Planning and Risk Assessment
Materiality and risk
Planning begins with materiality. Performance materiality is set below overall materiality to leave a buffer for undetected misstatements. Candidates must apply the audit risk model: Audit risk = Inherent risk × Control risk × Detection risk. Detection risk is the auditor's lever - lower it by doing more substantive work.
Understand the risk assessment procedures: enquiries of management, analytical procedures, and observation/inspection. Then link significant risks (e.g. complex transactions, estimates, related parties) to planned responses.
Understanding the entity
Know the business: industry, regulation, accounting policies, IT environment, and internal control components (control environment, risk assessment, control activities, information and communication, monitoring).
Worked example
A retailer with a large year-end inventory and thin margins: inventory is likely a significant risk (valuation, existence). Response: attend the count, test net realisable value, and increase sample sizes.
Traps
- Thinking inherent risk can be reduced by the auditor - it cannot; only detection risk is controlled.
- Confusing materiality with a fixed percentage; it is a judgement.
- Forgetting that planning is iterative, revised as evidence emerges.
- Missing that analytical procedures are required at planning and at the review stage.