IDENTIFYING AND ASSESSING THE RISK OF MATERIAL continue the engagement, and there is no

MISTATEMENT misunderstanding with the client as to the terms of

the engagement.
Audit Opinion Formulation Process
• overall audit strategy sets the scope, timing and
direction of the audit, and that guides the
development of the audit plan such as the
resources to deploy for specific audit areas
Risk Assessment Risk Response Reporting
• audit plan can be developed to address the various
matters identified in the overall audit strategy,
taking into account the need to achieve the audit
objectives through the efficient use of the auditor’s
resources.
Phase I – Risk Assessment • the auditor shall document:
• Preconditions for an audit (a) The overall audit strategy;
• Engagement letter
• Identifying RoMM (b) The audit plan; and
• Respond to identify risks of RoMM (c) Any significant changes made during the audit
Phase II – Risk Response engagement to the overall audit strategy or the audit plan,
and the reasons for such changes.
• Select controls to test
• additional considerations:
• Perform test of controls
• Result of TOC a. Performing procedures required by PSA 220
• Perform substantive tests regarding the acceptance of the client relationship and the
specific audit engagement; and
Phase III – Reporting
b. Communicating with the predecessor auditor,
• Complete review and communication activities where there has been a change of auditors, in compliance
• Determine the appropriate type of opinion to issue with relevant ethical requirements.
• planning is not a discrete phase of an audit, but
PLANNING AN AUDIT OF FINANCIAL STATEMENTS rather a continual and iterative process

• engagement partner and other key members of the ---------------------------------------------------------------------------------

engagement team shall be involved in planning the IDENTIFYING AND ASSESSING THE RISKS OF
audit, including planning and participating in the MATERIAL MISSTATEMENT THROUGH
discussion among engagement team members. UNDERSTANDING THE ENTITY AND ITS ENVIRONMENT

• preliminary engagement activities include: Audit Risk- the risk that an auditor gives an incorrect
opinion on financial statements, even when those
a. Performing procedures required by PSA 220, statements contain material misstatements. (There is an
“Quality Control for Audits of Historical Financial Information” inverse relationship between materiality and audit risk)
regarding the continuance of the client
Risk of Material Misstatement - the probability that a
relationship and the specific audit engagement; company's financial statements contain errors or fraud that
are significant enough to alter a user's understanding of the
b. Evaluating compliance with ethical requirements,
company's financial position
including independence, as required by PSA 220;
and Risk assessment procedures – The audit procedures
performed to obtain an understanding of the entity and its
b. Establishing an understanding of the terms of the
environment, including the entity’s internal control, to identify
engagement, as required by PSA 210, “Terms of
and assess the risks of material misstatement, whether
Audit Engagements.”
due to fraud or error, at the financial statement and assertion
• Example: The auditor maintains the necessary levels.
independence and ability to perform the
• Risk assessment procedures by themselves, do not
engagement, there are no issues with management
provide sufficient appropriate audit evidence on
integrity that may affect the auditor’s willingness to
which to base the audit opinion.
 • Include inquiries of management, analytical the achievement of an entity’s objectives with regard to
procedures, and observation and inspection reliability of financial reporting, effectiveness and efficiency
of operations, and compliance with applicable laws and
• Auditor’s assessment of the risks of material regulations. Components are as follows:
misstatement at the assertion level may change
during the course of the audit as additional audit [Link] environment: evaluate whether Management, with
evidence is obtained the oversight of those charged with governance, has created
and maintained a culture of honesty and ethical behavior;
Audit Risk - Detection Risk (DR) x RoMM and the strengths in the control environment elements
RoMM = Inherent Risk (IR) x Control Risk (CR) collectively provide an appropriate foundation for the other
components of internal control
Inherent Risk - susceptibility of an assertion (a claim about
the financial statements) to misstatement, assuming there [Link] assessment process: obtain an understanding of
are no related internal controls. It's a measure of how easily whether the entity has a process for:
a particular area of the financial statements could be (a) Identifying business risks* relevant to financial reporting
misstated due to its nature or the environment it operates in. objectives;
Control Risk - This is the risk that a material misstatement (b) Estimating the **significance of the risks;
will not be prevented or detected on a timely basis by the
entity's internal controls. It reflects the effectiveness of the (c) Assessing the likelihood of their occurrence; and
company's internal controls in mitigating potential
(d) Deciding about actions to address those risks.
misstatements.
iii. Control activities relevant to the audit: to assess
Detection Risk - the possibility that an auditor's procedures
the risks of material misstatement at the assertion
will fail to detect a material misstatement that exists in the
financial statements. level and design further audit procedures
responsive to assessed risks.
Allowable detection risk or Planned detection risk is the
amount of risk the auditor can allow for an assertion or a iii. Monitoring of controls: obtain understanding and
measure of the risk that audit evidence for a segment will fail how the entity initiates corrective actions to its
to detect misstatements exceeding a tolerable amount, controls.
should such misstatements exist. *Business risk – A risk resulting from significant conditions,
- It determines the amount of substantial evidence events, circumstances, actions or inactions that could
adversely affect an entity’s ability to achieve its objectives
that the auditor plans to accumulate, inversely with
and execute its strategies, or from the setting of
the size of planned detection risk.
inappropriate objectives and strategies.
PDR = AAR/ (IRxCR)
**Significant risk – An identified and assessed risk of
Required Understanding of the Entity and its
Environment, Including the Entity’s Internal Control material misstatement that, in the auditor’s judgment,
requires special audit consideration. In exercising judgment
a. Entity and Its Environment (relevant industry, as to which risks are significant risks, the auditor shall
regulatory, and other external factors including the
consider at least the following:
applicable financial reporting framework, the nature of the
entity, entity’s selection and application of accounting • Whether the risk is a risk of fraud;
policies, entity’s objectives and strategies, and those related
business risks that may result in risks of material • Whether the risk is related to recent significant
misstatement, and measurement and review of the entity’s economic, accounting or other developments and,
financial performance) therefore, requires specific attention;

b. Entity’s Internal Control (matter of the auditor’s • The complexity of transactions;

professional judgment whether a control, individually or in • Whether the risk involves significant transactions
combination with others, is relevant to the audit) with related parties
• auditor shall evaluate the design and • The degree of subjectivity in the measurement of
implementation of those controls other than inquiry financial information related to the risk, especially
(such as walkthrough) those measurements involving a wide range of
Internal control – The process designed, implemented and measurement uncertainty; and
maintained by those charged with governance, management
and other personnel to provide reasonable assurance about
 • Whether the risk involves significant transactions
that are outside the normal course of business for
the entity, or that otherwise appear to be unusual.
If significant risks exist, the auditor shall obtain an
understanding of the entity’s controls, including control
activities, relevant to that risk.
• Auditor identify risks of material misstatements at:
a. The financial statement level
b. The ***assertion level for classes of transactions,
account balances, and disclosures
***Assertions – Representations by management, explicit or
otherwise, that are embodied in the financial statements, as
used by the auditor to consider the different types of
potential misstatements that may occur.
---------------------------------------------------------------------------------