A scenario question gives you a page of facts about a company and asks what could go wrong in its financial statements. The skill is to turn each fact into a risk the auditor must plan for. This topic shows how business risk becomes financial statement risk, which risks recur in exam cases, and how the auditor responds to the risks it assesses.
The examiner marks you on the link. A comment about a business problem earns nothing if you do not say which figure in the financial statements it could distort. Practise the two-step method in this topic until it is automatic, because it also serves the group audit, fair value and going concern questions.
In 30 seconds
Business risk is a risk management must deal with. Where its probability and its financial effect are both low, it is acceptable and management may do nothing. Where the financial effect could be high, management chooses to reduce, transfer, avoid or accept the risk. For the auditor, a business risk matters because of the financial statement risk it creates.
Business risk can lead to financial statement risk, and financial statement risk drives audit risk. In exam answers, read the scenario for key words, name the business risk, then state the financial statement risk and what the auditor should test. Typical financial statement risks are overstated revenue, overstated current assets, overstated non-current assets, understated liabilities, understated operating expenses, unreliable estimates, and failure to follow accounting standards.
Under International Standard on Auditing (ISA) 330 the auditor responds with overall responses and with procedures at assertion level, and always performs substantive procedures on each material class of transactions, balance and disclosure.
From business risk to audit risk
Business risk is any risk that threatens the entity’s ability to achieve its objective, which is usually to maximise profit or wealth. Anything that threatens that objective is a risk that profits will be lower. In an extreme case losses may be so large that the going concern basis is in doubt.
Acceptable and applicable risks
Business risks fall into two groups.
- A risk with a low probability, or a small loss if the event happens, is acceptable. The cost of controls to reduce it would not be justified by the benefit.
- A risk whose financial effect could be high is applicable. Management must choose a plan to manage it.
For an applicable risk, management has four strategies:
- Reduce the risk by introducing more internal controls.
- Transfer the risk, for example by insuring against it.
- Avoid the risk entirely by withdrawing from the operations it relates to.
- Accept the risk and take no action to reduce or transfer it.
The chain of risks
For the auditor, the importance of business risk lies in the effect it could have on the financial statements. Most business risks make a material misstatement more likely. The chain runs like this:
- Business risk could lead to financial statement risk.
- Financial statement risk affects audit risk.
- Audit risk results from inherent risk, control risk and detection risk.
Audit risk follows from financial statement risk, so the auditor assesses financial statement risks as a step towards assessing audit risk. Some business risks do not create any specific financial statement risk. They may still lead to going concern problems, so the auditor cannot ignore them.
Linking business risk to financial statement risk
Some pairs recur in almost every case. Learn this table.
| Business risk | Financial statement risk |
|---|---|
| Customers in financial difficulty, or a major customer lost | Understated bad debts or allowance for doubtful debts, so receivables and profit are overstated |
| Falling demand or rapid obsolescence of products (for example, high-tech goods) | Inventory valued above net realisable value |
| Damage to a building, or a plant that may have to close | Non-current assets overstated because impairment has not been recognised |
| Penalties, warranties, redundancies, onerous leases or breached contracts | Provisions missing, so liabilities are understated |
| A fire loss that is insured | A provision made for repairs, with the insurance recovery ignored, which understates profit and other receivables |
| Staged payments or deposits received in advance | Revenue recognised when cash is received and not when the performance obligation is met (IFRS 15) |
| A sharp fall in the ratio of administrative costs to sales while sales rise | Operating expenses understated |
| Reliance on management judgement | Material accounting estimates misstated |
| Operations stopped or being sold | Going concern basis inappropriate, and assets held for sale and discontinued operations presented wrongly |
The syllabus lists seven families of financial statement risk to look for: overstated revenue or other income, overstated current assets, overstated non-current assets, understated liabilities, understated operating expenses, risks from accounting estimates, and failure to comply with specific accounting standards such as those on contingent liabilities, deferred tax, share-based payments and related parties.
The two-step method for scenario questions
- Find the key words. Underline the facts in the scenario that point to a risk: a licence, a deposit paid in advance, an old asset, a new system, a shutdown, a dispute.
- Write the risk, then its effect. Name the business risk in half a sentence. Then state the financial statement risk, which means the figure or disclosure that may be misstated and in which direction. Finish with what the auditor should test.
Three rules come from how the marks are given.
- If the question asks for financial statement risks, a comment about a general business risk earns no marks unless you link it to the financial statements.
- If the question asks for business risks first and financial statement risks second, do not bring in new risks in part two. Take each risk from part one and link it.
- Risks must be specific to the client. A general remark about misstatement that could apply to any company earns nothing.
Some facts in a case are not worth the auditor’s time. A routine insurance policy, the quality of staff meals or a small over-booking problem may be noise. Pick the facts that could affect a material figure.
Responding to assessed risks: ISA 330
Once risks are identified and assessed, under ISAs 300 and 315, the auditor designs and carries out responses under ISA 330 The auditor’s responses to assessed risks. There are two levels.
| Level | What it means |
|---|---|
| Overall responses | Responses that affect the audit as a whole |
| Procedures at assertion level | An appropriate mix of tests of controls and substantive procedures for each risk of material misstatement |
Two rules apply whatever risks have been assessed:
- the auditor must design and perform substantive procedures for each material class of transactions, account balance and disclosure; and
- the auditor must consider whether external confirmation procedures (ISA 505) should be used as substantive procedures.
The risk-based approach then lets the auditor conclude whether a true and fair view is presented.
Background: ISA 330 gives examples of overall responses: stressing professional scepticism to the team, assigning more experienced staff or experts, increasing supervision, building in unpredictability in the choice of procedures, and changing the nature, timing or extent of procedures. A significant risk needs a response aimed at that risk. If the auditor plans to rely on controls, the controls over it must be tested.
Where the response is substantive only, it must include tests of detail. Higher risk leads to more reliable evidence, larger samples and procedures closer to the year end.
The rules in more depth
Why the financial statement link is where the marks are
The auditor reports on the financial statements, not on the business. A risk that cannot reach a figure or a disclosure does not change the audit. A risk that can reach one tells the auditor where to look and for what, such as overvalued inventory or a missing provision. That is why the examiner rewards the link and not the observation.
Why direction matters
State whether a balance is overstated or understated. Assets and income are usually at risk of overstatement and liabilities and expenses of understatement, because management often wants favourable results. Saying “inventory may be misstated” earns less than “inventory may be overstated because net realisable value is below cost”. The direction also tells the auditor what to test, such as existence and valuation for overstated assets, and completeness for understated liabilities.
Why some business risks matter without a specific figure
A risk such as the loss of the main customer may not point to one balance. Its effect is on the entity’s future, and so on going concern. The auditor then considers whether the going concern basis is appropriate and whether disclosure is adequate.
Why substantive work is never skipped
Risk assessment is judgement and can be wrong. The requirement for substantive procedures on every material class, balance and disclosure is a safeguard against a wrong assessment. It also means that low-risk areas are still looked at, only less.
Worked example: business and financial statement risks in an events company
Scenario. Marina Bay Events Ltd runs event halls in Lagos, Abuja and Port Harcourt. Customers pay a deposit when they book, up to twelve months ahead, and the contract says deposits are non-refundable. Each hall needs an annual fire safety certificate. One hall was closed for eight weeks after part of a ceiling collapsed. Two halls are making losses because wedding bookings have fallen.
A fourth hall is being built, is well over budget, and is financed by a dollar loan. Management has postponed replacing the air-conditioning plant. Required: identify the business risks and the financial statement risks.
| Key facts | Business risk | Financial statement risk |
|---|---|---|
| Deposits up to twelve months ahead; “non-refundable” | Cash is received long before the service. Cancellations and disputes | Revenue recognised on receipt, so overstated. Deferred income misstated. A refund provision may be needed if the term cannot be enforced |
| Annual fire certificate | A hall cannot operate if the certificate is withdrawn | The hall may be impaired. A provision may be needed for fines |
| Ceiling collapse and eight-week closure | Lost income and claims from guests | Provision or contingent liability for claims. Damaged assets impaired. An insurance recovery may be unrecorded |
| Two halls making losses | Falling demand may spread to the other halls | Impairment of the loss-making halls. Going concern in doubt if losses continue |
| Fourth hall over budget; dollar loan | Cost overruns and exchange rate exposure | Capitalised costs above recoverable amount. Loan translated at the wrong rate. Covenant breach |
| Air-conditioning replacement postponed | Customer dissatisfaction; ageing equipment | Depreciation or impairment of old plant wrongly estimated |
Plan. The auditor would give most attention to revenue cut-off and the deferred income calculation, impairment of the halls, provisions for claims, and the loan. The going concern assessment would be a main area.
How to score full marks
- Use a three-column layout in your head: key fact, business risk, financial statement risk. Write it as short sentences.
- State the direction of every misstatement: overstated or understated.
- Name the standard where one applies: IFRS 15 for deposits, International Accounting Standard (IAS) 36 for impairment, IAS 37 for provisions, IFRS 5 for assets held for sale.
- Finish each risk with what to test, if the question asks about audit planning.
- Answer the question set. Business risks, financial statement risks and audit risks are three different requirements.
- Skip the noise. Pick the facts that could affect a material figure.
- Time. Spend time in proportion to marks.
Common mistakes in the exam
- Discussing business risks in a question that asks only for financial statement risks.
- Introducing new risks in the second part of a two-part question.
- Writing general risks that fit any company.
- Leaving out the direction of the misstatement.
- Forgetting going concern when operations are stopped or sold.
- Treating ISA 330 as a list of tests, and forgetting that substantive procedures are required for every material area.
- Confusing financial statement risk with audit risk.
Quick revision
- Business risk threatens the entity’s objectives. Management chooses to reduce, transfer, avoid or accept it.
- Low probability or low severity: acceptable. High financial effect: applicable.
- Chain: business risk, financial statement risk, audit risk.
- Seven families of financial statement risk: revenue, current assets, non-current assets, liabilities, operating expenses, estimates, accounting standards.
- Method: key fact, business risk, financial statement risk, direction, what to test.
- ISA 330: overall responses; procedures at assertion level; substantive procedures on each material class, balance and disclosure; consider confirmations.
- Some business risks have no specific figure but threaten going concern.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. Financial statement risk consists of:
- Control risk and detection risk
- Inherent risk and control risk
- Business risk and audit risk
- Detection risk and business risk
Show the answer
B. Audit risk is then financial statement risk combined with detection risk.
Question 2. A business risk with low probability and low financial effect is best called:
- An applicable risk
- An acceptable risk
- A Category 1 risk
- A detection risk
Show the answer
B. Management may take no action because controls would cost more than they save.
Question 3. A company insures against fire damage to its factory. In risk management terms this is:
- Reducing the risk
- Transferring the risk
- Avoiding the risk
- Accepting the risk
Show the answer
B. The loss passes to the insurer.
Question 4. In a question asking for financial statement risks, which answer earns the fewest marks?
- Inventory may be overstated because products are becoming obsolete
- Competition is increasing in the industry
- A provision for warranties may be missing
- Revenue may be recognised before delivery
Show the answer
B. It is a business risk with no link to a figure.
Question 5. A high-tech manufacturer’s products can quickly become obsolete. The related financial statement risk is that:
- Inventory is overstated
- Share capital is understated
- Revenue is understated
- Directors’ pay is overstated
Show the answer
A. Net realisable value may be below cost.
Question 6. Customers pay deposits months before an event takes place. The main revenue risk is that revenue is:
- Recognised too early
- Recognised too late and never
- Always correct
- Not affected
Show the answer
A. Under IFRS 15, revenue is recognised when the performance obligation is met.
Question 7. Whatever risks are assessed, ISA 330 requires substantive procedures for:
- Only high-risk areas
- Each material class of transactions, account balance and disclosure
- Only balances with controls that fail
- Nothing, if controls are strong
Show the answer
B. This is a safeguard against wrong risk assessment.
Question 8. Which is an example of an overall response to assessed risks?
- Assigning more experienced staff or specialists to the audit
- Counting one inventory line
- Confirming one receivable
- Re-adding one invoice
Show the answer
A. The others are procedures at assertion level.
Question 9. Sales are rising but the ratio of administrative expenses to sales falls sharply. The risk is that:
- Operating expenses are understated
- Revenue is overstated only
- Inventory is understated
- Share capital is wrong
Show the answer
A. Cost ratios are usually fairly stable from year to year.
Question 10. A company sells its production equipment and stops manufacturing before the year end. The most important issue for the financial statements is:
- Whether the going concern basis is still appropriate
- The colour of the annual report
- The number of directors
- The auditor’s fee
Show the answer
A. A break-up basis may be needed.
Written questions
Question 11 (10 marks). Explain how business risk, financial statement risk and audit risk are linked, and the strategies management may adopt to manage business risk.
Question 12 (20 marks). (a) Explain how the auditor responds to assessed risks of material misstatement under ISA 330. (7 marks) (b) Describe the main types of financial statement risk the auditor should look for in a case. (8 marks) (c) Explain why a business risk that creates no specific financial statement risk may still matter to the auditor. (5 marks)
Question 13 (10 marks). Zuma Courier Ltd stopped its on-demand delivery service on 31 August and sold its delivery vans to a buyer in July. It made most of its drivers redundant in September. It holds three depot leases that cannot be sublet or sold and that expire in four years. Tracking devices supplied to customers carry a three-year warranty. The year end is 30 September.
Identify the financial statement risks the auditor should take into account. (10 marks)
Model answers
Show the model answer to Question 11
Business risk (2 marks). The risk that threatens the entity’s ability to achieve its objectives. A risk with low probability or low severity is acceptable, and a risk whose financial effect could be high is applicable and must be managed. (2)
Strategies (4 marks). Reduce the risk by more internal controls; transfer it, for example by insurance; avoid it by withdrawing from the operation; accept it and do nothing. (4, 1 each)
The links (4 marks). Business risk can lead to financial statement risk, for example falling demand leading to overstated inventory. (1.5) Financial statement risk, which is the risk that the statements are misstated, affects audit risk. (1) Audit risk is the risk that the auditor gives an inappropriate opinion, and results from inherent, control and detection risk. (1) Some business risks have no specific statement effect but may threaten going concern. (0.5)
Show the model answer to Question 12
(a) ISA 330 (7 marks). The auditor designs and implements responses to the risks assessed under ISAs 300 and 315. (1) Overall responses affect the audit as a whole, such as more experienced staff, experts and more supervision. (1) Procedures at assertion level are an appropriate mix of tests of controls and substantive procedures. (1) Whatever the assessed risks, substantive procedures are designed and performed for each material class of transactions, account balance and disclosure.
(1) The auditor considers external confirmation under ISA 505. (1) A significant risk gets a response aimed at that risk, and controls over it are tested if relied on. (1) The nature, timing and extent of procedures are adjusted to the risk, and the auditor then concludes whether a true and fair view is presented. (1)
(b) Financial statement risks (8 marks, any eight at 1). Overstatement of revenue, such as staged payments or deposits recognised before the performance obligation is met. Overstated receivables because bad debts are not provided for. Overstated inventory because of obsolescence or count timing. Overstated non-current assets because impairment is missed. Understated liabilities, particularly provisions. Understated profit where an insurance recovery is ignored.
Understated operating expenses, shown by a falling cost ratio. Misstated accounting estimates. Failure to comply with standards on contingent liabilities, deferred tax, share-based payments and related parties.
(c) Risks without a specific figure (5 marks). Some business risks, such as the loss of the main customer, do not point to one balance. (1.5) They may still lead to going concern problems. (1.5) The auditor must then consider whether the going concern basis is appropriate and whether disclosure is adequate. (1) The auditor also judges whether the risk is significant and adjusts planning. (1)
Show the model answer to Question 13
Going concern basis (2 marks). The company has stopped its main activity, so the statements should not be prepared on a going concern basis but on another basis, such as break-up. (2)
Sale of the vans (2 marks). The sale affects presentation. Gains or losses on disposal must be shown properly, and any vans unsold at the year end are presented as held for sale. The activity may need disclosure as discontinued. (2)
Redundancies (2 marks). Redundancy payments not paid by the year end need a provision, and the amount and recognition date may be misjudged. (2)
Depot leases (2 marks). The leases cannot be sublet or sold and the depots are no longer used, so the leases may be onerous and a full provision may be needed. Costs may be understated. (2)
Warranties (2 marks). Customers still hold three-year warranties on the tracking devices, so a provision for warranty costs is needed, and it is an estimate open to bias. (2)
Pathfinder on business risk and financial statement risk
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
No written question in these two diets tests this topic on its own. The same two-step method, finding the key fact and then stating the financial statement risk, is what the group risk assessment question (November 2025 Question 2) and the fair value risks question (November 2025 Question 4) require.
Revise first: The two-step method for scenario questions
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
