Assessing Risk and Developing a Planned Response
What the exam tests here
This domain covers the risk assessment standards: understanding the entity and its environment, identifying and assessing risks of material misstatement (RMM) at the financial statement and assertion levels, and designing a planned response. Know the audit risk model: AR = IR × CR × DR, and that detection risk is the auditor's lever. Higher assessed RMM means lower acceptable detection risk, which means more substantive work and less reliance on controls.
Key concepts: inherent risk factors (complexity, subjectivity, fraud, related parties, significant unusual transactions), control risk and the understanding of the entity's internal control, significant risks, and the concept of assertions (existence, completeness, rights and obligations, valuation, presentation). Also know materiality (overall, performance, and clearly trivial thresholds) and how it drives the nature, timing, and extent of procedures.
Traps
Questions often confuse inherent risk (client-driven) with detection risk (auditor-driven). Another trap: concluding that a strong control environment means controls can be relied upon without testing-reliance requires testing operating effectiveness. Watch for the assertion-level trap: a risk may be significant for one assertion (e.g., valuation of inventory) but not others. Also remember that risk assessment is iterative and continues throughout the audit.
Rule of thumb
If a risk is assessed as high, the response must be substantive: increase extent, shift timing to year-end, and use more reliable (external, corroborative) evidence. Never respond to high risk by simply documenting more.
Worked example
A client with complex revenue contracts and a history of restatements has high inherent risk. The auditor sets control risk high (no reliance), lowers detection risk, and expands substantive testing of revenue cut-off and contract terms.