Audit Risk and Materiality

Audit risk - The risk that the auditor expresses an inappropriate audit opinion when the financial
statements are materially misstated

What Are the 3 Types of Audit Risk? There are three main types of audit risk: Inherent risk, control
risk, and detection risk.
What Is Inherent Risk?
Inherent risk is a form of raw risk (by its inherent nature or the natural risk that may occurs
whether or not internal control in place or not).
This type of risk is any that occurs naturally due to a factor other than a failure of internal control.
In a financial audit, inherent risk is most likely to occur when transactions are complex or in
situations that require a high degree of judgment in regard to financial estimates. This type of
risk represents a worst-case scenario because all internal controls in place have nonetheless failed.
Examples of inherent risks include disruptions in supply chains, unaudited financial statements, or
even unedited social media posts for businesses.
Takeaways:
• Inherent risk is the risk posed by an error or omission in a financial statement due to a factor
other than a failure of internal control.
• In a financial audit, inherent risk is most likely to occur when transactions are complex or in
situations that require a high degree of judgment in regard to financial estimates.
• Inherent risk is one of the risks auditors and analysts must look for when reviewing financial
statements, along with control risk and detection risk.
• Inherent risk is common in the financial services sector due to complex regulations and the
use of difficult-to-assess financial instruments.
Control Risk
Control risk is a type of risk that occurs when a financial misstatement results from a lack of proper
accounting controls in the firm. This means that there aren't enough internal controls or
management in place to avoid risk. Put simply, control risk occurs when there is a failure to review
financial statements. In other cases, these precautions may be in place but don't function properly.
This type of risk can lead to increased losses.
Components of Internal Control
1. Control environment - The control environment includes the governance and management
functions and the attitudes, awareness, and actions of those charged with governance and
management concerning the entity’s internal control and its importance in the entity. The
control environment sets the tone of an organization, influencing the control consciousness
of its people. It is the foundation for effective internal control, providing discipline and
structure.
2. Risk assessment process - The auditor should obtain an understanding of the entity’s process
for identifying business risks relevant to financial reporting objectives and deciding about
actions to address those risks, and the results thereof. The process is described as the “entity’s
risk assessment process” and forms the basis for how management determines the risks to
be managed.
3. Information system - The information system relevant to financial reporting objectives, which
includes the accounting system, consists of the procedures and records established to initiate,
record, process, and report entity transactions (as well as events and conditions) and to
maintain accountability for the related assets, liabilities, and equity.
4. Control activities - Control activities are the policies and procedures that help ensure that
management directives are carried out; for example, that necessary actions are taken to
address risks that threaten the achievement of the entity’s objectives. Control activities,
whether within IT or manual systems, have various objectives and are applied at various
organizational and functional levels. Examples of specific control activities include:
• Authorization.
• Performance reviews.
• Information processing.
• Physical controls.
• Segregation of duties.
5. Monitoring of controls - Monitoring of controls is a process to assess the effectiveness of

internal control performance over time. It involves assessing the design and operation of
controls on a timely basis and taking necessary corrective actions modified for changes in
conditions. Management accomplishes monitoring of controls through ongoing activities,
separate evaluations, or a combination of the two. Ongoing monitoring activities are often
built into the normal recurring activities of an entity and include regular management and
supervisory activities.
Detection Risk
Detection risk occurs when auditors simply fail to detect an easy-to-notice error. This may be a
result of fraud or other errors. Detection risk may occur unintentionally in that an auditor may miss
an error accidentally. In other cases, an auditor may misinterpret the figures on the financial
statements they're charged with reviewing that it results in one or more errors.
Overall Audit Risk (Combined Risk Assessment)
If inherent and control risks are considered to be high, an auditor can set the detection risk to an
acceptably low level to keep the overall audit risk at a reasonable level. To lower detection risk,
an auditor will take steps to improve audit procedures through targeted audit selections or increased
sample sizes.
Audit Risk Model
The audit risk model demonstrates the relationship between inherent risk and control risk and the
level of detection risk an auditor is willing to accept when performing audit procedures. The objective
of an audit is to limit audit risk to an acceptably low level (i.e., 5%). This level of audit risk is generally
accepted in the profession as an acceptable level of audit risk and recognizes that an auditor shall
perform an audit to obtain reasonable, not absolute, assurance that the financial statements as a
whole are not materially misstated.
Inherent risk and control risk are the entity’s risks and exist independently of audit. They arise from
many factors including, but not limited to, the nature of the entity’s business and the strategies that
it undertakes. They can be increased or reduced by the management’s attitude toward risk
(aggressive or passive, or corrective behaviors). Some businesses and strategies are inherently
more (or less) risky than others (e.g. financial institutions are riskier than a leasing company) and
result in higher (or lower) inherent risks that material misstatements of the financial statements may
occur.
Management can mitigate inherent risk by implementing effective internal control; however, inherent
risk cannot be totally eliminated due to the limitations of controls arising from the realities that
human judgment in decision-making can be faulty and that breakdowns in internal control can occur
because of human error or fraud.
Detection risk is the risk that a material misstatement would not be detected by an auditor’s
substantive procedures. These substantive procedures include Primary Substantive Procedures
(PSPs) and Other Substantive Procedures (OSPs) as appropriate. PSPs and OSPs examples:
• Substantive analytical procedures
• Test of details, which may include testing of key items and/or representative samples
The audit risk model effectively allows an auditor to take a variety of circumstances into account
when selecting an effective and efficient audit approach to reduce audit risk to an acceptably low
level.
An auditor evaluates and make judgments about the perceived level of inherent risk related to an
account balance or disclosure (e.g., Cash, Receivables, Derivative Financial Instruments, or Bank
Loans) and decide whether to rely or not to rely on controls. These judgments have a direct effect
on the nature, timing and extent of our substantive procedures (Note: The auditor adjusts its
detection risk depending on the IR and CR assessment).
The audit risk model is stated as:
IR x CR = Combined Risk Assessment

Detection Risk is adjusted based on the result of CRA. The higher the CRA, the higher the risk of
material misstatements. The higher the risk of material misstatements, the lower the detection risk
must be in order to reduce audit risk to an appropriately low level.
Understanding detection risk
The audit risk model shows the connection between inherent risk, control risk and detection risk.
Detection risk is directly influenced by the procedures an auditor performs and judgments he makes
throughout the audit.
The lower the confidence that a material misstatement may not exist based on our combined risk
assessment (i.e., from our assessments of inherent risk and control risk), the greater the confidence
we require from our detection procedures, resulting in “more” substantive procedures to be
performed to maintain audit risk at 5% (“more” includes the nature and timing of procedures as well
as their extent).
Audit Risk and Materiality
There is an inverse relationship between materiality and the level of audit risk, that is the higher
the materiality level, the lower the audit risk and vice versa (see explanation below). Auditors take
into account the inverse relationship between materiality and audit risk when determining the
nature, timing and extent of audit procedures.
Explanation:
1. Materiality is the threshold or the floor in which we can accept any misstatements.
2. Material misstatements mean misstatements above that materiality threshold. Below
materiality, all misstatements are considered immaterial.
3. The higher the materiality means the lesser accounts (e.g., expenses accounts) or transactions
to qualify above materiality.
4. Therefore, the auditor should have a low audit risk for him to be able to accept a high
materiality (which might mean lesser audit procedures).

Audit Risk and Materiality

Uploaded by

Copyright:

Available Formats

Audit Risk and Materiality

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Audit Risk and Materiality

Uploaded by

Copyright:

Available Formats

Audit risk - The risk that the auditor expresses an inappropriate audit opinion when the financial

statements are materially misstated

5. Monitoring of controls - Monitoring of controls is a process to assess the effectiveness of

IR x CR = Combined Risk Assessment

You might also like