Audit and Assurance: Risk, Materiality, and Evidence
Audit and Assurance tests the risk-based audit process from acceptance to reporting. Core 1 expects you to assess risk, design procedures, evaluate evidence and misstatements, and apply independence rules, with attention to the auditor's report and going concern.
The audit risk model and planning
- Audit risk = inherent risk × control risk × detection risk. Detection risk is the auditor's lever; lower acceptable detection risk means more substantive testing.
- Set materiality using a benchmark (often 5% of profit before tax, or 1% of revenue/assets). Performance materiality is lower, commonly 50–75% of materiality, to leave room for undetected misstatements.
- Obtain understanding of the entity and its controls, then identify significant risks, including fraud and management override.
- Evidence must be sufficient and appropriate; external evidence is generally stronger than internal evidence.
Worked example: materiality and misstatements
Profit before tax is $2,000,000. Materiality at 5% = $100,000. Performance materiality at 75% = $75,000. Clearly trivial threshold = 5% of materiality = $5,000.
During the audit, you find three uncorrected misstatements: $40,000, $35,000, and $15,000, totaling $90,000. Individually, each is below materiality, but the aggregate is $90,000, close to materiality and above performance materiality. Reasoning: request correction; if management refuses, evaluate qualitatively (trend, covenant impact) and consider whether the aggregate misstatement is material. The $90,000 total is not automatically material, but it cannot be dismissed. Document the evaluation and communicate to those charged with governance. The auditor's report states whether the financial statements are presented fairly; a qualified opinion is required when misstatements are material but not pervasive. The report also addresses going concern when substantial doubt exists and key audit matters for listed entities.
Traps that cost marks
- Confusing inherent and control risk with detection risk.
- Using performance materiality as the overall materiality threshold.
- Concluding controls operate effectively without testing them.
- Failing to cumulate misstatements and evaluate qualitative factors.
- Missing the subsequent-events window and going-concern indicators.
- Ignoring independence threats such as self-review or familiarity.