Audit planning, risk assessment and materiality
What the exam tests
This domain tests risk-based audit planning, engagement scoping and materiality in a bank audit. Questions often require you to distinguish the annual audit plan from the engagement plan, and to justify scope using risk rather than habit.
Core rules and concepts
- The audit universe lists auditable entities, processes and systems. Risk assessment scores likelihood, impact, control maturity, regulatory change, prior findings and fraud exposure.
- The annual plan allocates resources to higher-risk areas and must be approved by the audit committee. It should remain flexible for emerging risks.
- Engagement planning defines objectives, scope, criteria, timing, resources and information requests. A risk and control matrix links each risk to controls and planned test procedures.
- Materiality focuses audit effort on matters that could change a decision. Internal audit materiality is not identical to external audit materiality; qualitative factors such as fraud, related-party dealings and regulatory breaches can make small amounts material.
- Tolerable error is set before testing and drives sample size and evaluation of exceptions.
Worked example
A bank has gross loans of RM12 billion and profit before tax of RM300 million. For a loan portfolio audit, the auditor sets planning materiality at RM60 million, equal to 0.5% of gross loans, and tolerable error at RM45 million. During testing, a RM2 million loan to a director-related company was approved without the required board credit committee approval. Although RM2 million is below materiality, it is qualitatively material because it involves related-party dealing and a breakdown in approval authority. The auditor expands testing of related-party loans and reports the matter.
Traps
- Copying external audit materiality without considering internal audit purpose.
- Setting scope before completing the risk assessment.
- Ignoring IT and third-party risks in the audit universe.
- Treating a small regulatory breach as immaterial without qualitative analysis.