Audit planning and risk assessment

1 Introduction

Audit risk is a technical term related to the process of auditing. The first thing to appreciate is that audit risk cannot be reduced to zero as an audit cannot provide absolute assurance – only reasonable assurance. This is because an audit has ‘inherent limitations’, for example:

• Part of the nature of financial reporting is that financial statements should include accounting estimates which necessarily involve management's judgment.
  

• Audit procedures are designed to gather audit evidence, not to detect intentional misstatement that has been deliberately concealed.
  

• As an audit needs to be conducted within a reasonable period of time and at a reasonable cost, it is not possible to examine everything exhaustively.
  

Audit risk is considered throughout the audit, in particular:

• In understanding the entity – what are the risks?
  

• In planning the audit – how are risks to be reduced to an acceptably low level?
  

2 The audit process

2.1 Introduction

Once the audit has been accepted then the audit process can begin. There are essentially three stages:

• Planning. This will often require a meeting with the client – certainly in the first year of a new audit. Subsequently, a planning phone call might suffice for smaller clients. For new audits the auditor will want to meet senior staff and to visit the client’s premises. They will want to discuss any problems that might have arisen in previous audits. In subsequent years, the auditor will be particularly interested in changes during the year such as a new accounting system, additional premises, changes in senior personnel and accounting or trading problems.
  

• An interim audit. This takes place typically four or five months before the end of the accounting period. This is when the accounting system and internal controls are examined and tested.
  

• A final audit. This happens typically a few weeks after the accounting period end to allow the client to prepare the draft financial statements. It is on these statements that the auditor will be reporting.

A more detailed depiction of an audit is as shown below:

2.2 Planning the audit

This is an essential stage in any audit. Indeed, in the auditor’s report the auditor states that the audit was planned.

The first step is to understand the entity (client) and its environment. Information that will be collected includes:

• Nature of the client’s business
  

• Key customers, competitors and suppliers
  

• Location of operations, factories, shops and so on
  

• Organisational structure
  

• Recent sets of financial statements
  

• Industry comparatives
  

• Names of directors
  

• Organisational objectives
  

• Changes to the IT system
  

• Industry regulation
  

• Industry growth/decline
  

• Accounting policies
  

• Initial assessment of internal control procedures
  

The auditor obtains this understanding through inquiries of management and other staff, analytical procedures, and observation and inspection of operations, documents and records. Previous audit knowledge is useful only after checking for changes. The applicable financial reporting framework, accounting policies and relevant legal requirements must also be understood: they provide the criteria against which the financial statements are audited. The engagement partner and key team members discuss the reporting framework and where material misstatements could arise, including how fraud could occur. The partner communicates relevant matters to team members who did not attend.

Based on this information, preliminary materiality can be calculated. Risks arise from material misstatements so it is necessary to have an early idea of what sizes of errors are likely to be material.

This information will also give the auditor some insight into the higher risk areas of the audit. Risk would be increased if, for example:

• The business operates with cash sales
  

• Inventory consists of small, high-value items (such as jewellery)
  

• There are many dispersed locations
  

• A new IT system has been introduced.
  

The auditor will respond to the risk assessment by designing appropriate audit procedures to obtain sufficient appropriate audit evidence that the financial statements are free from material misstatement.

For example, in the case of inventory consisting of small, high-value items it will be necessary to take great care over the audit of inventory. If a new IT system had been introduced during the year, the auditor will have to carry out additional work on accounting entries just after its implementation because the transition from old to new system might not have gone smoothly.

Complex areas need extra planning. A specialised estimate may require experienced staff, more time and an auditor’s expert; arrange availability early and define the expert’s work. An IT change can alter the audit trail and programmed controls, so plan IT skills, test data and access to complete data files. Budget staff time, schedule supervision and review, and revise the plan when risks or resources change.

2.3 Objectives of audit planning

Planning an audit involves establishing the overall audit strategy for the engagement and developing an audit plan. Adequate planning benefits the audit of financial statements in several ways, including the following:

• To give appropriate attention to important areas of the audit.
  

• To identify and resolve potential problems on a timely basis.
  

• To properly organise and manage the audit engagement so that it is performed in an effective and efficient manner.
  

• To select engagement team members with appropriate levels of capabilities and competence to respond to anticipated risks, and the proper assignment of work to them.
  

• To facilitate the direction and supervision of engagement team members and the review of their work.
  

• To assist where applicable, in coordination of work done by internal audit and experts.

2.4 Overall audit strategy and audit plan

Auditors are expected to produce and document both the audit strategy and the audit plan.

In establishing the overall audit strategy, the auditor will:

1. Identify the characteristics of the engagement that define its scope;
   

2. Plan the timing of the audit and the nature of the communications required. This will include the timing of any reports needed, the nature of the reports and for whom the reports are being prepared.
   

3. Consider the factors that, in the auditor’s professional judgment, are significant in directing the audit team’s efforts. For example, looking carefully at whether the going concern basis of accounting is appropriate.
   

4. Ascertain the nature, timing and extent of resources necessary to perform the engagement. This will include deciding the number of staff needed, their experience and seniority. It will also include deciding to what extent third parties might be needed for some of the audit work, for example, surveyors might be needed to assess the stage of completion of a building.
   

The audit plan will include:

1. The nature, timing and extent of risk assessment procedures.
   

2. The nature, timing and extent of further audit procedures to respond to the assessed risks.
   

An extract from an audit plan relating to receivables is:

This part of the plan is a detailed audit program which sets out exactly the work that has to be done.

2.5 Standard audit programmes

An audit programme lists the procedures needed to meet the objectives for an audit area. Standard programmes save preparation time, encourage consistent coverage and help allocate, supervise and review work. However, a checklist can be followed mechanically, include irrelevant tests or omit a client-specific risk. Tailor it to the entity, its controls, materiality and assessed risks; record who performed each procedure and the conclusion.

2.6 Professional judgment

It is important to remember that professional judgment should be exercised throughout the planning and performance of an audit:

• To identify and assess risks of misstatement based on an understanding of the entity and its environment.
  

• To determine the audit scope and audit plan (e.g. in deciding the nature, timing and extent of audit procedures) to obtain sufficient appropriate audit evidence.
  

• To draw conclusions based on evidence obtained (e.g. in assessing the persuasiveness of conflicting evidence from different sources and the reasonableness of management’s estimates).

3 Materiality

3.1 Introduction

Information is material if its omission or misstatement could influence the decisions of users of the financial statements.

Information can be material through its size, incidence and/or nature. For example, if there is a requirement to disclose directors' remuneration, this must be accurate so any misstatements should be regarded as material. Similarly there is no excuse for failing to state the cash at bank figure accurately. However, for inventory, judgment is needed to arrive at net realisable value, so there will be a range of acceptable amounts.

Materiality is ultimately a matter for the audit partner. How may shareholders be influenced by a figure? Although it will be up to the partner to make the final decision, it is important for members of the audit team, to be given some guidance. There is no point asking for a $5,000 error to be corrected in the financial statements of a multi-national company that is reporting in $ millions.

3.2 Common benchmarks for materiality

Common materiality benchmarks (and you need to know these for your exam) are:

3.3 Performance materiality

Performance materiality is the amount(s) set by the auditor at less than materiality for the financial statements as a whole. Being less means that it reduces the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole.

Consider this example: wages, electricity, depreciation, rent are all understated by 3%. Each item on its own is immaterial to profit, but taken together, because the errors add up the same way, the effect is material. Therefore, the concept of performance materiality means that smaller errors may be identified by audit procedures.

4 Analytical procedures

4.1 Introduction

The term “analytical procedures” means evaluations of financial information through analysis of plausible relationships among both financial and non-financial data. For example, if sales rise you might also expect the packaging cost to rise. Analytical procedures include investigation of identified fluctuations or relationships that are inconsistent with other relevant information or that differ from expected values by a significant amount. So, if packaging costs do not rise in line with sales, the fear is that there has been an accounting error. Of course, the apparent discrepancy might be explained by the company having adopted cheaper packaging.

Analytical procedures must be used at the planning stage to assess whether or not the financial statements are consistent with the auditor's understanding of the entity.

4.2 Examples

Analytical procedures include comparison of the entity’s financial information with, for example:

• Comparable information for prior periods.
  

• Anticipated results of the entity, such as budgets or forecasts, or expectations of the auditor, such as an estimation of depreciation.
  

• Similar industry information, such as a comparison of the entity’s ratio of sales to accounts receivable with industry averages or with other entities of comparable size in the same industry.
  

• Comparison of financial and related non-financial information. For example, number of hotel guests x average price per room should be approximately equal to room revenue.
  

Various methods may be used to perform analytical procedures. These methods range from performing simple comparisons to performing complex analyses using advanced statistical techniques.

5 The audit risk model

5.1 Introduction

At the start of this chapter, audit risk was defined as the risk that the auditor gives an inappropriate opinion on the financial statements. Proper planning is essential to reduce audit risk by, for example, giving appropriate attention to high risk areas of the audit.

However, this ‘common sense’ approach to audit has an extremely important theoretical foundation that shows how risk can build up or be reduced.

5.2 The components of audit risk

Inherent risk:   the susceptibility of an assertion to misstatement that could be material…assuming that there were no related internal controls. In other words, the risk of an error occurring in the first place.

Control risk:   the risk that the misstatement will not be prevented, detected and corrected on a timely basis by the entity’s internal control

Detection risk:   the risk that the auditor’s procedures will not detect the misstatement.

Therefore, for a material error to get into the published financial statements together with an inappropriate auditor’s report, three things have to happen:

1. The error has to have occurred (inherent risk)
   

2. It must not have been picked up by the client’s internal control system (control risk)
   

   The error is now in the financial statements that are about to be audited, and together these two risks determine the risk of a material misstatement ('ROMM').
   

3. The financial statements are audited, but the auditor does not detect the misstatement
   

   The error will now be in the published financial statements that will be sent to shareholders with an inappropriate audit opinion - that they show a true and fair view (or present fairly), when they do not.

5.3 What causes the risks?

Inherent risk can be increased by factors such as:

• Complex transactions
  

• Inexperienced staff
  

• Time pressure
  

• New IT systems
  

• Pressure to perform (leading to optimistic estimates)
  

• Cash businesses
  

ISA 315 (Revised 2019) highlights complexity, subjectivity, change, uncertainty and susceptibility to management bias or fraud as inherent risk factors. For example, a complex valuation model with uncertain assumptions is more susceptible to misstatement before controls are considered. These factors can affect assertions differently; assess the likelihood and size of a possible misstatement.

Control risk can be increased by:

• A poor internal control system
  

• Poor supervision
  

• Poor compliance with internal control procedures
  

• Inexperienced staff
  

• Shortcuts
  

• An unfavourable control environment (not supportive of internal controls).
  

Detection risk is decreased by:

• Performing more audit work eg larger samples are tested.
  

• Performing different audit work eg by attending inventory locations in every branch or by enlisting the help of experts.
  

• Assigning more experienced audit staff.
  

• Greater supervision and review of the audit work.
  

• A quality management review before the auditor's report is issued (one partner reviewing the work of another).
  

5.4 What can be done about the risks?

The auditor can do little about the inherent risk. Over time the auditor might be able to decrease the control risk by writing to the client and making recommendations about how the internal control system could be improved or more consistently implemented. However, the auditor can affect the detection risk as that is determined by the amount and nature of the audit work carried out.

Therefore, if inherent risk and/or control risks are high, the auditor can reduce audit risk to an acceptable level by performing more audit work.

If inherent risk and control risk are both low, the auditor will be able to perform less work because there is only a low risk of an error having occurred and then only a low risk that the client’s system will not detect the misstatement.

5.5 Professional scepticism

The amount of audit work that has to be carried out should be influenced by the concept of professional scepticism. Professional scepticism is defined as "an attitude that includes a questioning mind, being alert to conditions which may indicate possible misstatement due to error or fraud, and a critical evaluation of audit evidence". If you are sceptical it means that you do not know whether or not something is true; you would have a questioning attitude and would not believe something in the absence of reasonable evidence.

Auditors must adopt this attitude. This does not mean that they suspect all directors and employees in the client company of telling lies and deliberately misleading them, but they are aware that everyone makes mistakes, everyone can be unrealistically optimistic, and that everyone can give quick but incorrect replies if under time pressure. Of course, human nature being what it is, occasionally auditors will be deliberately given incorrect information.

Professional scepticism affects the amount of audit work that has to be carried out. It includes being alert to, for example:

• Audit evidence that contradicts other audit evidence obtained.
  

• Information that brings into question the reliability of documents and responses to inquiries to be used as audit evidence.
  

• Conditions that may indicate possible fraud.
  

Maintaining professional scepticism throughout the audit is necessary if the auditor is, for example, to reduce the risks of:

• Overlooking unusual circumstances.
  

• Over generalising when drawing conclusions from audit observations.
  

• Using inappropriate assumptions in determining the nature, timing and extent of the audit procedures and evaluating the results thereof.
  

5.6 Fraud

Management and those charged with governance are responsible for preventing and detecting fraud. The auditor obtains reasonable assurance that the financial statements are free of material misstatement from fraud or error. Fraud can be harder to detect because of concealment or collusion, so the auditor maintains professional scepticism and considers fraud risk in planning.