Auditing and Internal Control
Auditing and Internal Control tests how an auditor obtains reasonable assurance and how an organisation designs controls that prevent or detect material misstatement. Expect audit risk, assertions, evidence, sampling, internal control frameworks and reporting.
Risk and materiality
Audit risk is the risk of an inappropriate opinion and is the product of inherent, control and detection risk. Detection risk is the auditor's lever: lower acceptable detection risk means more or better substantive work. Materiality is a matter of judgement, often benchmarked to profit before tax (commonly 5%) or revenue (commonly 0.5–1%). Performance materiality is set below overall materiality to leave room for undetected misstatement; the clearly trivial threshold sits lower again.
Evidence and controls
Evidence is more reliable when obtained from independent external sources, when documentary rather than oral, and when generated under effective controls. Tests of controls support a lower assessed control risk; substantive procedures address assertions directly. The COSO framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring.
Worked example
Profit before tax is 2,000,000 and the benchmark is 5%, giving materiality of 100,000. Performance materiality is set at 75%, giving 75,000, and the clearly trivial threshold at 5% of materiality, giving 5,000. An uncorrected misstatement of 60,000 is below materiality but above performance materiality; the auditor accumulates it, considers it with other misstatements, and evaluates whether the total could reasonably influence users. A single 60,000 error would not by itself cause an adverse opinion, but a pattern of similar errors might.
Control deficiencies
The same clerk creating vendors and approving invoices is a segregation-of-duties deficiency. An owner review of the vendor master file can be a compensating control, but it must be timely, documented and performed by someone with the knowledge to spot anomalies.
Traps
Treating low inherent risk as a reason to skip substantive work. Confusing sampling risk with non-sampling risk. Concluding that individually immaterial misstatements can be ignored in aggregate. Relying on a test of control when the assertion needs substantive evidence. Confusing a modified opinion with an emphasis-of-matter paragraph.