An auditor cannot test everything. The first big decision is where to look for evidence, and that decision is the audit strategy. A client with weak controls needs a different approach from one with strong controls, and a large listed company needs a different approach from a one-person business.
This topic covers the four audit strategies, the factors that decide which one to use, and the business risk approach favoured by larger firms. Examiners ask you to define an audit strategy, list the factors in choosing one and apply them to a case. In the November 2025 diet this was worth 5 marks, and the case turned on a team that relied on weak controls it had not tested.
In 30 seconds
An audit strategy is the overall approach the auditor decides to take, from which the detailed audit plan is built. Four are available: the business risk (risk-based) approach, the systems-based approach, substantive testing, and the statement of financial position approach, which is mainly for small entities. They are not exclusive and are often combined.
The choice depends on the nature and size of the client, the control environment and controls, and the firm’s own methods, and in practice on the assessed risk of material misstatement, cost against benefit, complexity, the information technology (IT) environment and materiality. The business risk approach is top-down: identify the key business risks, assess their effect on the financial statements and plan the audit around them.
Risks are ranked by impact and likelihood. The approach builds deep knowledge of the client and suits large clients, but needs experienced staff and may raise questions about independence.
What an audit strategy is
An audit strategy is the overall approach the auditor takes to an audit. The detailed audit plan is developed from it. The strategy describes the emphasis of the audit, which means where the auditor expects to find most of the evidence needed to give an opinion on whether the financial statements give a true and fair view.
Four strategies are available:
- the business risk (or risk-based) approach;
- the systems-based approach;
- the substantive testing approach; and
- the statement of financial position approach, usually for small entities.
The strategies are not mutually exclusive. Most of the work on one audit may be systems-based, yet the auditor will still carry out some substantive testing on balances and transactions. The strategy tells you the main source of evidence, not the only one.
The four strategies compared
| Strategy | What the auditor concentrates on | Where it suits | Main weakness |
|---|---|---|---|
| Substantive testing | Testing a large number of recorded transactions and account balances directly | Weak or non-operating controls; smaller entities | Slow and costly for large clients. It tests what is recorded, so understatements and unrecorded items can be missed. Time may go on items that are not material |
| Systems-based | Testing the controls in the systems that produce the figures, supported by some substantive testing and analytical procedures | A strong control environment and controls that operate | Cheaper than full substantive testing, but there is a danger of over-auditing areas where controls work well. It fails if the controls do not actually operate |
| Business risk (risk-based) | Assessing the likelihood of material misstatement in each area. High-risk areas get extensive work (substantive tests, systems testing and analytical procedures). Low-risk areas get little | Large and complex clients; firms with industry knowledge | Needs experienced staff and detailed knowledge of the client. May be effective only on larger audits |
| Statement of financial position | Substantive testing of balances rather than transactions | Small companies; entities whose assets and liabilities are large compared with their transactions, such as investment companies | Rests on the idea that correct opening and closing net assets mean a correct profit |
Background: The weakness shown for the statement of financial position approach is a practical point. Two errors in balances can cancel out, and a classification error between income and expense items does not change net assets at all.
Factors in the choice of strategy
The syllabus gives three factors. Examiners reward a longer list, so learn all eight below and tie each one to the facts in the case.
- The nature and size of the client. A business risk approach suits large companies. A statement of financial position approach is usually most suitable for small ones.
- The control environment and internal controls. A strong environment and controls that work support a systems-based approach. Weak controls, or a management that does not care about control, push the auditor towards substantive testing.
- The methods and techniques the firm favours. Larger firms often prefer a business risk approach and have industry specialists to support it.
- The risk of material misstatement. If the assessed risk at assertion level is high, the auditor needs more substantive evidence. If it is low and controls are reliable, reliance on controls becomes possible.
- Cost against benefit. For large volumes of automated transactions, testing controls is usually cheaper than testing every item.
- The nature and complexity of operations. Complex transactions, estimates and manual records mean high inherent risk, so more substantive work.
- The IT environment. A reliable automated system can support control reliance. Manual records and outdated software lower the reliability of controls.
- Materiality. Work is directed at items that could matter to users, and the level set affects how much testing is needed.
Background: Factors 4 to 8 come from the November 2025 model solution and from International Standard on Auditing (ISA) 330, under which the auditor’s responses depend on the assessed risks. The syllabus describes risk and controls inside each strategy but does not list them as factors.
How audit practice developed
Audit approaches changed because clients changed. Two reasons drove the change. Businesses became larger and more complex, and firms wanted a more efficient audit.
- The early emphasis was on substantive testing of transactions and balances.
- The systems-based approach then concentrated on internal control systems and relied far less on substantive testing.
- The risk-based audit followed. The auditor puts most of the work into areas where overall audit risk is high. Audit risk is the combination of inherent risk, control risk and detection risk.
- Larger firms then developed the business risk approach, which looks at the client’s business first and the accounts second.
Each stage kept the tools of the one before. A modern audit uses all of them in different proportions.
The business risk approach
Business risk is the threat that an event or development will harm the entity’s ability to achieve its objectives. Typical examples are the loss of a major customer or a sharp rise in the cost of a key commodity. Business risks are faced by the client’s management. They can affect the financial statements, including the going concern assumption.
Under the business risk approach the auditor looks at the business as a whole and evaluates the risks it is exposed to. The general method has three steps:
- identify the key business risks;
- evaluate their possible impact on the financial statements; and
- plan the audit around those key risks.
Four features of the approach are worth knowing.
- It is top-down. It starts at the top with the business, which generates the transactions, and ends at the bottom with the financial statements, which record the outcome. The business drives the financial statements.
- It starts earlier than the audit risk model. By understanding the business first, the auditor gains a better view of the inherent risks and control risks that the model later measures.
- It depends on knowing the client. ISA 315 already requires an understanding of the entity and its environment. Large firms that use the approach often form industry groups, call on industry experts or keep industry databases.
- It looks forward. The auditor must consider possible future developments as well as the present position. The auditor cares about business risk only because of its likely effect on the financial statements.
External business risks
These arise from the environment in which the company operates. Examples:
- loss of a major contract after a dispute with the customer;
- long-term decline in demand, with no investment in new products;
- a new competitor entering the market;
- changes in law or regulation, such as the withdrawal or non-renewal of a licence needed to operate;
- new technology;
- changes in the economy, such as interest rates, exchange rates or a recession;
- natural hazards such as flooding that stop the business operating; and
- threats from competitors to patents or copyrights.
Internal business risks
These arise from inside the company. Examples:
- ineffective employees or weak management;
- poor attention to customer needs, which eventually reduces sales;
- poor financial management, such as high gearing, weak cash management and poor working capital control;
- lack of finance to replace or modernise equipment;
- system weaknesses or failures, which are internal control weaknesses;
- over-reliance on one or two key individuals; and
- fraud or misappropriation of assets.
Both lists are examples, not complete lists. In the exam you read a scenario and pick out the risks from the facts. Then you explain how each affects the company’s ability to meet its objectives and how it affects the audit. Some facts in a case are not worth an auditor’s attention, such as the quality of staff meals or a routine insurance policy. Do not waste time on them.
Ranking business risks
Not all risks matter equally. The significance of a risk to the auditor depends on two things:
- Impact. How big the effect on the financial statements would be if the event happened. In audit terms this is close to materiality.
- Likelihood. How probable it is that the event happens.
| High likelihood | Low likelihood | |
|---|---|---|
| High impact | Category 1: most audit attention | Category 2: ranked by judgement |
| Low impact | Category 3: ranked by judgement | Category 4: least attention |
The model is used widely in management and strategy and is not an audit model as such. Most audit emphasis goes to Category 1. Categories 2 and 3 are ranked using the auditor’s judgement.
Management has four possible responses to a risk: reduce it with more controls, transfer it (for example by insurance), avoid it by leaving the activity, or accept it. The auditor is interested in how management responded, because the response shapes the risk that is left.
Business risk and financial statement risk
Business risk is the risk that the entity will fail to meet its objectives. Financial statement risk is the risk that the financial statements will fail to give a true and fair view because of misstatements or omissions. The two are closely linked. If management does not deal with a significant business risk, items in the financial statements may be wrong.
A weakness in internal control is itself a business risk that may lead to misstatement.
| Business risk | Possible financial statement risk |
|---|---|
| Falling demand for the main product | Inventory overstated because net realisable value is below cost; production assets impaired; doubt over going concern |
| Loss of a major customer | Receivables from that customer not recoverable; revenue and going concern in doubt |
| A plant operating without a licence the law requires | The plant may have to close, so its carrying amount is overstated; a provision may be needed for fines |
| Large foreign currency loans and a weaker naira | Liabilities understated; higher finance costs; a loan covenant may be breached |
| Weak internal controls | Errors or fraud not prevented or detected; unrecorded transactions |
Both risks must be assessed, so that the auditor can tell which parts of the financial statements are most likely to be misstated. A later topic deals with this link in detail.
Advantages and disadvantages of the business risk approach
Advantages
- Deep knowledge. The auditor must learn the client’s business in depth, which improves the judgement made about the financial statements.
- Keeps up with change. When the environment is changing fast, the approach keeps the auditor up to date.
- Targets real problems. Evidence suggests that major audit problems come more often from business problems than from internal control weaknesses.
- Adds value. The auditor can make useful recommendations to improve the client’s performance.
- May lower cost. There is less testing, which saves time, especially the time of junior staff.
- Helps the firm. A modern approach can set the firm apart from competitors.
Disadvantages
- Needs experienced staff. Partners and managers are expensive, which can offset the saving on junior time.
- Independence. Closer involvement in the client’s business may raise questions about the auditor’s independence.
- Uneasy auditors. Some auditors think the broad view is less suitable for reaching an opinion than a systems view.
- Larger clients only. The approach may be effective only for the audit of bigger companies.
The rules in more depth
Why strategies are combined
No strategy gives enough evidence alone. Under ISA 330, whatever the assessed risks, the auditor must design and perform substantive procedures for each material class of transactions, account balance and disclosure. So even a heavily systems-based audit includes substantive testing. The strategy sets the balance between controls testing and substantive testing. It does not remove either.
Why weak controls rule out control reliance
Relying on controls means expecting them to operate effectively. The auditor must test that they do. If the client’s records are manual, the software is outdated and one person does several jobs, there is little basis for expecting the controls to work. Relying on them anyway, without tests, leaves misstatements undetected, and that is audit failure. When controls are weak, the sound strategy is a substantive one.
Why independence is a concern
The business risk approach asks the auditor to advise on risk and performance. That is useful to the client, but it moves the auditor closer to management. Earlier topics explain the self-review and advocacy threats. The auditor must keep recommendations to the client within what the ethical rules allow.
Why the approach starts before the risk model
The audit risk model measures inherent, control and detection risk for each balance. The business risk approach asks first what could go wrong in the business. The answers tell the auditor where inherent risk is likely to be high and which controls matter most. It sharpens the model rather than replacing it.
Worked example: choosing and justifying a strategy
Scenario. Afam and Co is planning the audit of Kano Grain Mills Plc, a listed company with revenue of ₦22 billion and three mills. Four national distributors take 70% of sales. Maize, the main raw material, is partly imported, so its cost moves with the weather and the exchange rate. The audit committee is active and internal audit tests the sales and inventory controls every quarter.
A new enterprise resource planning (ERP) system was installed in March. In July one mill was shut for three weeks after a fire. A bank loan carries a covenant on the current ratio. (a) Recommend an audit strategy and justify it. (b) Identify and rank two business risks and state the related financial statement risks.
- Framework. Kano is large, listed and complex, and has sector risks. A business risk approach is the natural framework, because the auditor should understand the risks first and direct the work to them.
- Controls. A strong audit committee and active internal audit support a systems-based approach to sales and inventory. The ERP is new, so controls for January to March, before it went live, were different and the new controls are unproven. The auditor should walk through the new system, test the controls and increase substantive testing for the early months.
- Substantive work. Substantive procedures are still needed on every material balance, and extra work on the fire-damaged mill: inventory, damaged assets and any insurance claim.
- Not suitable. The statement of financial position approach is wrong for a large client with many transactions.
- Risk 1: raw material cost and exchange rate. External, high impact and likely, so Category 1. Financial statement risks: inventory valued above net realisable value, foreign currency payables mistranslated, margins overstated.
- Risk 2: dependence on four distributors. External, high impact but less likely, so Category 2. Financial statement risks: receivables not recoverable, and disclosure of concentration. If a major distributor was lost, going concern would be in question.
- Also note. The covenant is a financial risk. If it is breached, the loan may need reclassifying as current and going concern considered.
Conclusion. Use a business risk framework, rely on controls only where tested, and apply substantive procedures to every material balance, with extra work on inventory, receivables and the loan.
How to score full marks
- Define first. A one-sentence definition of audit strategy earns the opening mark.
- Give the factor, then the reason. A bare list scores half marks. “Weak controls, so a substantive approach” scores in full.
- Apply to the case. Use the facts: manual records, a new system, the size of the client.
- When asked to choose a strategy, name one, say why, and say what else you will do alongside it.
- For business risks, work from the scenario. Quote the key phrase, name the risk and give its financial statement effect.
- Keep the risks apart. Business risk belongs to the entity. Audit risk belongs to the auditor.
- Time. Spend time in proportion to marks, about two minutes for each mark.
Common mistakes in the exam
- Saying the strategies are alternatives that exclude each other.
- Recommending control reliance without saying that the controls must be tested first.
- Giving the factors with no link to the case.
- Confusing business risk with audit risk.
- Listing business risks that have no effect on the financial statements.
- Forgetting that the business risk approach raises an independence question.
- Applying the statement of financial position approach to a large client.
Quick revision
- Audit strategy: the overall approach, from which the audit plan is built.
- Four strategies: business risk, systems-based, substantive, statement of financial position. Often combined.
- Factors: nature and size; control environment and controls; the firm’s methods; and in practice risk of material misstatement, cost against benefit, complexity, IT environment and materiality.
- Business risk approach: identify key business risks, evaluate their effect on the financial statements, plan the audit around them. Top-down.
- Rank risks by impact and likelihood: Category 1 gets most attention.
- Advantages: knowledge, up to date, targets real problems, adds value, may cut cost. Disadvantages: needs expert staff, independence, uneasy auditors, large clients only.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. Which strategy concentrates on testing balances rather than transactions, on the argument that correct opening and closing net assets mean a correct profit?
- Systems-based approach
- Statement of financial position approach
- Business risk approach
- Test of controls approach
Show the answer
B. It is wholly substantive and suits small entities.
Question 2. Which statement about audit strategies is correct?
- They are mutually exclusive
- They are often used in combination
- Only large firms may use more than one
- The client chooses the strategy
Show the answer
B. A systems-based audit still includes some substantive testing.
Question 3. Which strategy is usually best suited to a large company?
- Statement of financial position approach
- Business risk approach
- Testing every transaction
- No strategy is needed
Show the answer
B. The statement of financial position approach is usually for small companies.
Question 4. Business risk is best described as:
- The risk that the auditor gives the wrong opinion
- The threat that an event or development will harm the entity’s ability to achieve its objectives
- The risk that controls will fail to detect an error
- The risk that a sample is not representative
Show the answer
B. A is audit risk, C is control risk and D is sampling risk.
Question 5. Which of the following is an internal business risk?
- A new competitor entering the market
- A rise in interest rates
- Over-reliance on one or two key individuals
- Flood damage to a factory
Show the answer
C. The others come from outside the company.
Question 6. In the risk ranking model, a risk with high impact and high likelihood is:
- Category 1
- Category 2
- Category 3
- Category 4
Show the answer
A. It gets most audit attention.
Question 7. Which is a disadvantage of the business risk approach?
- It gives the auditor little knowledge of the client
- Closer involvement with the client may raise questions about independence
- It cannot be combined with other strategies
- It always raises audit cost
Show the answer
B. It also needs experienced staff.
Question 8. If the auditor judges that the client’s controls are weak, the strategy most likely to be chosen is:
- Reliance on controls with few tests
- Substantive testing
- No testing
- A reduced audit
Show the answer
B. Weak controls cannot be relied on.
Question 9. The business risk approach is sometimes called a:
- Bottom-up approach
- Top-down approach
- Sideways approach
- Circular approach
Show the answer
B. It starts with the business and ends with the financial statements.
Question 10. Which is an advantage of the business risk approach?
- It keeps the auditor up to date when the business environment changes quickly
- It needs no experienced staff
- It removes the need for substantive testing
- It guarantees that no misstatement exists
Show the answer
A. The auditor must keep learning about the business.
Written questions
Question 11 (10 marks). Explain the audit strategies available to an auditor and the factors the auditor considers in choosing between them.
Question 12 (20 marks). (a) Explain the business risk approach to an audit. (5 marks) (b) Give examples of external and internal business risks facing a manufacturer. (5 marks) (c) Explain how business risks are ranked. (4 marks) (d) Discuss the advantages and disadvantages of the business risk approach. (6 marks)
Question 13 (10 marks). Ngozi and Co is the auditor of Zenith Logistics Ltd, a listed company with 600 vehicles, three depots, automated fleet and billing systems, an internal audit team and an active audit committee. The audit senior proposes to audit only the closing statement of financial position, because last year’s audit found no misstatements. The partner doubts that this is right.
Advise the partner on the senior’s proposal and on the strategy that should be used. (10 marks)
Model answers
Show the model answer to Question 11
Audit strategy. The overall approach the auditor decides to take, from which the detailed audit plan is developed. (1)
Strategies available. The business risk (risk-based) approach plans the audit around key business risks and their effect on the financial statements. The systems-based approach tests the controls in the systems that produce the figures. The substantive approach tests transactions and balances directly. The statement of financial position approach tests balances, on the basis that correct opening and closing net assets mean a correct profit, and suits small entities. The strategies can be combined. (4, 1 each)
Factors in the choice. The nature and size of the client; the control environment and internal controls; the methods favoured by the firm; the assessed risk of material misstatement; cost against benefit; the complexity of operations; the IT environment; and materiality. Each is given with its reason. (5, any five at 1 each)
Show the model answer to Question 12
(a) The approach (5 marks). Business risk is the threat that an event or development will harm the entity’s ability to achieve its objectives. (1) The auditor identifies the key business risks, evaluates their effect on the financial statements and plans the audit around them. (1.5) It is a top-down approach: it starts with the business, which generates the transactions, and ends with the financial statements.
(1) It needs a good understanding of the client and its environment, as ISA 315 requires, and large firms use industry groups and experts. (1) The auditor looks at future developments too, and cares about business risk for its effect on the financial statements. (0.5)
(b) Examples for a manufacturer (5 marks). External:
- loss of a major customer
- falling demand
- a new competitor
- changes in law or in licence terms
- new technology
- exchange rate and interest rate changes
- flood or fire
(2.5, any five at 0.5) Internal: weak management or staff; poor customer care; poor cash and working capital control; no money to replace equipment; system failures and control weaknesses; reliance on one or two key people; fraud. (2.5, any five at 0.5)
(c) Ranking (4 marks). Risks differ in importance. Impact is the size of the effect on the financial statements, close to materiality. (1) Likelihood is the probability that the event occurs. (1) A matrix of high and low impact against high and low likelihood gives four categories. (1) Category 1 (high and high) gets the most attention, Category 4 the least, and Categories 2 and 3 are ranked by judgement. (1)
(d) Advantages and disadvantages (6 marks). Advantages:
- deep knowledge of the client
- keeps the auditor up to date in a changing environment
- major problems often come from business causes
- the auditor can add value by recommendations
- may reduce cost because there is less testing
- distinguishes the firm
(3, any three at 1) Disadvantages: needs experienced and costly staff; closer involvement may raise independence questions; some auditors prefer a systems view; may suit only larger audits. (3, any three at 1)
Show the model answer to Question 13
Why the proposal is wrong (3 marks). The statement of financial position approach is wholly substantive and tests balances. It suits small entities, or those whose assets and liabilities are large compared with transactions. (1) Zenith is large, listed and has a very large volume of transactions, so testing only closing balances is not enough.
(1) Errors in balances can offset each other, and errors in the classification of income and expenses would not show up in net assets. (1)
Factors pointing to another strategy (5 marks). Size and nature: a large, complex client suits a business risk approach. (1) Controls and environment: an active audit committee and an internal audit team support reliance on controls, subject to testing. (1.5) IT: automated systems for fleet and billing can have reliable programmed controls. (1) Cost against benefit: testing controls over high volumes is cheaper than testing items.
(1) Last year’s clean audit is not evidence for this year. Risk must be assessed again, because the business and its risks may have changed. (0.5)
Recommended strategy (2 marks). Use a business risk approach as the framework, with a systems-based audit of the main transaction cycles after walk-throughs and tests of controls. (1) Add substantive procedures on every material balance and extra work on high-risk areas such as vehicles, impairment and revenue. (1)
Pathfinder on audit strategies and the business risk approach
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
A client with manual records and outdated software was audited on a control-reliance basis, with no proper tests of the controls, an over-high materiality level and an underestimated obsolescence risk. You define an audit strategy and explain the factors in choosing one (5 marks). Part (b), on the reliability of audit evidence, is covered in the topic on audit evidence.
Revise first: Factors in the choice of strategy
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
