Section Audit Risk and Materiality - ASA 200 - Objective and General Principles Governing an Audit of a Financial Report - April 2006 - Audit Risk and Materiality | Zoe
ASA 200 - Objective and General Principles Governing an Audit of a Financial Report - April 2006
Audit Risk and MaterialityAudit Risk and Materiality
Start here
Get a plain-English read of Audit Risk and Materiality
Turn the raw legal text into a practical explanation grounded in ASA 200 - Objective and General Principles Governing an Audit of a Financial Report - April 2006.
30 Entities pursue strategies to achieve their objectives, and depending on the nature of their operations and industry, the regulatory environment in which they operate, and their size and complexity, they face a variety of business risks.[4] Management and those charged with governance are responsible for identifying such risks and responding to them. However, not all risks relate to the preparation of the financial report. The auditor is ultimately concerned only with risks that may affect the financial report.
31 Under ASA 500 Audit Evidence, the auditor needs to obtain and evaluate audit evidence to obtain reasonable assurance about whether the financial report gives a true and fair view or presents fairly, in all material respects, in accordance with the applicable financial reporting framework. The concept of reasonable assurance acknowledges that there is a risk the audit opinion is inappropriate. The risk that the auditor expresses an inappropriate audit opinion when the financial report is materially misstated is known as “audit risk”.[5]
32 The auditor shall plan and perform the audit to reduce audit risk to an acceptably low level that is consistent with the objective of an audit.
33 Under ASA 330 The Auditor’s Procedures in Response to Assessed Risks, the auditor needs to reduce audit risk by designing and performing audit procedures to obtain sufficient appropriate audit evidence to be able to draw reasonable conclusions on which to base an audit opinion. Reasonable assurance is obtained when the auditor has reduced audit risk to an acceptably low level.
34
Audit risk is a function of the risk of material misstatement of the financial report (or simply, the “risk of material misstatement”) (that is, the risk that the financial report is materially misstated prior to audit) and the risk that the auditor will not detect such misstatement (“detection risk”). Under ASA 315 Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement and ASA 330, the auditor needs to perform audit procedures to assess the risk of material misstatement and to seek to limit detection risk by performing further audit procedures based on that assessment. The audit process involves the exercise of professional judgement in designing the audit approach, through focusing on what can go wrong (that is, what are the potential misstatements that may arise) at the assertion level (see ASA 500 for further explanatory guidance) and
performing audit procedures in response to the assessed risks in order to obtain sufficient appropriate audit evidence
(see ASA 330 for further explanatory guidance)
.
35 The auditor is concerned with material misstatements, and is not responsible for the detection of misstatements that are not material to the financial report taken as a whole. Under ASA 320 Materiality and Audit Adjustments, the auditor needs to consider whether the effect of identified uncorrected misstatements, both individually and in aggregate, is material to the financial report taken as a whole. Materiality and audit risk are related (see ASA 320 for further explanatory guidance). In order to design audit procedures to determine whether there are misstatements that are material to the financial report taken as a whole, under ASA 315, the auditor needs to consider the risk of material misstatement at two levels: the overall financial report level and the assertion level for:
36 Under ASA 315, the auditor needs to consider the risk of material misstatement at the overall financial report level, which refers to the risk of material misstatement that relates pervasively to the financial report as a whole and potentially affects many assertions. Risk of this nature often relates to the entity’s control environment (although this risk may also relate to other factors, such as declining economic conditions), and is not necessarily risk identifiable with specific assertions at the class of transactions, account balance, or disclosure level. Rather, this overall risk represents circumstances that increase the risk that there could be material misstatements in any number of different assertions, for example, through management override of internal control. Such risk may be especially relevant to the auditor’s consideration of the risk of material misstatement arising from fraud. The auditor’s response to the assessed risk of material misstatement at the overall financial report level ordinarily includes consideration of the knowledge, skill, and ability of personnel assigned significant engagement responsibilities, including:
whether to involve experts;
the appropriate levels of supervision; and
whether there are events or conditions that may cast significant doubt on the entity’s ability to continue as a going concern.
37 Under ASA 315, the auditor needs to consider the risk of material misstatement at the class of transactions, account balance, and disclosure level because such consideration directly assists in determining the nature, timing, and extent of further audit procedures at the assertion level.[7] Under ASA 330, the auditor needs to obtain sufficient appropriate audit evidence at the class of transactions, account balance, and disclosure level in such a way that enables the auditor, at the completion of the audit, to express an opinion on the financial report taken as a whole at an acceptably low level of audit risk. The auditor ordinarily uses various approaches to accomplish that objective.[8]
38 The discussion in the following paragraphs provides an explanation of the components of audit risk. The risk of material misstatement at the assertion level consists of two components as follows:
(a) “Inherent risk” is the susceptibility of an assertion to a misstatement that could be material, either individually or when aggregated with other misstatements, assuming that there are no related controls. The risk of such misstatement is greater for some assertions and related classes of transactions, account balances, and disclosures than for others. For example, complex calculations are more likely to be misstated than simple calculations. Accounts consisting of amounts derived from accounting estimates that are subject to significant measurement uncertainty pose greater risks than do accounts consisting of relatively routine, factual data. External circumstances giving rise to business risks may also influence inherent risk. For example, technological developments might make a particular product obsolete, thereby causing inventory to be more susceptible to overstatement. In addition to those circumstances that are peculiar to a specific assertion, factors in the entity and its environment that relate to several or all of the classes of transactions, account balances, or disclosures may influence the inherent risk related to a specific assertion. These latter factors include, for example, a lack of sufficient working capital to continue operations or a declining industry characterised by a large number of business failures.
(b) “Control risk” is the risk that a misstatement that could occur in an assertion and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control. That risk is a function of the effectiveness of the design and operation of internal control in achieving the entity’s objectives relevant to preparation of the entity’s financial report. Some control risk will always exist because of the inherent limitations of internal control.
39 Inherent risk and control risk are the entity’s risks; they exist independently of the audit of the financial report. Under ASA 330, the auditor needs to assess the risk of material misstatement at the assertion level as a basis for further audit procedures, though that assessment is a judgement, rather than a precise measurement of risk. When the auditor’s assessment of the risk of material misstatement includes an expectation of the operating effectiveness of controls, under ASA 330, the auditor needs to perform tests of controls to support the risk assessment. The Auditing Standards do not ordinarily refer to inherent risk and control risk separately, but rather to a combined assessment of the “risk of material misstatement”. Although the Auditing Standards ordinarily describe a combined assessment of the risk of material misstatement, the auditor may make separate or combined assessments of inherent and control risk depending on preferred audit techniques or methodologies and practical considerations. The assessment of the risk of material misstatement may be expressed in quantitative terms, such as in percentages, or in non-quantitative terms. In any case, the need for the auditor to make appropriate risk assessments is more important than the different approaches by which they may be made.
40 “Detection risk” is the risk that the auditor will not detect a misstatement that exists in an assertion that could be material, either individually or when aggregated with other misstatements. Detection risk is a function of the effectiveness of an audit procedure and of its application by the auditor. Detection risk cannot be reduced to zero because the auditor ordinarily does not examine all of a class of transactions, account balance, or disclosure and because of other factors. Such other factors include the possibility that an auditor might select an inappropriate audit procedure, misapply an appropriate audit procedure, or misinterpret the audit results. These other factors can ordinarily be addressed through:
adequate planning;
proper assignment of personnel to the engagement team;
the application of professional scepticism; and
supervision and review of the audit work performed.
41 Detection risk relates to the nature, timing, and extent of the auditor’s procedures that are determined by the auditor to reduce audit risk to an acceptably low level. For a given level of audit risk, the acceptable level of detection risk bears an inverse relationship to the assessment of the risk of material misstatement at the assertion level. The greater the risk of material misstatement the auditor believes exists, the less the detection risk that can be accepted. Conversely, the less risk of material misstatement the auditor believes exists, the greater the detection risk that can be accepted.