Engagement Planning and Risk Assessment
Planning establishes the overall audit strategy and a detailed audit plan. Under ASA/ISA 300, the auditor must establish materiality, identify significant risks, and determine the nature, timing and extent of procedures. Planning is not a single event; it evolves as the audit progresses.
Materiality (ASA/ISA 320) has three levels: overall materiality (often a benchmark such as profit before tax, revenue or total assets), performance materiality (lower, to reduce aggregation risk), and specific materiality for particular classes of transactions or disclosures. Understand that materiality is a matter of professional judgement and can change as the audit proceeds.
Risk assessment (ASA/ISA 315) requires understanding the entity and its environment, including internal control, to identify and assess risks of material misstatement at the financial statement and assertion levels. Distinguish inherent risk (susceptibility before controls) and control risk (risk controls fail to prevent/detect). Significant risks often involve judgement, complex transactions, related parties, or fraud.
Traps: confusing performance materiality with overall materiality; assuming planning is complete before fieldwork; treating risk assessment as static; and forgetting to link identified risks to specific audit procedures (the risk-response linkage).
Rule of thumb: every significant risk must have a documented, tailored response. If a procedure is not linked to a risk, question why it is being performed.