Risk Assessment, Planning, and Materiality
This domain tests how auditors decide where to look and how much precision to demand, using risk and materiality to focus the audit.
Risk
- Audit risk = inherent risk × control risk × detection risk. Detection risk is managed through audit design.
- Risk assessment considers significance, complexity, prior findings, staff turnover, IT dependence, related parties, and fraud indicators.
- Document a risk register with likelihood and impact ratings and planned responses.
Planning and materiality
- The audit strategy and plan set objectives, scope, timeline, and resources.
- Materiality is quantitative (for example, a percentage of budget or assets) and qualitative (noncompliance, related-party transactions, public interest). There is no single statutory percentage; judgment must be documented and revisited.
- Performance materiality is set below overall materiality.
Worked example
An entity’s budget is 5,000 million tenge. Overall materiality is set at 1%, or 50 million. A 30 million payment to a related party is below that, but conflict-of-interest and corruption indicators make it qualitatively material. The team lowers performance materiality for procurement to 15 million and expands testing. At completion, a 40 million unrecorded liability is judged material because it changes the surplus/deficit result.
Traps
- Setting materiality once and never revising it.
- Using one threshold for every audit and every assertion.
- Dismissing a below-threshold fraud indicator without qualitative analysis.