Audit & Assurance: Risk, Evidence and Internal Control
What the exam tests in audit and assurance
This domain tests how assurance is obtained and how risk drives the audit response. You need to link business risk to audit risk, choose procedures that address assertions, and understand internal control and reporting.
Core rules and concepts
- Audit risk = inherent risk × control risk × detection risk. The auditor assesses inherent and control risk; detection risk is managed through the nature, timing and extent of procedures.
- Materiality is a matter of professional judgement; performance materiality is set below overall materiality to reduce the probability that uncorrected misstatements exceed it.
- Assertions include occurrence, completeness, accuracy, cut-off, classification, existence, rights and obligations, valuation and allocation.
- Evidence must be sufficient and appropriate. External confirmation is generally stronger than internal inquiry; inspection of documents is stronger than verbal representation.
- Internal control relies on segregation of duties, authorisation, reconciliations, physical controls and IT general controls.
- Going concern assessment considers forecasts, covenants, liquidity and support letters; inadequate disclosure is a reporting issue.
Worked example
A manufacturer holds £4m of inventory. Demand for one product line has fallen sharply and the client has not written down slow-moving stock. The key assertion is valuation. Risk: inventory is overstated because net realisable value (NRV) may be below cost. Reasoning: attend the year-end count to test existence and condition; obtain the aged stock report and test the ageing to sales invoices; compare cost with post-year-end selling prices less costs to complete and sell; recalculate the NRV write-down. If the client refuses to adjust a material amount, modify the audit opinion.
Traps that cost marks
- Saying detection risk is reduced by stronger controls; controls affect control risk, not detection risk directly.
- Relying on inquiry alone as sufficient evidence.
- Testing existence when the risk is valuation or cut-off.
- Treating a management representation as a substitute for other evidence.