Assessing audit risks: formula sheet

Key formulas

Audit risk model

Audit risk = Inherent risk × Control risk × Detection risk

A conceptual model, not a calculation with real figures in most exams. Each component is assessed as high, medium or low.

Risk of material misstatement

RMM = Inherent risk combined with Control risk

ISA 315 (Revised) requires you to assess inherent and control risk separately at assertion level. RMM is the combination of the two. It is a judgement, not an arithmetic product. You carry it into your response.

Link to detection risk

Higher RMM → lower acceptable detection risk → more substantive work

Detection risk is the only component you can change. It is inversely related to RMM.

Controls and risk

Controls tested and effective → support a lower assessed control risk → less substantive testing

Testing does not change the client's actual control risk. It only supports a lower assessment. If controls are weak or not tested, assess control risk as high and rely on substantive procedures.

Audit risk

Audit risk = Inherent risk × Control risk × Detection risk (= RMM × Detection risk)

This is a conceptual model, not a numerical calculation. Audit risk is the risk of giving an inappropriate opinion. RMM = inherent risk × control risk. Risk assessment procedures help you assess RMM, which drives how low detection risk must be.

Risk of material misstatement

RMM = Inherent risk × Control risk

ISA 315 (Revised) requires you to assess inherent risk and control risk separately at assertion level. This is a model, not a calculation with numbers.

Risk assessment procedures

Inquiries + Analytical procedures + Observation and inspection

These are the types of procedure included. You select the mix needed. Inquiry alone is not sufficient.

Areas to understand

Industry/regulatory/external factors + Nature of entity + Accounting policies + Objectives, strategies and business risks + Performance measurement + Internal control

A useful checklist for any scenario question.

Audit risk

Audit risk = Risk of material misstatement × Detection risk

A conceptual model, not a calculation. Higher RMM means the auditor must lower detection risk by doing more or better work.

Risk of material misstatement

RMM = Inherent risk × Control risk

Conceptual. ISA 315 (Revised) requires inherent and control risk to be assessed separately at assertion level.

Scenario link

Scenario fact → business risk → financial statement area → possible misstatement

Use this chain for every point you make in a written answer.

Business risk test

Business risk matters to the audit only if it could cause material misstatement

Risks with no effect on the financial statements earn few marks.

Overall materiality

Overall materiality = benchmark × chosen percentage

Benchmarks include profit before tax, revenue, total assets. Use the percentage given in the question.

Performance materiality

Performance materiality = overall materiality × a lower percentage (often 50% to 75%)

Firm policy sets the range. Use the percentage in the question. Lower it when risk is higher.

Overall materiality as a ratio

Misstatement ÷ benchmark × 100 = % of benchmark

Use it to test whether an item is above or below a threshold.

Benchmark for a revised figure

Adjusted profit = draft profit ± proposed adjustments

If a question says to use adjusted figures, recalculate the benchmark before applying the percentage.

Qualitative rule

Material if size or nature could influence users' decisions

A small item can be material because of its nature, even if below the calculated figure.

Revenue growth

(Current revenue − Prior revenue) ÷ Prior revenue × 100

Compare with industry growth and with changes in costs and receivables.

Gross profit margin

Gross profit ÷ Revenue × 100

An unexpected change may point to cut-off errors, inventory errors or pricing changes.

Operating profit margin

Operating profit ÷ Revenue × 100

Shows whether expenses are moving in line with sales.

Current ratio

Current assets ÷ Current liabilities

Low or falling values may signal going concern or liquidity risk.

Quick ratio

(Current assets − Inventory) ÷ Current liabilities

Use when inventory is slow-moving or hard to value.

Receivables days

Trade receivables ÷ Revenue × 365

Rising days may indicate overstated revenue or irrecoverable debts.

Inventory days

Inventory ÷ Cost of sales × 365

Rising days may indicate obsolete inventory or overvaluation.

Payables days

Trade payables ÷ Cost of sales × 365

Rising days may indicate cash pressure. Unexpectedly falling days may indicate unrecorded liabilities (completeness).

Gearing

Debt ÷ Equity × 100 (or Debt ÷ (Debt + Equity) × 100)

State which version you use. Check for covenant and going concern risk.

Interest cover

Operating profit ÷ Finance costs

Low cover signals difficulty servicing debt.

Core rule

Expectation vs actual → unusual difference → possible risk of material misstatement → audit response

Use this chain for every ratio you comment on.

Fraud triangle

Fraud risk = Incentive/pressure + Opportunity + Rationalisation/attitude

Use it to structure fraud risk factors in a scenario. It is a framework, not a calculation.

Presumed fraud risks (ISA 240)

Revenue recognition (presumed risk) + Management override of controls (always a significant risk)

Treat both as significant risks. Management override applies to every audit; the revenue presumption can be rebutted only with a documented reason.

Responsibility split

Management/TCWG: prevent and detect fraud. Auditor: reasonable assurance that statements are free from material misstatement.

Never say the auditor is responsible for preventing fraud.

Fraud vs error test

Fraud = intentional act. Error = unintentional act.

Intent is the only distinguishing feature.

Going concern indicator groups

Financial + Operating + Other

Sort each indicator in the scenario into a group, then state the audit implication.

Audit strategy (ISA 300)

Strategy = scope + timing + direction of the audit

Overall and high level. Guides development of the detailed plan.

Audit plan (ISA 300)

Plan = nature + timing + extent of procedures

Covers risk assessment procedures and further audit procedures at assertion level.

Audit risk

Audit risk = risk of material misstatement (inherent risk × control risk) × detection risk

Audit risk is the risk the auditor accepts of giving an inappropriate opinion, and it is set at an acceptably low level. The multiplicative form is a conceptual model, not a precise calculation. Use it to see the relationship: higher assessed risk of material misstatement means lower acceptable detection risk and more audit work.

Risk response

Higher risk → more extensive, more reliable, more testing at or after year end, more senior staff

Use this as the checklist when asked how risk affects the approach. Year-end testing is a tendency, not a rule: interim work can be used if it is adequately rolled forward.

Quick revision

• Audit risk = risk of material misstatement × detection risk.
• Risk of material misstatement combines inherent risk and control risk.
• The auditor cannot change inherent or control risk; detection risk is the one the auditor controls through procedures.
• Risk assessment procedures include enquiry, analytical procedures, and observation and inspection.
• Business risks can lead to risks of material misstatement, but not every business risk does.
• Materiality is a matter of judgement, often based on a benchmark such as profit or revenue.
• Performance materiality is set below materiality to reduce the chance that uncorrected and undetected errors add up to a material amount.
• Unusual ratio movements point to areas for closer audit work; they are not proof of error.
• Fraud risks need professional scepticism, and management override of controls is always presumed to be a risk.
• Going concern indicators can be financial, operational or other, and the auditor evaluates management's assessment.
• The audit strategy sets scope, timing and direction; the audit plan details the procedures.
• Consider ethics, competence and integrity of the client before accepting an engagement.

Common mistakes

• Saying the auditor can reduce inherent or control risk. Fix: Inherent and control risks exist in the client. Only detection risk is changed by your procedures.
• Mixing up inherent risk and control risk. Fix: Ask whether the problem exists even with perfect controls. If so, it is inherent. If it is about a control failing, it is control risk.
• Treating business risk and audit risk as the same thing. Fix: Business risk relates to the entity's objectives. Audit risk is the risk of an inappropriate opinion on materially misstated statements. Say how a business risk could lead to misstatement.
• Relying on inquiry alone as evidence about the entity. Fix: Corroborate answers by inspecting documents, observing operations or using analytical procedures. Inquiry alone does not provide sufficient appropriate evidence for risk assessment.
• Listing business risks without linking to the financial statements. Fix: Always finish with the balance affected and the likely misstatement.
• Writing vague statements such as 'there is a risk of error'. Fix: Name the item, say overstated or understated, and give the reason from the scenario.
• Using the wrong benchmark, such as profit for a loss-making company. Fix: Check the entity first. If profit is negative, tiny or volatile, use revenue or assets.
• Setting performance materiality higher than overall materiality. Fix: Performance materiality is always lower. Its purpose is to leave a margin for errors that add up.
• Calculating ratios but not saying what they mean for the audit. Fix: Always end each point with the risk of material misstatement or the area needing more work.
• Saying analytical procedures prove balances are correct. Fix: At planning they only identify risk. They give limited evidence and do not confirm figures.

Exam tips

• Use the exact terms inherent, control and detection risk and define each briefly. Marks are often given for correct definitions.
• In scenarios, quote the fact and then name the risk type. A fact without a label, or a label without a fact, scores less.
• Always finish with the effect on audit procedures. Examiners reward responses that are linked to nature, timing and extent.
• In objective questions, look for the trap: the auditor cannot change inherent or control risk.
• Do not write about every risk type if the requirement asks for one. Answer the requirement.
• In Section A objective test cases, watch for options saying inquiry alone is enough. That is wrong.
• In Section A or B, distinguish business risk from audit risk by asking whose risk it is: the entity's objectives or the auditor's opinion.
• For written answers, tie every risk to a scenario fact and an assertion. Generic answers score few marks.