Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics

Materiality, Risk Assessment and Internal Control: CA Final Audit Chapter Guide

This chapter covers how an auditor sets materiality (SA 320), understands the entity and its internal control (SA 315), identifies and assesses risks of material misstatement, and reports control deficiencies (SA 265). To solve questions, read the case facts, link each fact to a risk or control, then answer in provision, facts, conclusion form.

What this chapter covers

This chapter is the base of the risk-based audit. Materiality tells you how much error matters. Risk assessment tells you where errors are most likely. Internal control tells you how far you can rely on the client's own systems. Together they decide the nature, timing and extent of your audit procedures.

The flow is simple. You set materiality and performance materiality. You understand the entity, its environment and its internal control. You use that understanding to identify and assess risks of material misstatement at the financial statement level and the assertion level. Where you find control deficiencies, you communicate them under SA 265.

The rest of the paper depends on this chapter. Audit planning, audit evidence, sampling, the use of IT, group audits, going concern, reporting and quality management all assume that you can link a risk to a response. If you are weak here, case scenarios in other chapters will also feel hard.

Papers 1 to 5, including Paper 3, carry 30% case-scenario or case-study based MCQs and 70% descriptive questions. In both parts you must apply the standards to facts about a client. Facts about a risk, a control weakness or a materiality judgement call for this chapter. If you can classify the facts quickly and quote the right SA requirement, you score in this chapter and also in planning, evidence and reporting questions. The Paper 6 case studies also expect you to use these ideas when an audit angle appears. The chapter is conceptual, so a clear method gives you marks without heavy memorising.

Materiality, Risk Assessment and Internal Control: topics in the order to study them

  1. 1Materiality and Performance Materiality (SA 320)Start here because it is the simplest idea and every later risk and evidence decision uses a materiality figure.
  2. 2Understanding the Entity and Its Environment (SA 315)Risk comes from the business, so you must know how the auditor learns about industry, objectives, strategy and financial performance before judging risk.
  3. 3Components of Internal Control under SA 315Once you know the entity, you study the five components of its internal control, which is the second half of the required understanding.
  4. 4Manual and Automated Controls and IT RisksThis builds on the components by showing how controls work in an IT environment and what new risks arise.
  5. 5Identifying and Assessing Risks of Material MisstatementThis pulls everything together: you use the entity, control and IT understanding to assess risk at both levels, including significant risks.
  6. 6Communicating Deficiencies in Internal Control (SA 265)Study it last because it is the output of the control work: what you found, how serious it is and whom you tell.

How to prepare Materiality, Risk Assessment and Internal Control

Treat this chapter as one connected chain, not six separate topics. Practise applying it to short case facts, since that is how it is examined.

  1. Read the six topics in the given order and draw one flow chart: materiality, understanding, controls, risk assessment, response, communication.
  2. For each SA, list its objective, the key requirements and the terms it defines. Learn the definitions in your own words, such as performance materiality and significant deficiency.
  3. Memorise the five components of internal control and one example of each. Then practise tagging a case fact to the right component.
  4. Make a two-column sheet for IT: general IT controls on one side and application controls on the other. Add the typical IT risks next to them.
  5. Solve case scenarios by asking three questions: what is the risk, at which level does it sit, and what is the auditor's response. Write the answer in provision, facts, conclusion form.
  6. Practise SA 265 questions by classifying a deficiency, deciding whether it is significant, and drafting who should be told and in what form.
  7. Revise by writing the chain from memory once a week, then attempt a few MCQs on the whole chapter without negative marking anxiety.

Common mistakes in Materiality, Risk Assessment and Internal Control

  • Treating materiality as a fixed percentage that you must apply mechanically.

    Fix: Say that the benchmark is chosen by judgement based on the entity and users' needs. Add that qualitative factors can make smaller items material.

  • Confusing materiality with performance materiality.

    Fix: Remember that materiality is for the financial statements as a whole, while performance materiality is the lower amount used to design and perform procedures.

  • Listing the components of internal control without linking them to the case facts.

    Fix: For each fact in the case, name the component it belongs to and state whether it is a strength or a deficiency. Then give the effect on risk.

  • Mixing up inherent risk, control risk and detection risk, or assessing risk only at one level.

    Fix: Write the relationship once: the risk of material misstatement consists of inherent risk and control risk, and SA 315 (Revised 2019) requires you to assess them separately. Detection risk is what you set in response to the assessed risks. State whether the risk is pervasive (financial statement level) or specific to an assertion.

  • Saying that a control deficiency must always be reported to the audit committee or in the audit report.

    Fix: First decide whether the deficiency is significant. Then state the correct recipient and form of communication, and keep the audit report separate from SA 265 communication.

  • Writing long theory answers to case questions.

    Fix: Use provision, facts, conclusion. Quote only the requirement that applies, tie it to two or three facts, and end with a clear action for the auditor.

Last-day revision: Materiality, Risk Assessment and Internal Control

  • Materiality is a judgement. Benchmarks such as profit before tax or revenue are starting points, not fixed rules.
  • Performance materiality is set below materiality to lower the chance that uncorrected and undetected misstatements together exceed materiality.
  • Materiality has a qualitative side. A small misstatement can still be material, for example if it hides a breach of law or turns a loss into a profit.
  • Revise materiality if you learn new information during the audit that would have changed the original figure.
  • The auditor must understand the entity, its environment, the applicable financial reporting framework and the entity's system of internal control.
  • The five components of internal control: control environment, entity's risk assessment process, process to monitor the system of internal control, information system and communication, and control activities.
  • Controls are manual or automated. Automated controls are consistent but depend on general IT controls working.
  • General IT controls support the IT environment. Application controls work at the transaction level.
  • Risks of material misstatement are assessed at the financial statement level and at the assertion level.
  • A significant risk needs special audit consideration. For significant risks, the auditor must identify the controls that address them, evaluate their design and determine whether they have been implemented.
  • The risk of material misstatement consists of inherent risk and control risk. SA 315 (Revised 2019) requires the auditor to assess inherent risk and control risk separately. Detection risk is set by the auditor in response to the assessed risks.
  • Under SA 265, communicate significant deficiencies in writing to those charged with governance on a timely basis, and report other deficiencies to the appropriate level of management.

Materiality, Risk Assessment and Internal Control practice questions

Materiality, Risk Assessment and Internal Control in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Materiality, Risk Assessment and Internal Control: frequently asked questions

How should I study this chapter for CA Final Audit?

Study it as a chain from materiality to risk assessment to control and then to communication. Learn the key requirements of SA 320, SA 315 and SA 265, then spend most of your time on case scenarios. Practise tagging each fact to a risk or control.

Do I need to memorise materiality percentages?

No. SA 320 asks for professional judgement, and benchmarks are only starting points. Learn the logic of choosing a benchmark and the qualitative factors, because exam answers are marked on reasoning, not a fixed percentage.

What is the difference between a deficiency and a significant deficiency in internal control?

A deficiency exists when a control is missing or does not work to prevent, or detect and correct, misstatements on time. A significant deficiency is one that, in the auditor's professional judgement, is important enough to merit the attention of those charged with governance.

Why is IT covered inside a risk assessment chapter?

Most entities run their accounting on IT systems, so the auditor must understand how IT affects controls and risk. Automated controls are consistent, but they depend on sound general IT controls. A weakness there can affect many transactions at once.