Understanding and Assessing Material Misstatement Risk

1. The Risk-Based Audit Approach

Before diving into the details, let's frame our discussion. Modern auditing is not about giving equal attention to every single account. It's about focusing your efforts on the areas where the risk of material misstatement (RoMM) is highest. This is the essence of a risk-based audit.

Think about two ways to audit a company:

1. Approach 1 (Traditional): You have 100 hours. You spend 25 hours on assets, 25 on liabilities, 25 on income, and 25 on expenses, regardless of the company's specifics.
2. Approach 2 (Risk-Based): You first study the company and find that inventory valuation is complex and the sales process has weak controls, while expenses are straightforward. You might then decide to spend 40 hours on inventory and sales, and only 10 on expenses.

Clearly, the second approach is more effective and efficient. SA 315 provides the framework for implementing this intelligent approach. The first step in this process is to perform Risk Assessment Procedures (RAPs).

These are the activities you perform to gain an understanding of the entity. You've done these throughout your articleship. They primarily include:

• Inquiry: Asking questions of management, finance staff, and other employees.
• Analytical Procedures: Analyzing trends and relationships in financial and non-financial data to spot unusual fluctuations.
• Observation: Watching processes or procedures being performed by others (e.g., observing an inventory count).
• Inspection: Examining documents, records, and tangible assets.

This mind map provides a great overview of the various procedures and sources of information an auditor uses.

2. The Core of the Process: Understanding the Entity

To assess risk, you must first understand the business. SA 315 requires the auditor to obtain an understanding of the entity and its environment, its applicable financial reporting framework, and—crucially—its system of internal control.

What is Audit Risk?

Let's clarify what we mean by "risk." Audit Risk is the risk that the auditor expresses an inappropriate opinion (e.g., giving a clean report when there's a material misstatement). It has two main components:

1. Risk of Material Misstatement (RoMM): The risk that the financial statements are materially misstated before the audit begins. This risk exists within the company itself and is made up of:
   • Inherent Risk: The susceptibility of an assertion to misstatement, assuming there are no controls. For example, the valuation of complex financial instruments is inherently riskier than the valuation of cash.
   • Control Risk: The risk that the company's own internal controls will fail to prevent or detect and correct a misstatement.
2. Detection Risk: The risk that the auditor's own procedures will fail to detect a material misstatement that exists.

The auditor cannot change inherent or control risk—those belong to the client. The auditor's job is to assess RoMM and then manage detection risk by performing more or better audit procedures in high-risk areas.

The following video provides a clear explanation of audit risk and its components.

3. Understanding the System of Internal Control

A significant part of understanding the entity is understanding its system of internal control. This is a topic you've encountered extensively, but SA 315 provides a specific structure for the auditor's understanding.

Internal Control is the process designed, implemented, and maintained by management to provide reasonable assurance about achieving the entity's objectives related to:

• Reliability of financial reporting.
• Effectiveness and efficiency of operations.
• Safeguarding of assets.
• Compliance with laws and regulations.

Inherent Limitations of Internal Control

It's important to remember that internal controls can only provide reasonable, not absolute, assurance. Why? Because of inherent limitations, such as:

• The possibility of human error.
• Controls being circumvented by collusion between employees.
• Management overriding a control.
• The cost of a control outweighing its benefit.
• Controls being designed for routine transactions, not unusual ones.

The Five Components of Internal Control

SA 315 requires the auditor to understand five specific components of the entity's internal control system. Understanding this framework is essential for your exams.

This structured approach ensures the auditor considers the entire ecosystem of control within the entity, not just isolated policies.

4. Identifying and Assessing the Risks

After gaining an understanding of the entity and its controls, the auditor is ready for the main event: identifying and assessing the risks of material misstatement.

Two Levels of Risk

Risks can manifest at two levels:

1. Financial Statement Level: These are risks that are pervasive and could affect many assertions across the financial statements. For example, a weak control environment or an incompetent CFO could lead to errors everywhere. This is often called a 'pervasive' risk.
2. Assertion Level: These are risks that relate to specific classes of transactions, account balances, or disclosures. For example, a lack of security at a warehouse creates a risk for the existence and valuation assertions for inventory, but it likely doesn't affect accounts payable.

The video below gives clear examples that will help you distinguish between these two levels.

The Assessment Process: A Practical Walkthrough

So, how does an auditor actually do this? It's an iterative process of connecting risks to controls and assertions.

Significant Risks

Some risks are so important that they require special audit consideration. SA 315 calls these significant risks. These are typically risks that are high on the spectrum of inherent risk. Examples include:

• Risk of fraud.
• Risks related to significant economic or accounting developments.
• Complex transactions.
• Significant transactions with related parties.
• Transactions involving a high degree of subjectivity or estimation uncertainty.

Identifying a risk as 'significant' has direct implications for the audit response, which we will cover in our next lesson on SA 330.

Conclusion

In this lesson, we have unpacked the process of identifying and assessing risks as prescribed by SA 315. We've seen that it's a systematic process that forms the backbone of a risk-based audit, directing the auditor's attention to where it matters most.

Key Takeaways:

• SA 315 provides the framework for a risk-based audit, focusing efforts on high-risk areas.
• The process begins with performing Risk Assessment Procedures (inquiry, inspection, observation, analytical procedures) to understand the entity.
• A core part of this understanding involves evaluating the entity's five components of internal control: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring.
• Internal controls have inherent limitations, meaning they only provide reasonable, not absolute, assurance.
• Based on this understanding, the auditor identifies and assesses risks of material misstatement (RoMM) at two levels: the pervasive financial statement level and the specific assertion level.
• Risks that require special audit consideration are identified as significant risks.

Preview of the Next Lesson

We have now planned the audit (SA 300), determined what is material (SA 320), and identified and assessed the risks of material misstatement (SA 315). The next logical step is to decide what to do about those risks. In our next lesson, we will explore SA 330, "The Auditor's Responses to Assessed Risks," to learn how we design overall responses and further audit procedures to address the risks we've just identified.