Audit risk and the auditor’s response to assessed risks (ISA 330)

Two clients, same size. The first is a food manufacturer with a long-serving finance team, a tidy system and no complicated estimates. The second is a construction company with long contracts, big estimates, new staff and loose controls. An auditor who tests both with the same sample sizes will over-audit the first and under-audit the second.

The risk-based approach fixes this by asking, for every area, how likely a material error is and how much testing is needed to be satisfied that there is not one.

This topic covers the risk-based approach, the response to assessed risks under International Standard on Auditing (ISA) 330, the three components of audit risk and the formula that links them, the effect of the control environment, and the exam technique for identifying risks from a scenario. The previous topics covered planning, understanding the entity and materiality. The next covers fraud.

Key terms in plain English

Syllabus check

This topic is in syllabus area A, process of audit and assurance (20% of marks). It covers:

• audit risk and the response to assessed risks
• planning an audit
• the nature and use of internal control

CAMA 2020 and audit risk

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

The risk-based approach

A key feature of modern auditing is the risk-based approach. At planning, ISA 315 requires the auditor to identify and assess the main risks of the business. The auditor then prepares an overall strategy and plan under ISA 300 to focus the work on high-risk areas.

ISA 330, The Auditor's Responses to Assessed Risks, adds that the auditor's objective is to obtain sufficient appropriate audit evidence about the assessed risks of material misstatement by designing and carrying out suitable responses. In short the auditor must assess the risks and plan the work so that any material misstatements are found and corrected, which should ensure that the statements present a true and fair view.

Responses to assessed risks: ISA 330

At the financial statement level the responses are overall ones, which may include:

• stressing to the team the need to keep up professional scepticism;
• assigning more experienced staff or giving more supervision;
• using experts; and
• changing the nature, timing and extent of procedures, for example doing more substantive procedures at the final audit than at the interim, or getting more persuasive evidence.

The response depends heavily on the assessment of the control environment. An effective environment raises confidence in controls in all areas and allows more work at the interim audit and fewer tests of detail. At the assertion level the responses are further audit procedures, which are tests of controls and substantive procedures. Later topics describe both.

The audit risk model

Audit risk is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated. It is the chance of reaching a wrong conclusion on the area audited. An audit risk of 5% means the auditor accepts a 5% chance that the item is misstated and a 95% probability that it is materially correct. The model is:

AR = IR × CR × DR

where AR is audit risk, IR is inherent risk, CR is control risk and DR is detection risk. Risks are expressed as proportions, so 10% is entered as 0.10.

Inherent risk

Inherent risk is the susceptibility of an assertion about a class of transactions, an account balance or a disclosure to a misstatement that could be material, before considering any related controls. It arises from:

• the nature of the items: estimated items are inherently risky because they depend on an estimate and not a precise measure; and
• the nature of the entity and its industry: a construction company in a volatile industry is more likely to have misstated items than a food and drinks manufacturer.

Inherent risk operates independently of controls. It cannot be controlled, and the auditor must accept that it will not go away. Under the revised ISA 315 the auditor also considers inherent risk factors, which are complexity, subjectivity, change, uncertainty and susceptibility to misstatement due to management bias or fraud.

The higher an item scores on these factors, the higher the inherent risk, and the auditor assesses it on a spectrum from low to high.

Control risk

Control risk is the risk that a misstatement that could occur and be material will not be prevented, or detected and corrected on a timely basis, by the entity's internal control. The auditor assesses it for each area of the audit and obtains evidence through tests of controls. The starting assumption is that control risk is very high and the controls are insufficient to prevent material misstatement.

Tests of controls may give enough evidence to reduce the estimate for audit planning. Recommendations for improving controls can affect control risk in future years but not in the period under audit.

Detection risk

Detection risk is the risk that the procedures the auditor performs to reduce audit risk to an acceptably low level will not detect a misstatement that exists and could be material. If detection risk is 10%, there is a 10% probability that the tests fail to find a material misstatement. It can be lowered by doing more tests. Reducing it from 10% to 5% needs more work.

Of the three components, detection risk is the only one the auditor controls directly.

How the model is used

1. Set the overall level of audit risk judged acceptable for the audit.
2. Assess inherent risk and control risk.
3. Adjust detection risk to achieve the overall level: DR = AR ÷ (IR × CR).

When inherent and control risk are high, detection risk must be low, which means more extensive, more reliable testing nearer the year end and larger samples. When they are low, detection risk can be higher, which allows less testing. The product of inherent and control risk is the risk of material misstatement, the risk that the statements contain a material error before the auditor does any work.

Exam technique: identifying risks from a scenario

A scenario contains clues. Each clue affects the assessment of inherent, control or detection risk. A good answer spots the clue and explains why it is a risk.

The classic scenario is Risky Sounds, a retailer of hi-tech recording equipment, started under a year ago by its sole shareholder and director, with a series of book-keepers, the latest just gone, and a re-mortgaged home and a business loan with a bank that wants the financial statements.

Identifying inherent risks: the charity example

A charity gets cash from volunteers in the street and cheques by post, sometimes with conditions on use, and its constitution limits administration costs to 15% of income.

The inherent risks are that volunteers keep some cash, that no control can show that all money received is recorded because there are no sales invoices, that restricted gifts may not be spent for their purpose, that spending may not match the constitution and that administration costs may be mis-classified to stay under the limit.

Because these risks cannot be controlled in practice, the auditor must decide what substantive checks to do and whether any can give assurance. If no check can give assurance on the completeness of income, the auditor must consider a comment in the report that completeness could not be verified.

Worked examples

1. (a) There is a 10% risk that the opinion is wrong, or 90% certainty that it is right.
2. (b) DR = 0.10 ÷ (0.50 × 0.80) = 0.10 ÷ 0.40 = 0.25, or 25%.
3. (c) DR = 0.05 ÷ 0.40 = 0.125, or 12.5%.
   A lower detection risk means more audit work.

1. Before.
   DR = 0.05 ÷ (0.5 × 0.6) = 16.7%.
2. After.
   DR = 0.05 ÷ (0.5 × 1.0) = 10%.
3. Detection risk must fall, so more substantive testing is needed on sales.

1. (a) Inherent risk: the item depends on an estimate.
2. (b) Control risk: the control environment does not stop an error.
3. (c) Detection risk: a small sample is more likely to miss a misstatement.

1. The risk is at the financial statement level.
2. Overall responses: more experienced staff, closer supervision, more scepticism, more unpredictable procedures, more substantive work at the year end.

How to score full marks

• For each clue name the risk and the reason, then the audit response.
• Show the working in a formula question: DR = AR ÷ (IR × CR).
• Say that only detection risk is controlled by the auditor.
• Use inherent risk for estimates, industry and complexity.

Common mistakes in the exam

• Saying the auditor can reduce inherent risk.
• Multiplying instead of dividing when finding detection risk.
• Starting from low control risk before testing the controls.
• Listing risks with no explanation of why they matter.

Quick revision

• AR = IR × CR × DR; DR = AR ÷ (IR × CR).
• Inherent: nature of item or industry; cannot be controlled.
• Control: failure of controls; assume high until tested.
• Detection: auditor's tests; more work lowers it.
• ISA 330: overall responses and further procedures.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.