Planning, materiality and assessing the risk of material misstatement: formula sheet

Key formulas

ISA 210 preconditions

Acceptable framework + management's agreement to its responsibilities

Both must be met before you accept an audit. Management's responsibilities are preparing the statements, internal control, and access to information and people.

Acceptance considerations

Integrity + ethics and independence + competence and resources + risk

Use these as headings to structure any acceptance answer.

Engagement letter content

Objective and scope + responsibilities + framework + report form and content

Add fees and other practical terms if the scenario mentions them.

Limitation on scope

Management imposes a scope limit that is likely to lead to a disclaimer of opinion → do not accept as an audit

Applies where the limitation is imposed before acceptance. It is not the same as a limit found during the audit.

Risk assessment procedures

Inquiries + analytical procedures + observation and inspection

These are the types of risk assessment procedures the standard requires you to perform. Inquiry alone does not provide sufficient appropriate audit evidence for the risk assessment.

Components of the system of internal control

Control environment, entity's risk assessment process, process to monitor the system, information system and communication, control activities

ISA 315 (Revised 2019) sets these out as five components. Know the five names.

Audit risk

Audit risk = risk of material misstatement × detection risk

A conceptual relationship, not a calculation with fixed figures. RMM is assessed at both the financial statement level and the assertion level. At the assertion level, inherent risk and control risk are assessed separately.

Assessing inherent risk

Inherent risk is assessed by likelihood and magnitude of possible misstatement

Consider the inherent risk factors: complexity, subjectivity, change, uncertainty and susceptibility to misstatement due to management bias or fraud.

Levels of RMM

Financial statement level and assertion level

Pervasive risks sit at financial statement level. Assertion-level risks are tied to a class of transactions, balance or disclosure.

Overall materiality

Overall materiality = benchmark × chosen percentage

ISA 320 gives no fixed percentages. Use the rate given in the question. Say why you chose the benchmark.

Performance materiality

Performance materiality < overall materiality

Often expressed as a percentage of overall materiality. Lower it when risk is higher.

Specific materiality

Specific materiality < overall materiality

Used for items users are sensitive to, such as related party transactions or directors' pay.

Revision rule

If new information would have led to a different amount, revise materiality and reassess the procedures

ISA 320 requires revision if information comes to light during the audit that would have caused a different amount to be set.

Audit risk model

Audit risk = Risk of material misstatement × Detection risk

A conceptual model, not a calculation. Higher RMM means you must lower detection risk by doing more or better work.

Components of RMM

RMM is a combination of inherent risk and control risk, assessed separately at assertion level

This is conceptual, not an arithmetic product. ISA 315 requires separate assessments of inherent and control risk at assertion level. Do not merge them in your answer.

Detection risk and RMM

Higher RMM → lower acceptable detection risk → more extensive, more reliable evidence

This is the logic behind ISA 330. State the link explicitly.

Levels of assessment

Financial statement level (pervasive) and assertion level (specific)

Financial statement level risks get overall responses. Assertion level risks get specific further procedures.

Significant risk requirements

Significant risk → evaluate design and implementation of controls + substantive procedures specific to the risk. If the response is solely substantive procedures, they must include tests of details.

Tests of controls alone are not enough. Analytical procedures alone are not enough where the response is solely substantive. If you plan to rely on controls over a significant risk, you must test those controls in the current period (ISA 330). This is not a general requirement for all controls.

Assertion examples

Transactions: occurrence, completeness, accuracy, cutoff, classification. Balances: existence, rights and obligations, completeness, accuracy, valuation and allocation. Presentation and disclosure: occurrence and rights and obligations, completeness, classification and understandability, accuracy and valuation.

Tie every risk to an assertion so your response is targeted.

Fraud triangle

Fraud = Incentive or pressure + Opportunity + Attitude or rationalisation

Use it to organise risk factors in a scenario. Label each fact under one of the three sides.

ISA 240 presumed risks

Revenue recognition (presumed, rebuttable) + Management override of controls (always, cannot be rebutted)

The presumption that revenue recognition is a fraud risk may be rebutted only where the auditor concludes, in the circumstances of the engagement, that it is not applicable. The reasons must be documented. Management override cannot be rebutted.

Responsibility split

Management and TCWG: prevent and detect. Auditor: reasonable assurance.

Never say the auditor is responsible for preventing fraud.

ISA 250 two categories

Direct-effect laws: obtain sufficient appropriate audit evidence about compliance. Other laws: enquiry of management and, where appropriate, TCWG, plus inspection of correspondence with licensing or regulatory authorities.

Tax and pension laws are direct-effect examples. Operating licences are examples of the second group, where the procedures help identify non-compliance that may have a material effect.

ISA 570 period

Management's going concern assessment covers at least 12 months from the date of approval of the financial statements (ISA 570 (Revised 2024))

If management covered a shorter period, the auditor asks management to extend it. The auditor also considers events or conditions beyond that period.

Strategy versus plan

Strategy = scope + timing + direction; Plan = nature + timing + extent of procedures

Use this to answer 'difference' questions. The strategy guides the plan.

Analytical procedure test

Expectation vs recorded amount; investigate if difference > threshold

Develop the expectation first. Set the threshold from performance materiality and the reliability of data.

Gross profit margin

Gross profit margin = (Revenue − Cost of sales) ÷ Revenue × 100

A sudden change may signal revenue or cost cut-off errors.

Receivables days

Receivables days = Trade receivables ÷ Revenue × 365

A rise may signal overstated receivables or weak recoverability.

Payables days

Payables days = Trade payables ÷ Cost of sales × 365

A fall may signal understated liabilities, or a cash-rich business.

Inventory days

Inventory days = Inventory ÷ Cost of sales × 365

A rise may signal obsolete stock or overstated inventory.

Current ratio

Current ratio = Current assets ÷ Current liabilities

Useful for going concern and liquidity risk.

Interest cover

Interest cover = Profit before interest and tax ÷ Finance costs

A low figure raises going concern and covenant risk.

Quick revision

• Acceptance and continuance: consider integrity of management, competence and resources, independence and ethical threats.
• Understanding the entity covers industry, regulation, nature of the entity, accounting policies, objectives and strategies, performance measurement and internal control.
• Materiality is a judgement based on what influences users' economic decisions, not a fixed percentage.
• Choose a benchmark that suits the entity, such as profit, revenue or assets, and justify it.
• Performance materiality is set below materiality to reduce the risk that uncorrected and undetected misstatements together exceed materiality.
• Risk of material misstatement is inherent risk combined with control risk.
• Assess risks at both financial statement level and assertion level.
• Significant risks need a specific response and understanding of the related controls.
• Fraud: auditors must maintain scepticism and assess fraud risk, including management override and revenue recognition.
• Going concern: assess management's assessment and consider events or conditions that cast doubt on it.
• The audit strategy sets scope, timing and direction, and the audit plan sets out detailed procedures.
• Analytical procedures at planning help identify unusual relationships and risk areas, but they need reliable expectations.

Common mistakes

• Listing generic acceptance steps without using the scenario Fix: Tie each point to a specific fact in the case, such as a new owner, a fee dispute or a short deadline.
• Confusing the preconditions with the engagement letter contents Fix: Preconditions decide whether you can accept. The letter records the terms once you have accepted.
• Listing business risks without linking them to the financial statements. Fix: Always add: so which balance, which assertion, and what could be misstated.
• Treating business risk and risk of material misstatement as the same thing. Fix: Define each in a line. Business risk affects objectives. RMM affects the financial statements. Show how the first can create the second.
• Using profit before tax when the company is making a loss or profit is unusual. Fix: Test the benchmark against the scenario. Switch to revenue, total assets or an average if profit is not representative.
• Confusing overall and performance materiality. Fix: Overall materiality is about users' decisions. Performance materiality is lower and drives audit procedures and sampling.
• Writing generic risks such as 'there may be errors in inventory'. Fix: Quote the scenario fact, name the assertion, and say what could go wrong. For example, 'slow-moving stock of ₹40,00,000 may be overvalued'.
• Confusing inherent risk and control risk. Fix: Ask whether the risk exists before any controls (inherent) or arises because controls are weak or missing (control).
• Saying the auditor is responsible for preventing fraud. Fix: State that management and those charged with governance prevent and detect fraud. The auditor obtains reasonable assurance.
• Listing fraud triangle headings without linking to the scenario. Fix: Quote the scenario fact, label the side of the triangle, then say what could be misstated.

Exam tips

• Always give a recommendation. Accept, accept with conditions, or decline, and say who should approve it.
• Use scenario facts. Most marks go to application, not recall of ISA 210.
• Link integrity concerns to ownership, management behaviour, fees and the reasons for the change of auditor.
• Name the ISA 210 preconditions precisely when the scenario involves a framework, access or scope issue.
• Show professional scepticism and commercial awareness in your wording, for example by questioning why the client wants a change.
• Always tie each business risk to a financial statement account and assertion. This is where most marks are won.
• Use the figures and names in the scenario. Generic answers score poorly.
• If the requirement asks about the system of internal control, structure your answer by the five components.