Audit Planning, Risk Assessment and Internal Control
What to master
Planning under ISA 300 establishes strategy, materiality, and direction. ISA 315 (Revised) requires understanding the entity, its environment, and its system of internal control (control environment, risk assessment, control activities, information/communication, monitoring). Candidates must distinguish inherent risk, control risk, and detection risk, and understand the audit risk model: AR = IR × CR × DR. Know how to identify significant risks, understand the entity's IT environment and general IT controls, and use analytical procedures as risk assessment (ISA 315) versus substantive testing (ISA 520).
Traps in exam questions
- Confusing risk assessment with risk response (ISA 315 vs ISA 330).
- Treating detection risk as controllable by the client - it is controlled by the auditor through the nature, timing, and extent of procedures.
- Assuming strong controls eliminate the need for substantive procedures; controls only reduce control risk.
- Overlooking fraud risk (ISA 240) and related-party considerations during planning.
- Forgetting that materiality is set at planning and revised as the audit progresses.
Rule of thumb
When a question gives you a scenario and asks "what should the auditor do next?", locate it in the cycle: understand → assess risk → design response → perform → evaluate. Match the ISA to the stage.
Worked example
A company has a high-volume, automated sales system. Under ISA 315, the auditor identifies IT general controls and automated application controls as relevant; if reliance on controls is planned, ISA 330 requires tests of controls; otherwise substantive procedures are increased to lower detection risk.