Audit and Assurance · Assessing audit risks

Identifying Business Risks and Risks of Material Misstatement in ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

A business risk is a threat to the entity achieving its objectives. A risk of material misstatement (RMM) is the risk that the financial statements contain a material error or fraud. To solve AA questions, take each scenario fact, state the business risk, then name the affected balance and the misstatement that could result.

Understand Identifying Business Risks and Risks of Material Misstatement

Start with the entity. Every business has objectives, and anything that threatens them is a business risk. Examples are a new competitor, a new law, a system change or a key customer leaving.

The auditor does not give an opinion on business risk. The auditor gives an opinion on the financial statements. So the auditor asks one question: could this business risk cause the financial statements to be materially wrong? If yes, it creates a risk of material misstatement (RMM).

RMM sits at two levels. Financial statement level risks affect the statements as a whole, for example weak management integrity, a new finance team or pressure to meet profit targets. Assertion level risks affect a specific balance, transaction or disclosure, for example inventory valuation or revenue occurrence.

RMM has two parts: inherent risk (how likely a balance is to be misstated before considering controls) and control risk (the risk that controls will not prevent or detect the misstatement). Detection risk is the auditor's own risk of missing it, and it is set in response to the assessed RMM.

A significant risk is an RMM that needs special audit consideration because of its nature or size. Fraud risks, including revenue recognition, and management override of controls are treated as significant. Complex estimates and unusual transactions are often significant too. In the exam, always connect fact, risk, balance and effect.

Key rules to remember

Audit risk: Audit risk = Risk of material misstatement × Detection risk; A conceptual model, not a calculation. Higher RMM means the auditor must lower detection risk by doing more or better work.
Risk of material misstatement: RMM = Inherent risk × Control risk; Conceptual. ISA 315 (Revised) requires inherent and control risk to be assessed separately at assertion level.
Scenario link: Scenario fact → business risk → financial statement area → possible misstatement; Use this chain for every point you make in a written answer.
Business risk test: Business risk matters to the audit only if it could cause material misstatement; Risks with no effect on the financial statements earn few marks.

How to solve Identifying Business Risks and Risks of Material Misstatement questions

Use this method for any Section B case question or Section C requirement that asks for audit risks or risks of material misstatement.

1Read the requirement. Note whether it asks for business risks, RMM, or both, and how many points are needed.
2Read the scenario and underline facts that signal change, pressure, complexity, new systems, new staff, estimates or unusual transactions.
3For each fact, state the business risk in one short phrase.
4Link it to a specific balance or disclosure in the financial statements, such as revenue, inventory, receivables, provisions or going concern.
5State the misstatement: overstated or understated, and which assertion is affected, such as valuation, occurrence, completeness or cut-off.
6Use figures from the scenario. Compare size with profit or total assets to judge materiality.
7Mark any fraud, management override or complex estimate risks as significant.
8Check that each point is separate and your count matches the marks available.

Quickest way: Fact, risk, balance, effect in one sentence

When to use it: Use under time pressure in Section C, where each risk is worth about one to two marks.

Scan the scenario once and tick every fact that looks unusual or new.
Write one sentence per fact in this pattern: 'Because [fact], there is a risk that [balance] is [overstated/understated] as [reason].'
Add the assertion in brackets only if time allows.
Put a short label such as significant risk where fraud or estimates are involved.
Stop when you have one more point than the marks needed.

Common mistakes in Identifying Business Risks and Risks of Material Misstatement

Listing business risks without linking to the financial statements.
Students describe the commercial threat because it is easy to spot.
Fix: Always finish with the balance affected and the likely misstatement.
Writing vague statements such as 'there is a risk of error'.
Students rush and do not name a balance or direction.
Fix: Name the item, say overstated or understated, and give the reason from the scenario.
Confusing audit risk with business risk.
Both use the word risk and both appear in the same chapter.
Fix: Business risk concerns the entity's objectives. Audit risk is the risk of giving an inappropriate opinion. RMM links the two.
Ignoring materiality.
Students treat every fact as a risk.
Fix: Compare amounts with profit or assets. Small items rarely earn marks as significant risks.
Writing audit procedures when only risks are asked.
Students recall procedures more easily than risk reasoning.
Fix: Answer the requirement exactly. Procedures earn no marks in a risk question.
Missing fraud and management override.
Students focus on errors and overlook incentives, such as bonuses or loan covenants.
Fix: Look for profit targets, pressure and unusual transactions, then state the fraud risk.

Worked examples

Example 1

Zeta Co sells electronics. Profit before tax is $2m. In the year it launched an online store using a new IT system, and the finance director's bonus depends on revenue growth. Inventory of $1.5m includes older models that now sell at discounts. Identify three risks of material misstatement (6 marks).

Show the solution

Fact 1: new online store and new IT system. Business risk: data may not transfer or process correctly.
Link: revenue and receivables may be misstated, for example sales recorded twice or not recorded (occurrence and completeness).
Fact 2: the bonus depends on revenue growth. Business risk: pressure on management to meet targets.
Link: revenue may be overstated through early recognition or fictitious sales. This is a fraud risk, so treat it as significant.
Fact 3: older models sold at discounts. Business risk: falling selling prices.
Link: inventory of $1.5m is large relative to profit of $2m, and may be overstated if cost exceeds net realisable value (valuation, IAS 2).

Answer: 1) New IT system: revenue and receivables may be misstated through processing errors. 2) Bonus linked to revenue: revenue may be overstated through manipulation, a significant fraud risk. 3) Discounted old models: inventory may be overstated if held above net realisable value, which is material compared with profit.

Example 2

Kali Co, a manufacturer, has a bank loan with a covenant requiring a current ratio above 1.2. The ratio is currently 1.25. A major customer, 30% of sales, has just gone into administration and owes $400,000 at the year end. Explain the business risks and the related risks of material misstatement (6 marks).

Show the solution

Business risk 1: breach of the loan covenant. The headroom is small, so a minor change in current assets or liabilities could cause a breach.
Link: management has an incentive to overstate current assets or understate current liabilities, so there is a risk of misstatement or window dressing.
Business risk 2: loss of a customer that provides 30% of sales.
Link: receivables of $400,000 may be overstated because the customer may not pay. This is a valuation risk and may need an irrecoverable debt allowance.
Link: the revenue loss and the covenant risk may threaten going concern, so the going concern basis and disclosures may be inappropriate.
Impairing the debt would reduce current assets, which makes the covenant breach more likely and increases the incentive to avoid impairment.

Answer: Covenant pressure creates a risk that current assets are overstated or current liabilities understated. The $400,000 receivable from the customer in administration may be overstated, which is a valuation issue. The loss of 30% of sales, together with a possible covenant breach, raises going concern risk and the risk of inadequate disclosure. These are significant risks because of the incentive to manipulate and the use of judgement.

Exam tips

Show the chain fact, risk, balance and effect in every point. This is where marks are earned.
Use numbers from the scenario and compare them with profit or total assets to show materiality.
Read the requirement carefully. Business risk, RMM and audit procedures earn marks in different questions.
In objective test cases, remember that RMM is the combination of inherent and control risk, and detection risk is the auditor's own response.

Identifying Business Risks and Risks of Material Misstatement in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Identifying Business Risks and Risks of Material Misstatement: frequently asked questions

What is the difference between business risk and risk of material misstatement?

Business risk is a threat to the entity's objectives. Risk of material misstatement is the risk that the financial statements are materially wrong. A business risk becomes an RMM only when it could affect the financial statements.

How do I identify audit risks from an ACCA AA scenario?

Look for change, pressure, complexity and weak controls in the scenario. For each fact, name the balance affected and whether it may be overstated or understated. Check the amount against profit or assets.

What makes a risk significant?

A significant risk needs special audit attention because of its nature or size. Fraud risks, including revenue recognition and management override of controls, are the usual examples. Complex estimates and unusual transactions are also often significant.

Is detection risk part of the risk of material misstatement?

No. RMM is inherent risk and control risk, which exist in the entity. Detection risk is the risk that the auditor's procedures miss a misstatement, and the auditor sets it in response to RMM.