Materiality and audit risk

An auditor cannot check everything, and does not need to. Users of financial statements do not care whether inventory is 38,500 thousand dollars or 38,497 thousand dollars; they care whether it is roughly right, close enough that their decisions would not change. Materiality is the concept that turns "roughly right" into a working threshold, and audit risk is the concept that tells the auditor how much evidence is enough. Together they let the auditor concentrate effort where a misstatement could matter and accept less evidence where it could not. This lesson sets materiality for the Fairhaven audit, explains the audit risk model, and introduces the significant risks and fraud risks that receive special attention throughout the rest of the course.

What materiality means

Misstatements, including omissions, are material if they, individually or in aggregate, could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements. Three ideas follow from that definition. First, materiality depends on users, assumed to have a reasonable knowledge of business and accounting and to study the statements diligently. Second, it has both quantitative and qualitative aspects; a small misstatement can be material because of its nature. Third, it applies to aggregates, so many small misstatements can add up to a material one.

Qualitative factors can make a small amount material. A misstatement that turns a loss into a profit, hides a breach of a debt covenant, affects management's bonus, conceals an illegal payment, or misstates a segment that analysts watch closely may matter more than its size suggests. In Fairhaven's case, any misstatement that would push income before tax below the 12 million bonus target, or breach the bank's debt-to-equity covenant, would be material whatever its size.

Setting overall materiality

Auditing standards do not prescribe a formula, but practice has converged on benchmarks and rules of thumb. The auditor chooses a benchmark that users focus on and applies a percentage. For a profitable commercial company, income before tax from continuing operations is the usual benchmark, typically at about 5 per cent. Where profit is volatile or close to zero, revenue (0.5 to 1 per cent) or total assets (1 to 2 per cent) may be more stable. For not-for-profit organizations, total expenses or revenues are common.

# Materiality for the Fairhaven audit (thousands of dollars)
benchmarks = {                       # benchmark: (amount, typical percentage range)
    "Income before tax": (12_600, (0.05, 0.05)),
    "Revenue":           (184_000, (0.005, 0.01)),
    "Total assets":      (142_000, (0.01, 0.02)),
    "Equity":            (64_400, (0.01, 0.02)),
}
print(f"{'Benchmark':<20}{'Amount':>10}{'Range of materiality':>24}")
for name, (amt, (lo, hi)) in benchmarks.items():
    rng = f"{amt * lo:,.0f}" if lo == hi else f"{amt * lo:,.0f} to {amt * hi:,.0f}"
    print(f"{name:<20}{amt:>10,}{rng:>24}")

overall = round(0.05 * 12_600)       # chosen benchmark: income before tax, 5 per cent
performance = round(overall * 0.65 / 10) * 10   # 65 per cent, rounded to the nearest 10
trivial = round(overall * 0.05 / 10) * 10       # clearly trivial threshold, about 5 per cent
print(f"Overall materiality: {overall}")
print(f"Performance materiality: {performance}")
print(f"Clearly trivial threshold: {trivial}")

Benchmark               Amount    Range of materiality
Income before tax       12,600                     630
Revenue                184,000            920 to 1,840
Total assets           142,000          1,420 to 2,840
Equity                  64,400            644 to 1,288
Overall materiality: 630
Performance materiality: 410
Clearly trivial threshold: 30

Because Fairhaven is a profitable listed company and its income before tax is a stable, closely watched figure, Bramble Shaw chooses income before tax at 5 per cent, giving overall materiality of 630 thousand dollars. The firm considers whether any users would be influenced by smaller amounts in particular classes of transactions or disclosures, such as related party transactions or directors' remuneration, and sets lower specific materiality for those.

CAS 320 deals with materiality in planning and performing an audit, and CAS 450 with evaluating misstatements identified during the audit.

Performance materiality and the clearly trivial threshold

If the auditor planned each test to find only misstatements greater than 630, several undetected misstatements just below that amount could together exceed it. To leave a margin for undetected and uncorrected misstatements, the auditor sets performance materiality below overall materiality, usually between 50 and 75 per cent of it. Lower percentages apply where the risk is higher, such as a first-year audit, a history of many misstatements, or weak controls. Bramble Shaw uses 65 per cent, giving performance materiality of 410. Performance materiality drives sample sizes and the precision of substantive analytics.

The auditor also sets a threshold below which misstatements are clearly trivial and need not be accumulated, commonly 3 to 5 per cent of overall materiality. For Fairhaven, that is 30. Any misstatement above 30 goes on the summary of misstatements, which lesson 11 evaluates at the end of the audit.

Materiality is revised if new information would have caused the auditor to set a different amount. If, for example, final income before tax came in at 9 million because of large year-end write-downs, the auditor would reconsider materiality and possibly extend testing.

The audit risk model

Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. It has two components. The risk of material misstatement (RMM) is the risk that the statements are materially misstated before the audit; it belongs to the entity and the auditor assesses it but cannot change it. Detection risk is the risk that the auditor's procedures will not detect a misstatement that exists; the auditor controls it through the nature, timing and extent of procedures.

The risk of material misstatement has two components at the assertion level. Inherent risk is the susceptibility of an assertion to misstatement before considering controls. Control risk is the risk that a misstatement will not be prevented, or detected and corrected, on a timely basis by the entity's internal control. The model is usually written as a product.

Rearranged, it tells the auditor the detection risk it can accept for a given level of audit risk and assessed inherent and control risks.

The model is a planning tool, not a precise calculation. Auditors rarely assign exact probabilities; most firms use categories such as high, moderate and low. But the logic matters: the higher the assessed risk of material misstatement, the lower the acceptable detection risk, and the more persuasive the substantive evidence the auditor must obtain. The program below applies the model to five areas of the Fairhaven audit.

# The audit risk model: what detection risk can the auditor accept for each balance?
AR = 0.05                                   # acceptable audit risk
areas = {                                   # area: (inherent risk, control risk)
    "Revenue cut-off":          (1.0, 0.6),
    "Inventory valuation":      (1.0, 1.0),
    "Receivables existence":    (0.8, 0.5),
    "Payroll expense":          (0.5, 0.3),
    "Property, plant and equipment": (0.4, 0.5),
}
print(f"{'Area':<32}{'IR':>5}{'CR':>5}{'RMM':>7}{'Acceptable DR':>15}  Substantive work")
for a, (ir, cr) in areas.items():
    rmm = ir * cr
    dr = min(AR / rmm, 1.0)
    level = "extensive" if dr < 0.10 else "moderate" if dr < 0.25 else "limited"
    print(f"{a:<32}{ir:>5.1f}{cr:>5.1f}{rmm:>7.2f}{dr:>15.3f}  {level}")

Area                               IR   CR    RMM  Acceptable DR  Substantive work
Revenue cut-off                   1.0  0.6   0.60          0.083  extensive
Inventory valuation               1.0  1.0   1.00          0.050  extensive
Receivables existence             0.8  0.5   0.40          0.125  moderate
Payroll expense                   0.5  0.3   0.15          0.333  limited
Property, plant and equipment     0.4  0.5   0.20          0.250  limited

For inventory valuation, inherent risk is high because of obsolescence and the new warehouse system, and the auditor plans not to rely on controls, so control risk is set at the maximum. Acceptable detection risk is 5 per cent: substantive procedures must do all the work. For revenue cut-off, the auditor plans to test controls over shipping and invoicing, and if those tests support a control risk of 0.6, acceptable detection risk is about 8 per cent, still requiring extensive work. Payroll, a routine, well-controlled process, can be audited mainly with substantive analytics.

Inherent risk factors and the spectrum of risk

CAS 315 (Revised 2019) asks the auditor to assess inherent risk on a spectrum, considering inherent risk factors: complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or fraud. A balance is higher on the spectrum when these factors increase the likelihood or the magnitude of a possible misstatement. Control risk is assessed separately; if the auditor does not plan to test controls, control risk is assessed at the maximum.

Significant risks

Some risks of material misstatement sit at the upper end of the spectrum. A significant risk is one for which the assessment of inherent risk is close to the upper end because of the likelihood and magnitude of a potential misstatement, or one that the standards require to be treated as significant. Two risks are presumed significant in every audit: the risk of management override of controls, which can never be rebutted, and the risk of fraud in revenue recognition, which can be rebutted only in rare cases, such as a company with a single, simple type of revenue.

For significant risks, the auditor must understand the related controls, cannot rely solely on evidence about controls from prior audits, and must perform substantive procedures that respond specifically to the risk; substantive analytics alone are not enough. These risks are also typically reported to those charged with governance and are candidates for discussion in the auditor's report as key or critical audit matters (lesson 12).

Assessing risk at two levels

Risks exist at two levels. Financial-statement-level risks are pervasive: they affect many assertions and cannot be tied to a single account. Weak tone at the top, a lack of competent accounting staff, going concern doubts and pressure to meet analysts' expectations are examples. The response is overall, such as assigning more experienced staff, increasing supervision, adding unpredictability to procedures or changing the timing of work. Assertion-level risks relate to specific classes of transactions, balances and disclosures, such as the existence of receivables or the valuation of inventory, and are addressed with specific further audit procedures. Lesson 6 develops those responses.