CH 3 Materilaity and Risk Assesment
CH 3 Materilaity and Risk Assesment
LEARNING OBJECTIVES
After studying the material in the chapter you should be able to:
Materiality is not specifically defined in the ISAs. ISA 320, instead, defines
materiality in the context of an audit and as performance materiality. Although
financial reporting frameworks may discuss materiality in different terms, in the
context of an audit, they generally explain that:
1
Performance materiality means the amount or amounts set by the auditor at less than
materiality for the financial statements as a whole. This reduces to an appropriately
low level the probability that the total of uncorrected and undetected misstatements
exceeds materiality for the financial statements as a whole. If applicable, performance
materiality also refers to the amounts set by the auditor at less than the materiality
levels for particular classes of transactions, account balances or disclosures.
APPLYING MATERIALITY
There are five steps in this process. The first two involve the planning; the latter
three concern evaluating the results of tests.
Planning materiality is the maximum amount you believe the financial statements can
be misstated and not affect the judgment of users.
Planning materiality is a concept that is used to design the audit such that the auditor
can obtain reasonable assurance that any error of a relevant (material) size or nature
will be identified. There are additional costs for an auditor to audit with a lower
materiality. The lower the materiality, the more costly is the audit. If any error of
whatever small size needs to be found in the audit, the auditor would spend
significantly more time than when a certain level of imprecision (higher materiality
level) is considered acceptable.
What is material is often difficult to determine in practice. However, four factors are
generally considered: size of item; nature of item; the circumstances; and the cost
and benefit of auditing the item.
2
are quantifiable in monetary terms.
The materiality of an error depends upon the circumstances of its occurrence. There
are two types of relevant circumstances:
Since materiality means the impact on the decisions of the user, the auditor must have
knowledge of the likely users of the financial statements and those users’ decisions
process. If a company is being audited prior to listing on a national stock exchange or
a large loan or merger, the users will be of one type. If statements of a closely held
partnership are being audited, users will be of a different type.
For example, if the primary users of the financial statements are creditors, the auditor
may assign a low materiality threshold to those items on financial statements that
affect liquidity such as current assets and current liabilities. On the other hand, if the
primary users are investors or potential investors, the auditor may assign a low
materiality threshold to income.
The auditor should consider materiality and its relationship with audit risk when
conducting an audit, according to ISA 320. What does this mean? In statistical
sampling, there is a fixed relationship between:
the reliability of an assertion based on the sampling (in auditing this is
determined by audit risk);
the precision of this statement (in auditing it is determined by materiality);
the amount of evidence that should be gathered in order to make this assertion.
3
Changes in one of these three items have implications for (one of) the other two.
Where to Set Materiality?
Considering all these materiality factors, then, at what amount should materiality be
set? The international standards give no guidelines. In practice, however, every
accounting firm has its own set of guidelines or “rules of thumb” related to a financial
statement base such as net income, total revenues, etc. Rules of thumb commonly
used in practice include:
Lower materiality (i.e., 5% of net income before taxes) for higher risk (low
acceptable audit risk)
Higher materiality(i.e., 10% of net income before taxes) for a low risk audit
(high acceptable audit risk)
The appropriate financial statement base for computing materiality will vary based on
the nature of the client’s business. For example, if a company is near break-even, net
income for the year will be much too small to use as the financial statement base. In
that case the auditors will often choose another financial statement base or use an
average of net income over a number of prior years.
The preliminary estimate is geared toward planning - how much evidence will we
need. There is a direct link between materiality and evidence:
4
As with overall materiality, there are qualitative factors that must be considered in
determining tolerable misstatement. Examples of qualitative factors that the auditor
would consider for a given account include: the size and complexity of the account,
the importance of changes in the account to key performance indicators, debt
covenants, and meeting published forecasts or estimates. In conjunction with
qualitative factors, common computational benchmarks used in practice to determine
tolerable misstatement are 2 to 15 percent of the account (but never greater than
materiality) or 25 to 75 percent of preliminary planning materiality. These approaches
result in an allocation of combined tolerable misstatement that is greater than
materiality. There are a number of reasons why allocating combined tolerable
misstatement greater than materiality makes sense from an audit planning perspective.
Reason:
Offsetting over- and understatements
Unlikely to use full allocation of tolerable misstatement for each account
i.e., not all accounts will be misstated by the full amount of their tolerable
misstatement allocation.
Audits of individual accounts are conducted simultaneously. In other
words, for all but the smallest of audit clients, the audit team will be made
up of several auditors who are testing different accounts at the same time.
If accounts were audited sequentially, unadjusted misstatements observed
during testing would count against materiality, and theoretically, the
auditor could carry the unused portion of materiality to the next account,
and so forth. The simple benchmarks such as 25-75 percent of materiality
have proven to be a useful way to determine tolerable misstatement for
planning purposes.
Taken together, these points suggest that it would be inefficient for the auditor to
simply subdivide materiality proportionally to each account because this would result
in unnecessarily low tolerable misstatement levels. The lower the tolerable
misstatement is, the more extensive the required audit testing. In the extreme, if
tolerable misstatement were very small or zero, the auditor would have to test every
transaction in an account.
5
Factors affecting tolerable misstatement
Larger allocation Smaller allocation
Large balance Small balance
Errors expected Few errors expected
Costly to test or Testable with AP Less costly to test
Note that many of these factors relate to the inherent risk and control risk for the
account. Many firms set tolerable misstatement as a percentage of materiality based
on the inherent risk and control risk assessment for that account.
3. Estimate Total Misstatement in Segment - Use the errors found in the sample
tested to estimate the total errors in the population of items in each account.
The third step is completed near the end of the audit, when the auditor evaluates all
the evidence that has been gathered. Based on the results of the audit procedures
conducted, the auditor aggregates misstatements from each account or class of
transactions. The aggregate amount includes known misstatements and projections
based on the sample data collected. It should also include consideration of the effect
of misstatements not adjusted in the prior period because they were judged to be
immaterial. The auditor compares this aggregate misstatement (referred to as likely
misstatement) to the preliminary judgment about materiality. If the auditor’s judgment
about materiality at the planning stage (Step 1) was based on the same information
available at the evaluation stage (Step 3), materiality for planning and evaluation
would be the same. However, the auditor may identify factors or items during the
course of the audit that cause a revision to the preliminary judgment about materiality.
Thus, the preliminary judgment about materiality may differ from the materiality
judgment used in evaluating the audit findings. When this occurs, the auditor should
carefully document the reasons for revising the preliminary judgment about
materiality.
The error must be projected to the population. The auditor should consider sampling
risk, especially when the direct projection is close to tolerable misstatement.
Example:
We project errors because sample errors are our best indicator of errors in the portion
of the population we did not test.
6
Sampling error - Whether a sample is evaluated statistically or nonstatistically,
adequate consideration must be given to sampling risk. Although sampling risk must
be considered, it does not necessarily have to be quantified. Sampling risk is present
whenever less than 100% of the population is tested.
5. Compare Combined Estimated Total Misstatements from step 4 with the Revised
Judgment about Materiality. (Your preliminary estimate must be revised to
consider the actual financial numbers)
If estimated total combined errors are less than materiality, an unqualified opinion
may be issued. Options available to the auditor when combined errors exceed
materiality:
We are likely to record an adjustment and/or perform more testing before we would
qualify the opinion.
7
PART TWO: RISK ASSESSMENT
The auditor has a responsibility to plan and perform the audit to obtain reasonable
assurance about whether the financial statements are free of material misstatement,
whether caused by error or fraud. Because of the nature of audit evidence and the
characteristics of fraud, the auditor is able to obtain reasonable, but not absolute,
assurance that material misstatements are detected.
Risk is the first concept that underlies the audit process. An auditor engaged to
perform a financial statement audit faces two types of risk: audit risk and
engagement risk. Audit risk is the risk that the auditor may unknowingly fail to
appropriately modify the opinion on financial statements that are materially misstated.
Engagement risk is the auditor’s exposure to loss or injury to professional practice
from litigation, adverse publicity, or other events arising in connection with financial
statements audited and reported on.
The auditor should perform the audit to reduce audit risk to a level appropriate for
expressing an opinion on the financial statements. In doing so, the auditor needs to
consider audit risk at the financial statement level (pervasively) and at the account
balance or class of transactions level.
In considering audit risk at the overall financial statement level, the auditor considers
risks of material misstatement that relate pervasively to the financial statements and
potentially affect many assertions. Such risks often relate to the entity’s control
environment and may be relevant to the auditor’s consideration of the risks of
material misstatement arising from fraud (management override of internal control).
The auditor also considers audit risk at the individual account balance or class of
transactions level because such consideration directly assists the auditor to plan the
appropriate audit procedures.
Like audit risk, the auditor must consider engagement risk. Engagement risk relates to
an auditor’s exposure to financial loss and damage to his or her professional
reputation. For example, an auditor may conduct an audit in accordance with ISA and
still be sued by the client or a third party. Even if the auditor wins the lawsuit, his or
her professional reputation may be damaged in the process by the negative publicity.
While engagement risk cannot be directly controlled by the auditor, some control can
be exercised through the careful acceptance and continuance of clients. Audit risk, on
the other hand, can be directly controlled by the scope (nature, timing and extent of
audit procedures) of the auditor’s work.
The audit risk model is an important planning innovation to help auditors consider
the risk of the audit, and the necessary amount of evidence to gather. The model is
expressed as:
PDR = AAR
8
IR x CR
Where:
PDR = Planned detection risk
AAR = Acceptable audit risk.
IR = Inherent risk
CR = Control risk
For computational simplicity, the model can be expressed as:
AAR = IR x CR x PDR
An extended version of the model also considers analytical procedures risk (risk of
error given results of analytical procedures). Fraud risk is generally assessed outside
the risk model.
A. Planned detection risk - Is the risk that audit evidence for a segment will fail to
detect a material misstatement. Planned detection risk is the dependent variable
that is solved for in this equation, and determines the amount of evidence
required. The other three factors determine the auditor's detection risk, and the
amount of evidence that must be gathered (which is why the risk model is a
useful planning tool).
There is an inverse relation between detection risk and evidence. Low detection
risk implies high evidence.
B. Acceptable audit risk - This is the probability that the auditor may unknowingly
fail to appropriately modify the opinion when the financial statements are
materially misstated. The lower the acceptable audit risk, the greater the evidence
required (lower detection risk).
Some accounts are inherently more risky than others. Further, for a given account,
certain assertions/objectives are likely to be associated with higher inherent risk.
For example, there is more inherent risk with inventory than fixed assets. For
accounts receivable, there is greater inherent risk for net realizable value than for
detail tie-in.
Some factors affecting inherent risk:
Nonroutine transactions
Management estimates
9
Net realizable value
Subject to theft or manipulation (fraud risk)
D. Control Risk - This is the risk that the client's internal controls will not detect a
material misstatement. As control risk is lowered, less evidence is required.
Audit risk: Auditor judgment that varies across clients, but is constant for the entire
audit. Risk the auditor is willing to assume based on use of financial
statements and client's financial condition.
Inherent risk:Assessed by the auditor based on client-specific factors. Some factors
apply to all cycles, some factors are specific to objectives within
cycles.
10
Control risk: Assessed by the auditor, but determined by the client's controls. CR
can't be assessed as less than 100% (the maximum) unless the auditor
tests controls.
Or, expressed another way:
AAR = IR X CR X PDR
Audit Risk an error Risk internal Risk the auditor
Risk will occur controls won't detect it won't detect it
Note that detection risk can be divided further into analytical procedures risk and
substantive tests of details risk. Analytical procedures risk is the risk that substantive
analytical procedures and other relevant substantive tests will fail to detect material
misstatements, while tests of details risk is the allowable risk for failing to detect a
material misstatement that is not detected by internal controls or analytical procedures
and other relevant substantive tests. In discussion of the audit risk model, detection
risk will not be divided for ease of presentation.
Detection risk results from two uncertainties that are a function of the effectiveness of
an audit procedure and of its application by the auditor. The first uncertainty is called
sampling risk. Because the auditor examines only a subset of the population, the
sample may not represent the population, and the auditor may draw the wrong
conclusion on the fairness of the account balance. The second uncertainty is called
non sampling risk and can occur because the auditor used an inappropriate audit
procedure, failed to detect a misstatement when applying inappropriate audit
procedures, or misinterpreted the audit results. Non sampling risk can be reduced to a
negligible level through adequate planning, proper assignment of audit staff,
supervision and review of the audit work performed, and supervision and conduct of a
firm’s audit practice in accordance with appropriate quality control standards.
At the account balance or class of transaction level, audit risk consists of:
1. The risk that the balance or class and related assertions contain
misstatements that could be material to the financial statements when
aggregated with misstatements in other balances or classes (inherent risk and
control risk).
2. The risk that the auditor will not detect such misstatements
(detection risk).
Inherent risk and control risk differ from detection risk. Inherent risk and control risk
are functions of the entity and its environment, so the auditor has little or no control
over these risks. Sometimes the combination of these two risks is referred to as
auditee risk.
Detection risk can be controlled by the auditor through the scope of the audit
procedures performed. Detection risk has an inverse relationship to inherent risk and
control risk. For example, if inherent risk and control risk are judged to be high, the
auditor sets a lower level of detection risk in order to meet the planned level of audit
risk.
The auditor’s assessment of audit risk and its component risks (IR, CR and DR) is a
matter of professional judgment. At the completion of the audit, the actual level of
audit risk is not known with certainty by the auditor. If the auditor assesses the
11
achieved audit risk as being less than or equal to the planned level of audit risk, an
unqualified report can be issued. If the assessment of the achieved level of audit risk
is greater than the planned level, the auditor should either conduct additional audit
work or qualify the audit report.
The following table shows how the acceptable level of detection risk may vary based
on assessments of inherent and control risks, based on the Appendix to International
Standard on Auditing 400.
There is an inverse relationship between detection risks and the combined level of
inherent and control risks. For example, when inherent and control risks are high,
acceptable levels of detection risk need to be low to reduce audit risk to an acceptably
low level. On the other hand, when inherent and control risks are low, an auditor can
accept a higher detection risk and still reduce audit risk to an acceptably low level.
12
IV. ACCEPTABLE AUDIT RISK AND MATERIALITY
We know these two concepts are linked because they both help us decide how much
evidence to gather. How can we operationalize this interrelation?
For high acceptable risk, we would tend to high range of materiality estimate (ex. 6%
net income).
For low acceptable audit risk, we would tend toward low estimates of materiality (i.e.
3% net income).
FactorAss Comment
essment
Level
AAR Entire audit Based on use of f/s
IR Objective level for Assessed by auditor based on likelihood of error
each cycle/account
CR Objective level for Depends on existence and effectiveness of
each cycle/account controls in preventing error
PDR Objective level for Determined by other risk model factors
each cycle/account
REVIEW QUESTIONS
QUESTION ONE
Instruction: Following are six situations that involve the audit risk model as it is used
for planning audit evidence requirements in the audit of inventory.
Situation
Risk 1 2 3 4 5 6
Acceptable audit risk High High Low Low High Medium
Inherent risk Low High High Low Medium Medium
Control Risk Low Low High High Medium Medium
Planned detection risk
Planned evidence
13
Required: Fill in the blanks for planned detection risk and planned evidence using the
terms low, medium, or low.
QUESTION TWO
Instruction: Using the audit risk model, state the effect on control risk, inherent risk,
acceptable audit risk, and planned evidence for each of the following independent
events. In each of the events a to j, circle one letter for each of the three independent
variables and planned evidence: I = Increase, D = decrease, N = no effect, and C =
cannot determine from the information provided.
14
QUESTION THREE
Multiple Choices
1) As lower acceptable levels of audit risk and materiality are established, the
auditor should plan more work on individual accounts to:
a) Find smaller errors.
b) Find larger errors.
c) Increase tolerable error in accounts.
d) Increase materiality in the accounts.
2) Inherent risk and control risk differ from planned detection risk in that they:
a) Arise from the misapplication of audit procedures.
b) May be assessed in either quantitative or nonquantitative terms.
c) Exist independently of the financial statement audit.
d) Can be changed at the auditor's discretion.
QUESTION FOUR
Discussion Question
Source: Problem 9-26 (Alvin A. Arens &etl. Auditing & Assurance Services, 14th ed.)
You are evaluating audit results for current assets in the audit of Quick Plumbing Co.
You set the preliminary judgment about materiality for current assets at Br 12,500 for
overstatement and at Br 20,000 for understatements. The preliminary and actual
estimates are shown below.
Required
a. Justify lower preliminary judgment for overstatements than understatements of
assets -
b. Why does tolerable misstatement exceed the preliminary materiality estimate?
c. Why do three accounts have overstatements and understatements?
d. 1) Are you more concerned with overstatements or understatements?
2) Which account are you most concerned with?
e. Assume the estimate of total error is less than tolerable misstatement for each
account, but the total exceeds the preliminary materiality estimate.
15
1. Why could this occur?
2. What should the auditor do?
Answer:
a. Justify lower preliminary judgment for overstatements than understatements of
assets -
Audit risk and legal liability. Most auditors believe they have greater
responsibility for overstatement of assets in most situations. Note that the opposite
would hold true for liabilities (more concern for understatements).
e. Assume the estimate of total error is less than tolerable misstatement for each
account, but the total exceeds the preliminary materiality estimate.
1. Why could this occur? Simple math, since total tolerable misstatement is
allowed to exceed the preliminary estimate of materiality. This is not entirely
unusual. Clients know that auditors look for big errors, so they may try to
increase income by small amounts here and there.
2. What should the auditor do? The auditor should record an adjustment
(assuming the client does not want a qualified opinion), or perform expanded
tests to determine whether actual errors exceed materiality (most of the
estimated error is projected).
16