1

CHAPTER 5 Audit Risk

& Materiality

2

Scope paragraph:We conducted our audits in accordance with generally accepted auditing standards. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement...

The phrase “reasonableassurance” in the audit reportindicates that there is some

audit risk.

3

Scope paragraph:We conducted our audits in accordance with generally accepted auditing standards. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement...

Note the mentionof materiality inthe audit report.

4

What ismateriality?

Note the mentionof materiality inthe audit report.

5

Materiality is the magnitude of omittedor misstated information that probably

would have made a difference in thejudgment of someone relying on that

information (FASB 2).

What ismateriality?

6

For each engagement, auditors For each engagement, auditors typically establish a typically establish a preliminary preliminary

judgment about materialityjudgment about materiality..

The preliminary judgmentabout materiality is the maximumamount by which the auditor be-lieves the statements could be

misstated and still not affect thedecisions of reasonable users.

7

For each engagement, auditors For each engagement, auditors typically establish a typically establish a preliminary preliminary

judgment about materialityjudgment about materiality..- may be based on a firm-wide formula considering profitability and/or total assets, e.g., 6% of net income

adjusted accordingto auditor judgment

8

A small materialityestimate will resultin more evidence.

A large materialityestimate will resultin less evidence.

How does the preliminary judgment How does the preliminary judgment about materiality affect the about materiality affect the volumevolume

of audit evidence?of audit evidence?

“Investigate mis- statements over $100.”

“Investigate misstate- ments over $10,000.”

9

- materiality is strongly influenced by client size

$1000 - WOW!

$1000...peanuts

factors affecting the preliminary factors affecting the preliminary judgment about materiality judgment about materiality

10

- materiality is strongly influenced by client size- multiple bases of materiality may be appropriateFOR EXAMPLE: The auditor may be concerned that:net income is not misstated by $100,000,and total assets is not misstated by$300,000.

factors affecting the preliminary factors affecting the preliminary judgment about materiality judgment about materiality

11

- materiality is strongly influenced by client size- multiple bases of materiality may be appropriate- an irregularity is considered more ma- terial than an error of the same dollar amount.

WHY?WHY?

factors affecting the preliminary factors affecting the preliminary judgment about materiality judgment about materiality

12

- materiality is strongly influenced by client size- multiple bases of materiality may be appropriate- an irregularity is considered more ma- terial than an error of the same dollar amount.- small differences from contractual requirements may be material (e.g., ratios related to debt agreements)

factors affecting the preliminary factors affecting the preliminary judgment about materiality judgment about materiality

13

- multiple bases of materiality may be appropriate- an irregularity is considered more ma- terial than an error of the same dollar amount.- small differences from contractual requirements may be material (e.g., ratios related to debt agreements)- immaterial amounts may accumulate into a material amount

factors affecting the preliminary factors affecting the preliminary judgment about materiality judgment about materiality

14

What is acceptable audit risk?

Acceptable audit risk is therisk that the auditor is willingto accept that an unqualified

opinion will be issued for statements that are materially

misstated.

setmateriality, and

assess acceptableaudit risk andinherent risk

15

thelowerthe

acceptableaudit risk

2%

16

the greater the certainty the auditor wants to achieve

98%

thelowerthe

acceptableaudit risk

2%

17

the greater the certainty the auditor wants to achieve

98%

thegreater

the amountof audit

evidenceand

costs

thelowerthe

acceptableaudit risk

2%

18

Achieved audit risk is theactual risk that the state-ments are materially mis-stated after an unqualifiedopinion has been issued.

What is achieved audit risk?

19

How do How do acceptableacceptable and and achievedachieved audit risk affect the audit risk affect the audit reportaudit report??

ifachieved audit risk

acceptable audit risk<

audit report issupported bythe evidence

5%

10%

20

How do How do acceptableacceptable and and achievedachieved audit risk affect the audit risk affect the audit reportaudit report??

audit report isnot supported

by the evidence

ifachieved audit risk

acceptable audit risk>

15%

5%

21

Risk is very difficult Risk is very difficult to to quantifyquantify..

subjective

based onjudgment

22

How can an auditor How can an auditor reducereduce audit risk?audit risk?

audit risk

evidenceand cost

achieved risk

acceptable risk

sufficient,competent

gathergather moremore evidenceevidence

23

- degree to which users rely on the cli- ent’s financial statements- likelihood that the client will have fi- nancial difficulties after the report has been issued- management integrity

Auditors should consider:

Auditors may face additional auditAuditors may face additional auditrisk because of risk because of business riskbusiness risk; i.e.,; i.e.,

the risk that the client will havethe risk that the client will havefinancial problems.financial problems.

24

Audit Risk has 3 components Audit Risk has 3 components which combine to make the which combine to make the audit risk modelaudit risk model (AU 312): (AU 312):

?= x x

audit risk

inherent risk

control risk

detection risk

25

Inherent RiskInherent Risk- defined as the risk that material mis- statements exist before considering the client internal controls- some accounts, components, cycles are inherently riskier than others

auditors must:- identify inherently risky areas- gather appropriate evidence regarding those areas

26

inherent risk considerationsinherent risk considerations- nature of client’s business

EXAMPLE: Sally’s Clothing Boutique rents store space in a house.

What are the inherently riskyaccounts? cash inventory accounts payable

Sally’s

27

inherent risk considerationsinherent risk considerations- nature of client’s business

EXAMPLE: Sally’s Clothing Boutique rents store space in a house.

What are the inherently lessrisky accounts? fixed assets equity

Sally’s

28

inherent risk considerationsinherent risk considerations- nature of client’s business- integrity of management

poorintegrity

moreevidence

29

inherent risk considerationsinherent risk considerations- nature of client’s business- integrity of management- client motivation to misstate the finan- cial statements

Are managementbonuses based on net income?

30

inherent risk considerationsinherent risk considerations- nature of client’s business- integrity of management- client motivation to misstate the finan- cial statements- results of previous audits - accounts, components which had material mis- statements in prior years should be tested extensively in the current year

31

inherent risk considerationsinherent risk considerations- nature of client’s business- integrity of management- client motivation to misstate the finan- cial statements- results of previous audits- initial vs. repeat engagements

Why are Why are initialinitial audit audit engagements inherentlyengagements inherently

riskier than riskier than repeatsrepeats??

32

Why are Why are initialinitial audit audit engagements inherentlyengagements inherently

riskier than riskier than repeatsrepeats??- during the initial engagement, the auditor is not familiar with client systems, internal controls, and personnel- during the initial engagement, be- ginning balances must be exten- sively examined

33

inherent risk considerationsinherent risk considerations- nature of client’s business- integrity of management- client motivation to misstate the finan- cial statements- results of previous audits- initial vs. repeat engagements- related parties- nonroutine transactions

HasGAAP been

correctlyapplied?

34

inherent risk considerationsinherent risk considerations- related parties- nonroutine transactions- judgment required to correctly record transactions- susceptibility to defalcation

Example: CASH

35

averageage of a/p, 45 days

Which is riskierWhich is riskier?? averageage of a/p, 15 days

inherent risk considerationsinherent risk considerations- judgment required to correctly record transactions- susceptibility to defalcation- makeup of the population

36

Audit Risk has 3 components Audit Risk has 3 components which combine to make the which combine to make the audit risk modelaudit risk model: (AU 312): (AU 312)

?= x x

audit risk

inherent risk

control risk

detection risk

37

Audit Risk has 3 components Audit Risk has 3 components which combine to make the which combine to make the audit risk modelaudit risk model: (AU 312): (AU 312)

therisk that material

misstatements will not be prevented ordetected by

internal controls

= x xaudit risk

inherent risk

control risk

detection risk

38

Audit Risk has 3 components Audit Risk has 3 components which combine to make the which combine to make the audit risk modelaudit risk model: (AU 312): (AU 312)

?= x x

audit risk

inherent risk

control risk

detection risk

39

Audit Risk has 3 components Audit Risk has 3 components which combine to make the which combine to make the audit risk modelaudit risk model: (AU 312): (AU 312)

Detection risk is the riskthat material misstate-

ments will not be detectedby the auditor.

= x xaudit risk

inherent risk

control risk

detection risk

40

Why does Why does detection riskdetection risk exist? exist?

The last 3 reasons are The last 3 reasons are nonsam-nonsam-pling errorspling errors. The risk of their oc-. The risk of their oc-

currence is currence is nonsampling risknonsampling risk..

- the auditor samples (sampling risk)- the auditor may select ineffective audit procedures- the auditor may apply procedures ineffectively- the auditor may incorrectly evaluate the results of procedures

41

Which of these Which of these components can the components can the

auditor influence?auditor influence?

Audit Risk has 3 components Audit Risk has 3 components which combine to make the which combine to make the audit risk modelaudit risk model: (AU 312): (AU 312)

= x xaudit risk

inherent risk

control risk

detection risk

42

Which of these Which of these components can components can the auditor the auditor influence?influence?

Audit Risk has 3 components Audit Risk has 3 components which combine to make the which combine to make the audit risk modelaudit risk model: (AU 312): (AU 312)

indirectly:influencemanage-

ment

directly- larger sample size- enhanced training

= x xaudit risk

inherent risk

control risk

detection risk

43

auditingprocedures

internalcontrols

audit risk as a double-hoop basketball gameaudit risk as a double-hoop basketball game

44

auditingprocedures

misstatements(inherently

risky accountsare better shots)

internalcontrols

audit risk as a double-hoop basketball gameaudit risk as a double-hoop basketball game

45

auditingprocedures

misstatementsdetected by

internal controls

internalcontrols

audit risk as a double-hoop basketball gameaudit risk as a double-hoop basketball game

46

auditingprocedures

misstatementsnot detected by internal controls

(control risk)

internalcontrols

audit risk as a double-hoop basketball gameaudit risk as a double-hoop basketball game

47

auditingprocedures

misstatements detected by auditors

internalcontrols

audit risk as a double-hoop basketball gameaudit risk as a double-hoop basketball game

48

auditingprocedures

internalcontrols

audit risk as a double-hoop basketball gameaudit risk as a double-hoop basketball game

misstatements undetected by

auditors(detection risk)