AUD - Audit Risk, Evidence, and Reporting
The audit risk model is the spine of AUD
Audit risk (AR) is the risk the auditor issues an unmodified opinion on materially misstated statements. AR = RMM × DR, where RMM = IR × CR. Rearranged, DR = AR ÷ (IR × CR). Detection risk is the only component the auditor controls, and it moves inversely with assessed risk: the riskier the client, the lower the acceptable detection risk, and the more substantive testing is required.
Assertions drive procedure design
Separate transaction assertions (occurrence, completeness, accuracy, cutoff, classification) from balance assertions (existence, completeness, rights and obligations, valuation, presentation). Completeness questions point to tracing from source documents forward to the ledger; existence questions point to vouching backward from the ledger to source documents.
Evidence and opinions
Sufficiency = quantity; appropriateness = relevance plus reliability. Reliability ranking: auditor's direct knowledge > external documents > internal documents (stronger when controls are effective) > oral representations. The opinion maps to two dimensions - materiality and pervasiveness - yielding unmodified, qualified, adverse (misstatement) and disclaimer (scope limitation).
Traps: candidates assume effective internal controls reduce detection risk. They do not - they reduce assessed RMM, which raises allowable detection risk and shrinks substantive work. Also distinguish a review (inquiry and analytics, negative assurance) from an audit, and remember SOC 1 covers controls relevant to financial reporting while SOC 2 addresses trust-services criteria.
Rule of thumb: more assessed risk → more work, more reliable evidence, more experienced staff.
Worked example: AR = 5%, IR = 100%, CR = 50%. RMM = 1.00 × 0.50 = 50%. DR = 0.05 ÷ 0.50 = 10%. Plan substantive procedures so undetected misstatement risk does not exceed 10%.