1.

MATERIALITY & RISK ASSESSMENT

1.1 Concept of Materiality (SA 320)

 Materiality refers to the magnitude of misstatements that may influence the economic decisions of users taken
based on financial statements.

 It is applied in planning and performing the audit, and in evaluating the effect of identified misstatements.

 Judgments about materiality are based on circumstances and affected by the auditor’s perception of the needs of
financial statement users.

 Materiality is used:

o To determine audit procedures.

o To assess the effect of misstatements.

o To decide whether financial statements are free from material misstatement.

1.2 Risk Assessment and Audit Risk

 Audit risk: Risk that the auditor expresses an inappropriate audit opinion when the FS are materially misstated.

 Two key components:

1. Risk of Material Misstatement (RMM)

2. Detection Risk (DR)

Audit Risk = RMM x DR

Where,

 RMM = Inherent Risk (IR) x Control Risk (CR)

 IR: Susceptibility of assertion to misstatement without controls.

 CR: Risk that client’s internal control will not prevent/detect misstatements.

 DR: Risk that auditor's procedures will not detect a misstatement.

1.3 Application of Materiality and Risk in Audit

 Used in identifying risk of material misstatements.

 Applied in planning the nature, timing, and extent of further audit procedures.

 Used in evaluating audit evidence and assessing the effect of uncorrected misstatements.

1.4 Assertions in Financial Reporting

Assertions about classes of transactions and events:

 Occurrence

 Completeness

 Accuracy

 Cut-off

 Classification

Assertions about account balances:

 Existence

 Rights and obligations

 Valuation and allocation

Assertions about presentation and disclosure:

 Occurrence and rights & obligations

 Completeness

 Classification and understandability

 Accuracy and valuation

1.5 Steps for Risk Identification

1. Assess risk significance and revise materiality.

2. Evaluate likelihood and impact of risks.

3. Identify affected assertions.

4. Document specific risks.

5. Evaluate internal controls.

6. Address unique risk characteristics.

7. Design audit procedures specific to risk areas.

1.6 Illustration: Validity of Purchases

 Example: 40% purchases made without valid POs.

 Affected balances: Purchases and Payables.

 Assertions involved: Validity and Completeness.

 Audit procedures: Review documentation, vendor correspondence, and purchase records.

2. RISK-BASED AUDIT APPROACH

2.1 Concept and Framework

 RBA focuses on areas of greatest risk to ensure efficient resource allocation.

 Enables auditors to prioritize high-risk accounts and tailor audit procedures.

 Encourages reliance on internal control evaluations.

2.2 Types of Audit Risk

 Error: Unintentional mistakes.

 Fraud: Intentional misstatements for deceptive purposes.

Auditor is responsible to plan and perform audit to obtain reasonable assurance that FS are free from material
misstatement due to error or fraud.

2.3 Risk-Based Audit Phases

Phase 1: Risk Assessment

 Accept/continue client relationship.

 Understand business and internal controls.

 Identify and assess RMM.

 Identify significant risks.

 Communicate control deficiencies to management.

Phase 2: Risk Response

 Design audit procedures addressing identified risks.

 Consider:

o Assertions not addressed by substantive tests alone.

o Automated processing with minimal manual intervention.

o Analytical procedures.

o Management override risks.

 Use test of controls and substantive procedures.

Phase 3: Reporting

 Evaluate sufficiency and appropriateness of audit evidence.

 Conclude on audit opinion.

 Reassess risk if necessary and perform additional procedures.

3. INTERNAL CONTROL SYSTEM

3.1 Nature

 Internal controls include all policies and procedures to achieve management objectives such as orderly operations,
safeguarding of assets, accuracy of records, and compliance.

 Defined under SA 315 as a process designed and maintained by TCWG and management.

3.2 Scope

 Includes both accounting and administrative controls.

 Accounting controls relate to safeguarding of assets and financial record accuracy.

 Administrative controls relate to decision-making processes and authorizations.

3.3 Objectives

1. Authorization of transactions.

2. Timely and accurate recording.

3. Safeguarding of assets.

4. Verification and correction of discrepancies.

5. Reliable reporting and compliance.

3.4 Limitations

 Cost-benefit considerations.

 Human error and collusion.

 Management override.

 Manipulation and estimation errors.

3.5.1 Segregation of Duties:

 Allocation of tasks to prevent single-person control over a process.

 Functions like authorization, custody, execution, and record-keeping are separated.

3.5.2 Authorization:

 Delegation of authority for transactions should be documented.

 Independent comparison of transaction records with authorizations.

3.5.3 Record Adequacy:

 Prompt and accurate recording.

 Proper classification and summarization.

3.5.4 Safeguarding of Assets:

 Regular reconciliations and verification.

 Controlled access to sensitive assets.

3.5.5 Independent Checks:

 Internal audit and regular reviews to ensure system functionality.

4. COMPONENTS OF INTERNAL CONTROL

4.1 Control Environment

 Integrity, ethics, competence, and governance influence control effectiveness.

 Includes:

o Code of conduct

o Commitment to competence

o Oversight by TCWG

o HR policies

o Organizational structure and accountability

4.2 Risk Assessment Process

 Entity's process to identify and respond to business and reporting risks.

 Risks may arise from:

o Changes in environment, tech, or structure.

o Expansion or foreign operations.

o New regulations or personnel.

4.3 Control Activities

 Include:

o Performance reviews

o Information processing controls (application and general IT controls)

o Physical safeguards
 o Segregation of duties

o Authorization and approval mechanisms

4.4 Information Systems and Communication

 Ensure timely, accurate, complete recording.

 Involve infrastructure, software, people, and procedures.

 Enable proper classification, valuation, and presentation.

4.5 Monitoring of Controls

 Ongoing evaluations to ensure controls are operating as intended.

 Involves internal audit, feedback from external stakeholders, and self-assessment.

5. REVIEW OF INTERNAL CONTROL SYSTEM

 Evaluate control design and implementation effectiveness.

 Consider manual vs. automated controls.

 Identify weak areas for substantive audit focus.

 Review at least every 3 years or more frequently if needed.

 Methods: Inquiries, documentation review, tracing transactions.

6. INTERNAL CONTROL ASSESSMENT & EVALUATION

6.1 Factors Impacting Assessment

 Standard Operating Procedures (SOPs)

 Enterprise Risk Management (ERM)

 Segregation of responsibilities

 Job rotation in sensitive areas

 Delegation of powers

 IT-embedded controls

6.2 Techniques

6.2.1 Questionnaire

 Comprehensive and standardized for functional areas.

 Usually filled by auditor in consultation with executives.

6.2.2 Checklists

 Reminder-type tool used by audit staff.

 Ensures coverage of key control objectives.

6.2.3 Flowcharts

 Graphical representation of document flows and control points.

 Effective in understanding transaction cycles and inter-linkages.

7.1 Internal Check

 Built-in mechanism in routine procedures to detect errors and frauds.

 Ensures:

o Division of duties

o Periodic rotation

o Responsibility clarity

o Periodic verification and physical checks

7.2 Internal Audit

 Independent appraisal function.

 Examines and evaluates internal controls, accuracy of records, and adherence to policies.