Audit Planning, Risk and Materiality
Planning
Audit Planning, Risk and Materiality
Syllabus tag: KASNEB CPA | Intermediate Level | CA24 Auditing and Assurance | Topic 4 Audit Planning, Risk and Materiality
Lesson objectives
By the end of this topic, you will be able to:
- Explain the audit risk model and its three components
- Distinguish inherent, control and detection risk
- Show how the auditor responds to assessed risk
- Compute and apply materiality, including performance materiality
- Explain professional scepticism
Why this matters
An auditor cannot test everything. Planning is how limited effort is directed at the places where misstatement is most likely and would matter most. Everything in the file should trace back to a risk identified here.
The audit risk model
Audit risk = Inherent risk × Control risk × Detection risk
Audit risk is the risk of giving an inappropriate opinion when the financial statements are materially misstated.
| Component | Definition | Controlled by |
|---|---|---|
| Inherent risk | Susceptibility to misstatement before considering controls | The client and its circumstances |
| Control risk | Risk that the client's controls fail to prevent or detect it | The client's system |
| Detection risk | Risk that the auditor's procedures fail to find it | The auditor |
The crucial point: the auditor controls only detection risk. Inherent and control risk are assessed, not managed. They belong to the client.
Together, inherent and control risk make up the risk of material misstatement — the risk that the figures are wrong before the auditor does anything at all.
Responding to assessed risk
The model is used in reverse. The firm sets the audit risk it is prepared to accept, assesses the risk of material misstatement, and derives the detection risk it can tolerate.
High risk of material misstatement → detection risk must be low → more work. That means larger samples, more procedures at the year end rather than at an interim date, more experienced staff, and greater scepticism.
Low risk of material misstatement → detection risk may be higher → less work.
An examiner asks candidates to identify risks and state the response. The response must be specific: "increase sample sizes for revenue cut-off testing around the year end", not "do more work".
Examples of inherent risk
- A complex or judgemental accounting estimate
- Transactions with related parties
- Cash-intensive operations
- Management remuneration linked to reported profit
- A first-year audit, where the auditor lacks cumulative knowledge
- Rapid growth, or a business under financial pressure
Note the fifth and sixth together: pressure on management and an opportunity to misstate are two sides of the fraud triangle, and both raise inherent risk at the assertion level.
Materiality
Information is material if omitting or misstating it could reasonably be expected to influence the decisions of users.
It is judged on size and nature together. An amount too small to matter by size can still be material by nature — a director's transaction, a payment that turns a loss into a profit, or a breach of a loan covenant.
Common benchmarks, applied with judgement rather than mechanically:
| Benchmark | Typical range |
|---|---|
| Profit before tax | 5% |
| Revenue | 0.5% to 1% |
| Total assets | 1% to 2% |
The benchmark should suit the entity. Profit is a poor benchmark for an entity close to break-even, because a small swing in profit produces a wildly different materiality figure. A not-for-profit is usually measured against expenditure or total assets instead.
Performance materiality is set below overall materiality — often 50% to 75% of it. Its purpose is to leave room for the aggregate of undetected and uncorrected misstatements to remain below overall materiality. Testing to overall materiality directly would leave no margin at all.
Materiality is revised during the audit if better information emerges, such as actual results differing from the forecast used at planning.
:::checkpoint A company reports profit before tax of KES 4,000,000 on revenue of KES 800 million, having made losses in each of the previous two years. Compute materiality on the profit benchmark and on the revenue benchmark, and say which you would use and why. :::
Professional scepticism
An attitude that includes a questioning mind, alertness to conditions indicating possible misstatement, and a critical assessment of evidence.
The standard is not that the auditor assumes management is dishonest, nor that it assumes honesty. It is that the auditor neither assumes, and requires evidence either way.
In practice this means corroborating management explanations rather than accepting them, following up inconsistent evidence rather than setting it aside, and being alert to documents that may not be genuine.
Planning documentation
The overall audit strategy sets scope, timing and direction — the reporting framework, the deadlines, the resources.
The audit plan is more detailed: the nature, timing and extent of the procedures to be performed.
Both are revised as the audit proceeds. Planning is not a single event completed before fieldwork begins; it is continuous, and a risk identified in week three changes the plan for week four.
:::checkpoint An auditor sets performance materiality equal to overall materiality, reasoning that it is simpler. Explain what this leaves no room for, and what could go wrong at the conclusion of the audit. :::