Audit Materiality and Risk

Audit Risk = Risk of Material Misstatement (RMM) × Detection Risk.
RMM consists of:

1. Inherent Risk: Susceptibility of an assertion to material misstatement before considering controls.
2. Control Risk: Risk that internal controls will not prevent or detect the misstatement.
   Detection Risk: The risk that the auditor's procedures will fail to detect a material misstatement. The auditor assesses RMM and adjusts Detection Risk (by doing more work) to achieve an acceptably low Audit Risk.

Analytical procedures consist of evaluations of financial information made by a study of plausible relationships among both financial and non-financial data. Examples include comparing current year financial data with prior periods or with industry averages to identify unusual fluctuations.

Materiality (SA 320) is a concept where information is considered material if its omission or misstatement could reasonably influence the economic decisions of users taken on the basis of the financial statements. The auditor sets a materiality level for the financial statements as a whole and performance materiality to reduce the risk of undetected misstatements.

As per SA 330, the auditor's responses to assessed risks are categorized into two levels:

1. Overall Responses to Risks at the Financial Statement Level: These are responses that affect the overall audit strategy and the auditor's approach to the audit. Examples include:
   • Emphasizing to the audit team the need for professional skepticism.
   • Assigning more experienced staff or those with special skills.
   • Providing more supervision.
   • Incorporating more unpredictability in the selection of audit procedures.
   • Making general changes to the nature, timing, or extent of audit procedures (e.g., performing substantive procedures at year-end instead of an interim date).
2. Audit Procedures Responsive to Risks at the Assertion Level (Further Audit Procedures): These procedures are designed to obtain sufficient appropriate audit evidence at the assertion level for each material class of transactions, account balance, and disclosure. They comprise:
   • Tests of Controls: If the auditor plans to rely on internal controls, tests are performed to evaluate their operating effectiveness in preventing or detecting material misstatements.
   • Substantive Procedures: These are designed to detect material misstatements at the assertion level and include:
     • Tests of Details: Examining individual transactions, balances, and disclosures.
     • Substantive Analytical Procedures: Evaluating financial information through analysis of plausible relationships among both financial and non-financial data.
       The nature, timing, and extent of these procedures are directly linked to the assessed risks. Higher assessed risk generally leads to more persuasive evidence, performed closer to year-end, and more extensively.

Audit Risk is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated. In other words, it is the risk that the auditor fails to detect a material misstatement.
Audit Risk comprises three components:

1. Inherent Risk (IR): The susceptibility of an assertion about a class of transaction, account balance, or disclosure to a misstatement that could be material, either individually or when aggregated with other misstatements, before consideration of any related controls. Factors like complex calculations, cash transactions, or subjective estimates increase inherent risk.
2. Control Risk (CR): The risk that a misstatement that could occur in an assertion about a class of transaction, account balance, or disclosure and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control. This risk exists due to the inherent limitations of any internal control system.
3. Detection Risk (DR): The risk that the procedures performed by the auditor to reduce audit risk to an acceptably low level will not detect a misstatement that exists and that could be material, either individually or when aggregated with other misstatements. Detection risk is controlled by the auditor and can be reduced by performing more extensive audit procedures.

Materiality is a cornerstone of auditing and directly impacts the nature, timing, and extent (NTE) of audit procedures:

1. Nature: This refers to the type of audit procedure (e.g., inspection, observation, inquiry, confirmation, recalculation, analytical procedures). For highly material accounts or assertions, the auditor will select more persuasive and reliable procedures, such as external confirmations or detailed inspection of documents. For less material items, less rigorous procedures might suffice.
2. Timing: This refers to when the audit procedures are performed (e.g., at an interim date or year-end). For highly material balances or transactions, especially those with high inherent or control risk, procedures are typically performed closer to or at the year-end to obtain more relevant evidence. For less material items or those with strong controls, procedures might be performed at an interim date.
3. Extent: This refers to the quantity of a particular audit procedure (e.g., sample size, number of observations). As materiality decreases (meaning the acceptable misstatement threshold is lower), the extent of audit procedures generally increases (e.g., larger sample sizes, more detailed testing) to achieve a lower detection risk. Conversely, if materiality is higher, the auditor may perform less extensive procedures.
   In essence, a lower materiality level implies a higher risk of material misstatement being undetected, thus requiring more rigorous and extensive audit work.

Materiality levels are established during the planning phase, but they are not static. An auditor may need to revise materiality (overall and/or performance materiality) if:

1. New Information: Information comes to the auditor's attention that would have caused the auditor to determine a different amount initially. For example, discovery of significant fraud or error.
2. Change in Circumstances: A change in the entity's circumstances during the audit (e.g., a significant acquisition or disposal, a major change in operations, or unexpected financial results).
3. Change in Auditor's Understanding: A change in the auditor's understanding of the entity and its operations as a result of performing risk assessment procedures.
4. Re-evaluation of Benchmarks: If the benchmark used for overall materiality (e.g., profit before tax) significantly changes or becomes inappropriate (e.g., the entity moves from profit to loss).
   When materiality is revised, the auditor must also consider whether it is necessary to revise performance materiality and whether the nature, timing, and extent of further audit procedures remain appropriate.

Performance materiality is an amount or amounts set by the auditor at less than materiality for the financial statements as a whole to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole.
Purpose:

1. Risk Mitigation: It helps to mitigate the risk that individually immaterial misstatements, when aggregated, could become material.
2. Scope of Procedures: It guides the auditor in determining the nature, timing, and extent of audit procedures for specific classes of transactions, account balances, and disclosures.
3. Sampling: It is often used in determining sample sizes for substantive testing.
   Determination: Performance materiality is typically determined as a percentage (e.g., 50-75%) of overall materiality. The exact percentage is a matter of professional judgment and depends on the auditor's assessment of the risk of misstatement and the entity's internal control environment. A higher risk environment would generally warrant a lower performance materiality.

Audit materiality refers to the magnitude of misstatements (including omissions) that, individually or in aggregate, could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements. It is crucial because it helps the auditor:

1. Determine the nature, timing, and extent of audit procedures: Materiality guides the auditor in deciding which areas to focus on and how much evidence to gather.
2. Evaluate the effect of identified misstatements: It provides a threshold for assessing whether misstatements are significant enough to warrant adjustment or disclosure.
3. Formulate the audit opinion: The auditor's opinion on the financial statements' true and fair view is directly influenced by whether material misstatements exist and remain uncorrected.
   Proper determination ensures that the audit is effective in detecting significant errors without being overly burdensome or inefficient.

The three components of audit risk are interrelated and are often expressed in the Audit Risk Model:
Audit Risk (AR) = Inherent Risk (IR) x Control Risk (CR) x Detection Risk (DR)

• IR and CR are risks that exist independently of the audit of financial statements. They are the client's risks of material misstatement. The auditor assesses these risks.
• DR is the only component of audit risk that the auditor can directly control. It is the risk that the auditor's own procedures will fail to detect material misstatements.
  The interrelationship is generally inverse between the assessed risks of material misstatement (IR x CR) and the acceptable level of detection risk.
• If the auditor assesses IR and CR as high, then to achieve an acceptably low audit risk, the auditor must set DR as low. This means performing more extensive and rigorous substantive procedures (e.g., larger sample sizes, more detailed testing, more reliable evidence).
• If the auditor assesses IR and CR as low (due to strong internal controls and low inherent susceptibility), then the auditor can accept a higher DR. This allows for less extensive substantive procedures.
  This relationship directly influences the auditor's audit strategy, determining the emphasis on tests of controls versus substantive procedures.

The determination of overall materiality involves professional judgment and is influenced by various factors, including:

1. Financial Statement Elements: Common benchmarks include profit before tax, total revenue, total assets, gross profit, or equity. The choice depends on the entity's nature and industry.
2. Nature of the Entity: A growing entity might use revenue, while a non-profit might use total expenses. A loss-making entity might use total assets or equity.
3. Users' Expectations: The auditor considers the information needs of the financial statement users (e.g., investors, creditors, regulators).
4. Size and Complexity of the Entity: Larger, more complex entities may have different materiality considerations.
5. Prior Period Materiality: While not binding, prior period materiality can be a starting point, adjusted for current circumstances.
6. Relevant Financial Reporting Framework: The applicable accounting standards (e.g., Ind AS or AS) and legal requirements (e.g., Companies Act, 2013) influence what is considered material.
7. Volatility of Benchmarks: If a benchmark (like profit before tax) is highly volatile, the auditor might choose a more stable benchmark (like total revenue or assets).

An auditor typically considers three types of materiality:

1. Materiality for the Financial Statements as a Whole (Overall Materiality): This is the materiality level determined for the financial statements taken as a whole. It is used to assess the risk of material misstatement and to determine the nature, timing, and extent of audit procedures. It is usually determined by applying a percentage to a chosen benchmark (e.g., profit before tax, total revenue, total assets).
2. Performance Materiality: This is set at an amount or amounts lower than materiality for the financial statements as a whole to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole. It is used for specific audit procedures and for individual account balances or classes of transactions.
3. Specific Materiality (Materiality for Particular Classes of Transactions, Account Balances, or Disclosures): In some cases, misstatements of amounts lower than overall materiality could influence the economic decisions of users. For example, related party transactions, executive remuneration, or specific disclosures required by law. For such items, the auditor determines a specific materiality level.

No, an auditor cannot completely eliminate audit risk. The auditor provides 'reasonable assurance,' not absolute assurance, that the financial statements are free from material misstatement. This is due to several inherent limitations of an audit:

1. Nature of Financial Reporting: Financial statements involve judgments, estimates, and subjective decisions by management, which inherently carry a risk of misstatement.
2. Nature of Audit Procedures: Audit procedures are often based on sampling and testing, which cannot provide 100% certainty. Auditors also rely on persuasive rather than conclusive evidence.
3. Inherent Limitations of Internal Control: Even the most effective internal control systems can have limitations (e.g., human error, collusion, management override).
4. Evidence is Persuasive, Not Conclusive: Audit evidence is generally persuasive rather than conclusive.
5. Cost-Benefit Considerations: An audit must be conducted within a reasonable time and at a reasonable cost. Performing procedures to achieve absolute assurance would be prohibitively expensive and impractical.
   Therefore, while auditors strive to reduce audit risk to an acceptably low level, it can never be reduced to zero.

Risk assessment procedures are audit procedures performed to obtain an understanding of the entity and its environment, including the entity’s internal control, to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement and assertion levels.
These procedures are fundamental because they:

1. Provide Basis for Risk Assessment: They help the auditor identify potential areas where misstatements could occur.
2. Inform Audit Strategy: The understanding gained forms the basis for designing and implementing responses to the assessed risks of material misstatement.
3. Identify Significant Risks: They enable the auditor to identify significant risks that require special audit consideration.
4. Evaluate Internal Controls: They help in understanding the design and implementation of controls relevant to the audit.
   Examples of risk assessment procedures include:

• Inquiries of management and others within the entity.
• Analytical procedures.
• Observation and inspection.

A 'significant risk' is an identified and assessed risk of material misstatement that, in the auditor's judgment, requires special audit consideration. These are risks that are more likely to result in material misstatement or have a greater potential impact.
Factors that indicate a significant risk include:

• Risk of fraud.
• Relationship to recent significant economic, accounting, or other developments.
• Complexity of transactions.
• Significant related party transactions.
• Subjectivity in measurement of financial information.
• Transactions outside the normal course of business.
  Impact on Auditor's Approach:

1. Mandatory Substantive Procedures: For significant risks, substantive procedures are always required. Reliance solely on tests of controls is insufficient.
2. Tests of Controls (if applicable): If the auditor plans to rely on controls for a significant risk, those controls must be tested in the current period (i.e., cannot rely on prior period testing).
3. No Reliance on Analytical Procedures Alone: Substantive analytical procedures alone are often insufficient to address significant risks.
4. Specific Documentation: The auditor must document the significant risks identified and the related controls and audit procedures performed.
5. Consideration of Controls: The auditor must obtain an understanding of the entity's controls, including control activities, relevant to significant risks.