment procedures should, as aminimum,comprise a combination of these procedures.
• Inquiries of management and others within the entity
• Analytical procedures• Observation and inspection
The audit team and the engagement partner are also required by ISA 315 to
discuss the susceptibility of the financial statements to material misstatement.
Judgment must be exercised in determining which members of the team should
be involved in which parts of the discussion, but all team members should be
involved in the discussion relevant to the parts of the audit they will be involvedin.
Lastly, if it is a recurring audit, the auditors may have obtained a great deal of
knowledge about the entity and the environment in the course of prior year
audits. The auditor is entitled to use this information in the current year audit,
but he/she must determine whether any changes in the year have affected therelevance of information obtained in previous years.
Inquiries of management and others within the entity
The auditors will usually obtain most of the information they require from staff in the
accounts department, but may also need to make enquiries of other personnel,
for example, internal audit, production staff or those charged with governance.
Those charged with governance may give insight into the environment in which
the financial statements are prepared. In-house legal counsel may help with
understanding matters such as outstanding litigation, or compliance with laws
and regulations. Sales and marketing personnel may give information aboutmarketing strategies and sales trends.
Analytical procedures
Analytical procedures are a useful tool in risk assessment. ISA 315 and ISA 520
Analytical procedures provide guidance in this area. ISA 315 requires auditorsto use analytical procedures during the risk assessment phase of the audit.
Analytical procedures consist of the evaluations of financial information made by
a study of plausible relationships among both financial and non-financial data.
Analytical procedures also encompass the investigation of identified fluctuations
and relationships that are inconsistent with other relevant information, or deviatesignificantly from predicted amounts.
There are many sources of information available to the auditor at this stage
including interim financial information, budgets, management accounts,information for prior periods and industry information.
All of this information can be used by auditors to help them understand areas
of risk. For example, ratios (such as the receivables days, inventory turnover
and the current ratio) can be calculated using information from the financial
statements. The financial statements can also be compared to prior years, orsimilar firms in the same industry.
Budgets are helpful in indicating the expectations of the organization, and
management accounting information is useful for variance analysis. Variance
analysis involves looking at actual income and expenditure against the expectedfigures and determining the reasons for any variances between the two.
Analytical procedures such as these can be extremely helpful at the risk
assessment and planning stages of an audit and help the auditor to identify the
areas of greatest risk, and therefore the areas where the risk of misstatement
in the accounts is highest. These are the areas where the most work will berequired during the audit.
Observation and inspection
These techniques are likely to confirm the answers made to inquiries made of
management. They will include observing the normal operations of a company,
reading documents or manuals relating to the client’s operations or visitingpremises and meeting staff.
The ISA gives guidance on performing these risk assessment procedures inorder to obtain the required understanding of the business.
The table below summarizes some of the key points.
Application activity 7.3
1. What auditors need to know in understanding the entity and its
environment?
2. Why do auditors needs to be familiar with the organization business
model?
3. What are the factors the auditor must valuate to understand the entity
and its environment?
4. What is the most important thing that an auditor does whenunderstanding the entity?
7.4. Audit risk
Learning activity 7.4
Observe the above picture then answer the following questions:
1. Is it possible that an auditor can give an inappropriate audit opinionon financial statements?
2. How do we call the case in which an auditor can give an inappropriateaudit opinion on financial statements ?
7.4.1. Meaning and types of audit risks
a) Meaning of audit risk
In an audit of financial statements, audit risk is the risk that the auditor
expresses an inappropriate audit opinion when the financial statements
are materially misstated, i.e., the financial statements are not presented fairlyin conformity with the applicable financial reporting framework.
b) Types of audit risk
Audit risk
Audit risk is the risk that the auditors give an inappropriate audit opinion when
the financial statements are materially misstated. It has two elements: the risk
that the financial statements contain a material misstatement (inherent risk
and control risk) and the risk that the auditors will fail to detect any materialmisstatements (detection risk).
In order to obtain assurance about whether the financial statements are free
from material misstatement, the auditor needs to consider how and wheremisstatements are most likely to arise.
Carrying out a financial statement risk assessment helps the auditor ensure
that the key areas more susceptible to material misstatement are adequately
investigated and tested during the audit. It also helps the auditor identify low risk
areas where reduced testing may be appropriate, ensuring time is not wastedby over-testing these areas.
In this way, auditors follow a risk-based approach to auditing. In the risk-based
approach, auditors analyze the risks associated with the client’s business,
transactions and systems, which could lead to misstatements in the financial
statements, and direct their testing to risky areas. Audits conducted inaccordance with ISAs must follow the risk-based approach.
Auditors are therefore not concerned with individual routine transactions,although they will still be concerned with material, non-routine transactions.
As you can see from the above diagram, audit risk has two major components:
• The risk of material misstatement arising in the financial statements
is dependent on the entity, and cannot be influenced by the auditors.It is a product of inherent risk and control risk. (ISA 200: para. 13
Detection risk)
Detection risk is dependent on the auditor, and is the risk that the auditor will
not detect material misstatements in the financial statements. (ISA 200: para.13(e))
Inherent risk
Inherent risk is the risk that items will be misstated due to characteristics of
those items, such as the fact they are estimates or that they are important items
in the accounts. The auditors must use their professional judgment and all
available knowledge to assess inherent risk. If no such information or knowledgeis available, then the inherent risk is high.
Inherent risk is affected by many factors, including:
• The nature of the entity, for example, the industry it is in and the
regulations it falls under
• The attitudes and experience of management
• The geographic spread of the operations
• The future business strategy of the entity
• The presence of complex wage structures, for example, a bonus- orcommission-based salary structure
The information system, for example, computer-based accounting systems
Inherent risk can also vary from account to account. Balances made up of
complex items, such as inventory in a manufacturing company, portable assets
in an engineering company and cash balances are generally more prone to highlevels of inherent risk.
Control risk
Control risk is the risk that a misstatement that could occur in an assertion and
that could be material, individually or when aggregated with other misstatements,
will not be prevented or detected and corrected on a timely basis by the entity’sinternal control.
7.4.2. Model and calculation of audit risk
This aspect of audit risk is known as detection risk.
Detection risk is the risk that the auditor’s procedures will not detect a
misstatement that exists in an assertion that could be material, individually orwhen aggregated with other misstatements. (ISA 200)
Detection risk is the component of audit risk that the auditors have a degree of
control over, because, if risk is too high to be tolerated, the auditors can carry
out more work to reduce this aspect of audit risk, and therefore audit risk as awhole.
ISA 200 Overall objectives of the independent auditor and the conduct of an
audit in accordance with international standards on auditing (ISA 200) states
that ‘the auditor shall obtain sufficient appropriate audit evidence to reduce
audit risk to an acceptably low level and thereby enable the auditor to draw
reasonable conclusions on which to base the auditor’s opinion’, that is, givingreasonable assurance on the truth and fairness of the financial statements.
Looking at audit risk as a whole, we can see that it can be represented by theaudit risk model as follows:
The implication of this for the auditor is that if inherent risk and control risk are
relatively high, then the amount of work carried out to reduce detection risk willhave to increase to reduce audit risk as a whole to an acceptably low level.
For example, let us assume that an auditor is prepared to accept a 5% chance
that he may give an inappropriate audit opinion on the financial statements. Inother words, the auditor sets the acceptable level of audit risk at 5%.
From his assessment of the client’s risk environment, the auditor has determined
the inherent risk factor to be 80% and the control risk factor for a given area ofthe financial statements to be 25%.
By re-arranging the audit risk model [Audit risk (AR) = Inherent risk (IR) * Control
risk (CR) * Detection risk (DR)] we can find the level of detection risk required:
DR= AR/ IR*CR
DR = 0.05/ 0.8*0.25
DR= 0.05/0.2DR= 0.25*100= 25%
So, the level of detection risk would need to be set at 25%.
However, let us now assume that for a different area of the client’s financial
statements, the auditor has assessed control risk at 12½%. How does thisaffect the level of detection risk?
AR= 0.05
DR= AR/ IR*CR
DR= 0.05/ 0.8*0.125
DR= 0.05/ 0.1
DR= 0.5 *100= 50%
Now the level of detection risk should be set at 50%.
These examples illustrate a very important point: that detection risk has an inverse
relationship with risk of material misstatement (inherent risk u control risk). The
lower the risk of material misstatement, the higher the level of detection risk
which can be accepted, and therefore the lower the level of detailed testingrequired.
Conversely, if the auditor feels a company has a high risk of material misstatement,
then the acceptable level of detection risk will need to be reduced to compensate
for this, and consequently the auditor will need to increase the level of detailedtesting required.
Remember that the level of detection risk represents the risk that the auditors
will not find a material misstatement. Consequently, there is also an inverse
relationship between the level of detection risk and the level of substantive
testing required: the higher the acceptable level of detection risk, the lower theamount of substantive testing required, and vice versa.
7.4.3. Assessing the risk of material misstatement andresponding to risk assessment
a) Assessing the risk of material misstatement
The ISA 315) says that the auditor shall identify and assess the risks of material
mistatement at the financial statement level and assertion level. It requires theauditor to take the following steps:
• Identify risks throughout the process of obtaining an understanding of
the entity’
• Relate the risks to what can go wrong at the assertion level;
• Consider whether the risks are of a magnitude that could result in a
material misstatement;• Consider the likelihood of the risks causing a material misstatement.
b) responding to risk assessment
The auditors must formulate an approach to the identified risks of material
misstatement. They must formulate overall responses and detailed further audit
procedures, which will comprise tests of controls and substantive proceduresor substantive procedures only.
The objective of ISA 330 The auditor’s responses to assessed risks is ‘to obtain
sufficient appropriate audit evidence regarding to the assessed risks of material
misstatement, through designing and implementing appropriate responses tothose risks’.
In other words, having assessed the risks of material misstatements in the
financial statements, the auditor has to plan the work that will be carried out to
ensure that he/she can give an opinion that the financial statements give a true
and fair view, that is, that any material misstatements have been identified andamended if necessary.
Overall responses
Overall responses to risks of material misstatement will be changes to the
general audit strategy or re-affirmations to staff of the general audit strategy.
For example (ISA 330):
• Emphasizing to audit staff the need to maintain professional scepticism;
• Assigning additional or more experienced staff to the audit team;
• Using experts;
• Providing more supervision on the audit;
• Incorporating more unpredictability into the audit procedures;
• Making general changes to the nature, timing and extent of auditprocedures.
Responses to the risks of material misstatement at the assertion level
The ISA says that ‘the auditor shall design and perform further audit procedures
whose nature, timing and extent are based upon and are responsive to the
assessed risks of material misstatement at the assertion level. Nature refers
to the purpose and the type of test that is carried out. ISA 330 requires thatauditors should carry out tests of controls and substantive procedures.
Test of controls is an audit procedure designed to evaluate the operating
effectiveness of controls in preventing, or detecting and correcting materialmisstatements at the assertion level.
Substantive procedure is an audit procedure designed to detect material
misstatements at the assertion level. Substantive procedures comprise tests ofdetails and substantive analytical procedures.
Application activity 7.4
You are involved with the audit of Kigali Solutions Ltd, a small company. You
have been carrying out procedures to gain an understanding of the entity.The following matters came to your attention:
The company offers standard credit terms to its customers of 60 days
from the date of invoice. Statements are sent to customers on a monthly
basis. However, Kigali Solutions Ltd does not employ a credit controller,
the company sends statements to clients on a monthly basis, it does not
communicate with them on a systematic basis (regular basis). On certain
days, the receivables ledger clerk may call a customer if the company has
not received a payment. Some clients pay regularly according to the credit
terms offered to them, but others pay on a very haphazard basis and do not
provide a remittance advice. Receivables ledger receipts are entered into
the receivables ledger but not matched to invoices remitted. The companydoes not produce an aged list of balances.
Required
From the above information, assess the risks of material misstatement arising
in the financial statements. Outline the potential materiality of the risks anddiscuss factors in the likelihood of the risks arising.
Skills lab activity 7
Under the guidance of the teacher, the students can visit the school
accountant, headteacher and other school staffs, to ask them different
questions about organization policy, management framework and financial
informations that can help them to obtain useful information that can beused in the audit work.
End unit 7 assessment
1. Which of the following would not increae inherent risk
A. Revenue is derived from sales of high-tech products
B. Sales order are not authorised prior to sales being executed
C. A number of customers have significatly old debt
D. Some recent sales have resulted in legal claims against thecompany
2. Which of the following statement does not illustrate an inherent risk?
A. The organization is seeking to rise finance to diversity
B. The auditor uses samples when carrying out audit testing
C. Directors participate in a profit-related bonus schemeD. The financial statements contain complex transactions
3. Can an audit partner delegate responsibility for the audit opinion tohis staff?
4. What procedures might an auditor use in gaining an understandingof the entity?
5. What information does an audit plan usually contain?
6. The audit partner has set the overall level of audit risk for a client as10%.
Your risk assessment of the client has indicated that inherent risk is60% and control risk is 60%.
What level of detection risk should be prescribed for this client?