Audit Planning, Materiality, Risk Assessment and Internal Control — Practice

Question 1

An auditor assesses the risk of material misstatement relating to a company's revenue recognition as significantly higher than in the prior year, following a change in the company's business model to include complex, multi-element bundled contracts. Explain how this elevated risk assessment should specifically change the nature, timing and extent of the auditor's planned substantive procedures on revenue, compared to a lower-risk assessment.

Accepted Answer

Under SA 330, an elevated risk assessment requires the auditor to obtain more persuasive audit evidence, scaled across all three dimensions. On nature, the auditor should shift toward more effective procedures specifically targeting the new complexity, such as detailed testing of individual bundled contracts to verify correct identification of performance obligations and appropriate allocation of transaction price, rather than relying more heavily on analytical procedures or less rigorous procedures that might have sufficed for a lower-risk, routine revenue stream. On timing, the auditor should perform substantive procedures at or closer to the period end, rather than at an interim date, since a significant, newly elevated risk warrants evidence obtained closer to the reporting date to reduce the risk that conditions change materially between an interim testing date and period end. On extent, the auditor should increase the sample size or extent of testing applied to revenue transactions, particularly focusing on the newly introduced complex, multi-element contracts specifically, rather than maintaining the same sample size and testing extent that a lower, unchanged risk assessment would have supported; simply noting the elevated risk without correspondingly adjusting all three of these dimensions would mean the auditor has only completed the risk assessment half of the SA 315/SA 330 exercise without the required, matching risk response.

Question 2

An auditor tests and concludes that a company's internal controls over cash disbursements are operating effectively, planning to reduce substantive testing on this account as a result. Explain why SA 330 does not permit the auditor to eliminate substantive procedures over cash disbursements entirely, despite this positive controls conclusion.

Accepted Answer

SA 330 requires substantive procedures, tests of details and substantive analytical procedures, to be performed for all material classes of transactions, account balances and disclosures, regardless of the assessed level of control risk, reflecting that even well-designed and well-operating controls carry inherent limitations that no purely controls-based reliance strategy can fully eliminate — controls can be circumvented through collusion, management override remains a possibility regardless of how well controls otherwise function, and controls testing itself provides evidence about operating effectiveness over the period tested, not an absolute guarantee that no misstatement whatsoever has occurred. A positive controls conclusion legitimately allows the auditor to reduce the extent of substantive testing performed, since less audit evidence is needed from substantive procedures when reliable controls evidence already exists, but it does not permit eliminating substantive procedures on a material account balance entirely; some level of substantive testing, however reduced in extent relative to a scenario with weak or ineffective controls, remains a mandatory baseline SA 330 requires for every material item, ensuring the audit opinion is never based purely on an assessment of controls with no direct substantive verification of the actual account balances and transactions at all.

Question 3

An auditor identifies three uncorrected misstatements during the audit: an overstatement of inventory of ₹8 lakh, an understatement of a provision of ₹6 lakh, and an omitted disclosure relating to a related party transaction that does not itself affect any recognised figure. Overall materiality is ₹18 lakh. Explain how the auditor should evaluate these three items together under SA 450, and why the third item cannot simply be dismissed as immaterial merely because it involves no misstated figure.

Accepted Answer

Under SA 450, the auditor must accumulate all identified misstatements, other than those clearly trivial, and evaluate the aggregate effect of uncorrected misstatements against materiality, not merely assess each misstatement individually against materiality in isolation. Here, the inventory overstatement of ₹8 lakh and the provision understatement of ₹6 lakh together aggregate to ₹14 lakh, which, while still below the ₹18 lakh overall materiality on its own, leaves only ₹4 lakh of remaining headroom before the aggregate would exceed materiality, meaning any further misstatement identified, even a comparatively small one, could tip the aggregate over the materiality threshold; the auditor must keep this aggregate running total in mind throughout the remainder of the audit rather than dismissing each individual misstatement as immaterial purely on its own. The third item, the omitted related party disclosure, cannot simply be dismissed as immaterial merely because no recognised figure is misstated, because SA 450 explicitly requires the auditor to consider qualitative, not only quantitative, materiality considerations; an omitted disclosure about a related party transaction can be qualitatively significant regardless of its quantitative size, since related party transaction disclosures are specifically important to users assessing whether an entity's reported results might be affected by non-arm's-length dealing, exactly the qualitative materiality concern this chapter and the earlier Financial Reporting-adjacent disclosure content both flag, meaning this omission requires genuine evaluation on its own qualitative merits, not automatic dismissal purely because no quantitative misstatement is directly involved.

Question 4

An auditor set overall materiality for a company's audit based on planning-stage expected profit before tax of ₹5 crore. Midway through fieldwork, it becomes apparent that actual profit before tax will be closer to ₹2 crore, materially lower than originally expected. Explain what SA 320 requires the auditor to do in response, and the consequence for previously performed audit work.

Accepted Answer

SA 320 requires the auditor to revise materiality (and performance materiality) if the auditor becomes aware of information during the audit that would have caused the auditor to have determined a different materiality figure had that information been known at the planning stage; here, since actual profit before tax is materially lower than the planning-stage expectation the original materiality figure was based on, the auditor should revise overall materiality downward to reflect this new, lower figure. The consequence for previously performed audit work is significant: with a lower revised materiality, and correspondingly lower performance materiality, the auditor must reconsider whether the nature, timing and extent of audit procedures already performed remain appropriate given this revised, more stringent materiality threshold; procedures that were sufficient to provide adequate assurance at the original, higher materiality level may no longer provide sufficient evidence at the new, lower materiality level, potentially requiring the auditor to perform additional audit procedures, particularly on items or account balances that were previously judged immaterial and received limited or no testing at the original materiality level but could now be material, or contribute materially to an aggregate misstatement, at the newly revised, lower threshold.

Question 5

A company recognises a warranty provision based on a complex actuarial-style model incorporating historical claims data, expected future claim rates, and an assumed discount rate. Separately, the company also recognises a straightforward provision for a legal claim based on a single lawyer's opinion of the likely settlement amount, provided shortly before the audit report date, with the actual settlement subsequently agreed at almost exactly this estimated amount before the auditor's report is signed. Identify the most appropriate SA 540 approach for auditing each estimate, and justify your choice for each.

Accepted Answer

For the warranty provision, based on a complex actuarial-style model, the most appropriate approach is testing management's process, since this involves evaluating the specific model, data inputs (historical claims data), and assumptions (expected future claim rates, discount rate) management used to arrive at the estimate, assessing whether the model is appropriate, the underlying data is complete and accurate, and the assumptions are reasonable and consistent with other evidence obtained during the audit; given the complexity and multiple interacting assumptions involved, evaluating the process management used to build the estimate is generally more informative and more thorough than attempting to develop an entirely independent estimate from scratch, though an independent expectation could also be developed as a supplementary cross-check where practicable. For the legal claim provision, since the actual settlement was subsequently agreed at almost exactly the estimated amount before the auditor's report date, reviewing subsequent events is the most appropriate and most directly conclusive approach here: the actual settlement outcome, occurring before the report date, provides direct, concrete evidence confirming the reasonableness of management's original estimate, a form of evidence considerably more persuasive than attempting to independently model or re-evaluate management's process for an estimate that has, in substance, already been resolved by an actual, observable subsequent event occurring within the available evidence window.

Question 6

An auditor plans to use a substantive analytical procedure to test a company's interest expense, by comparing it to an expectation based on average outstanding borrowings and the applicable interest rate. Explain the specific preconditions SA 520 requires before this analytical procedure can be relied upon as persuasive audit evidence, applying each to this specific example.

Accepted Answer

First, the auditor must develop a sufficiently precise expectation, here computed by multiplying the average outstanding borrowings during the period by the applicable interest rate (or rates, if borrowings carried different rates across different facilities or periods), rather than a vague, imprecise estimate, since a precise expectation is what allows a genuinely meaningful comparison against the recorded interest expense. Second, the auditor must evaluate the reliability of the data the expectation is based on, here verifying that the average outstanding borrowings figure and the applicable interest rates used are themselves accurate and drawn from reliable sources, such as loan agreements and confirmed balances, since an expectation built on unreliable underlying data cannot itself be a reliable benchmark. Third, the auditor must define an amount of difference from the expectation that can be accepted without further investigation, a threshold set with reference to materiality and the desired level of assurance, before actually performing the comparison, rather than deciding after the fact whether a given difference seems acceptable. Fourth, the auditor must investigate differences from the expectation that exceed this predetermined threshold, obtaining sufficient appropriate audit evidence explaining the difference, such as a change in interest rates mid-period the initial expectation had not fully incorporated, rather than simply accepting an unexplained, threshold-exceeding difference without further inquiry; only once all four of these preconditions are genuinely satisfied does this analytical procedure constitute persuasive substantive audit evidence under SA 520, rather than a superficial, unreliable comparison.

Question 7

An external auditor is considering using the internal audit function's work on inventory cycle counts to reduce the extent of the external auditor's own direct testing. Explain the specific factors SA 610 requires the external auditor to evaluate before doing so, and why the external auditor retains ultimate responsibility for the audit opinion regardless of this reliance.

Accepted Answer

Before using internal audit's work on inventory cycle counts, SA 610 requires the external auditor to evaluate the objectivity of the internal audit function, considering its organisational status and whether it is free from bias or undue influence that could compromise its professional judgement; the technical competence of the internal auditors performing the work, considering their qualifications and experience relevant to inventory cycle counting specifically; whether internal audit applies a systematic and disciplined approach, including appropriate quality control over its own work; and, having evaluated these factors, whether the specific nature and scope of the inventory cycle count work is of a type the external auditor judges appropriate to use in the specific circumstances of this audit, considering the level of judgement involved and the assessed risk of material misstatement relating to inventory. The external auditor retains ultimate responsibility for the audit opinion regardless of this reliance because SA 610 does not permit the external auditor to delegate away this responsibility merely by relying on internal audit's work; the external auditor must still perform sufficient procedures of its own, including re-performing some of internal audit's work or performing similar procedures independently, to be satisfied that internal audit's work, and the external auditor's reliance on it, is adequate for the external auditor's own purposes, since it is ultimately the external auditor, not internal audit, whose name and professional judgement stand behind the audit opinion issued.

Question 8

An auditor engages an external actuary to assist in evaluating a complex, long-duration insurance liability. Explain the three specific matters SA 620 requires the auditor to evaluate regarding this expert, and why the auditor cannot simply accept the actuary's conclusion without further evaluation.

Accepted Answer

SA 620 requires the auditor to evaluate the competence, capabilities and objectivity of the expert, assessing whether the actuary possesses the necessary qualifications, experience and skills relevant to this specific type of long-duration insurance liability, and whether the actuary's relationships with the entity or other interests might compromise their objectivity. The auditor must also obtain a sufficient understanding of the actuary's field of expertise to be able to evaluate the adequacy of the actuary's work for the auditor's own purposes, meaning the auditor need not become an actuarial expert personally, but must understand enough about actuarial methods and assumptions relevant to this liability to meaningfully assess whether the actuary's work appropriately addresses the audit's own needs. Finally, the auditor must evaluate the appropriateness of the actuary's work as audit evidence, including the relevance and reasonableness of the actuary's findings or conclusions, the relevance and reliability of underlying data and assumptions used, and, where applicable, the appropriateness of the actuary's use of that data. The auditor cannot simply accept the actuary's conclusion without this evaluation because, exactly as with internal audit's work, using an expert's work does not transfer the auditor's own ultimate responsibility for the audit opinion to that expert; the auditor must actively evaluate the expert's work through the specific lens SA 620 prescribes, forming an independent, audit-specific judgement about whether that work provides sufficient appropriate evidence to support the audit opinion, rather than passively deferring entirely to the specialist's own, differently-purposed professional conclusion.

Question 9

During an audit, the auditor identifies that a company's IT system allows a single employee to both create new vendor records and approve payments to those vendors, with no independent review of this combination of access rights. Explain why this is likely a significant deficiency requiring communication to those charged with governance under SA 265, and what specifically makes a deficiency 'significant' rather than merely a deficiency to be noted for management alone.

Accepted Answer

This combination of access, allowing a single employee to both create new vendor records and approve payments to those vendors with no independent review, represents a serious segregation of duties failure that could permit the creation of fictitious vendors and the approval of fraudulent payments to them with no independent check to detect or prevent this, a genuine and material fraud risk given the potential magnitude of loss this specific control weakness could permit, likely qualifying it as a significant deficiency warranting communication to those charged with governance rather than a lesser deficiency communicated to management alone. What makes a deficiency 'significant,' as against merely a deficiency to be noted for management, is the auditor's professional judgement about whether the deficiency, or combination of deficiencies, is of sufficient importance to merit the specific attention of those charged with governance, a judgement typically weighing the likelihood that the deficiency could result in a material misstatement (here, high, given the direct opportunity for fraudulent payments this specific access combination creates) and the potential magnitude of any resulting misstatement (potentially significant, depending on the volume and value of vendor payments this employee could influence); a lesser control weakness, with limited likelihood or limited potential magnitude of misstatement, would be communicated to management at an appropriate level as a matter for improvement, without necessarily rising to the level of significance SA 265 requires for governance-level communication.

Question 10

An auditor's initial audit plan, prepared before fieldwork began, assessed a specific business segment as low risk based on the prior year's stable results. Three weeks into fieldwork, the auditor learns this segment's manager was replaced mid-year following a significant, previously undisclosed dispute over revenue recognition practices. Explain how SA 300's characterisation of planning as a continuous, iterative process should apply here.

Accepted Answer

SA 300 establishes that planning is not a discrete, one-time activity completed before fieldwork begins, but a continuous and iterative process that continues throughout the audit as new information emerges; the discovery of a significant, previously undisclosed dispute over the segment manager's revenue recognition practices, followed by that manager's replacement mid-year, is precisely the kind of new information that should trigger a genuine revision of the original plan, since it directly undermines the basis (stable prior-year results, implicitly assuming no such underlying dispute existed) on which the segment was originally assessed as low risk. The auditor should revisit and revise the risk assessment for this segment specifically, likely elevating it from low to a higher risk category, and correspondingly revise the planned nature, timing and extent of audit procedures for this segment under SA 330, rather than continuing to execute the original, now-outdated plan simply because it was already prepared and fieldwork was already underway; treating the original plan as fixed and unchangeable once fieldwork has begun would directly contradict SA 300's explicit characterisation of planning as an ongoing, responsive process throughout the engagement.

Question 11

A company enters into a highly unusual, one-off transaction near year end, selling a subsidiary to a related party at a price significantly above independently assessed fair value, with the gain recognised immediately in profit. Explain why this should be identified as a significant risk under SA 315, addressing each of the specific factors that elevate a risk to this status.

Accepted Answer

This transaction should be identified as a significant risk because it exhibits several of the specific factors SA 315 identifies as elevating an identified risk to significant status. First, it is a significant, unusual and non-routine transaction, occurring near year end and outside the entity's ordinary course of business, and non-routine transactions carry greater risk than routine, recurring transactions because they are less subject to the entity's established, tested internal controls and more subject to ad hoc, potentially less rigorous, judgement and processing. Second, it is a related party transaction, a category SA 315 specifically flags as inherently carrying elevated risk, since related party transactions may not be conducted under normal market terms and conditions, creating both a heightened risk that the transaction's economic substance differs from its stated form and a heightened risk of management bias in how the transaction is measured and presented. Third, the transaction involves significant judgement in measurement, since the price paid significantly exceeds independently assessed fair value, raising a direct question about whether the transaction has genuine economic substance at the stated price or has instead been priced specifically to generate an immediate, favourable gain for reasons unrelated to genuine arm's-length commercial terms, itself a red flag for potential management bias or an attempt to manage reported earnings through non-arm's-length related party pricing. Given this combination of factors, occurring together in a single transaction near year end, the auditor should treat this as a significant risk requiring specifically designed audit responses addressing the transaction's substance, its related party nature, and the reasonableness of the price and gain recognised, rather than treating it as an ordinary transaction subject only to routine audit procedures.

Question 12

Explain what SA 450 means by misstatements that are 'clearly trivial,' and why this threshold is set well below performance materiality rather than at the same level.

Accepted Answer

SA 450 permits the auditor to disregard misstatements that are 'clearly trivial,' meaning misstatements that are clearly inconsequential, whether taken individually or in aggregate, and clearly of a wholly different (much smaller) order of magnitude than the materiality determined for the financial statements as a whole, such that even after aggregating an unlimited number of such items, the total would still not have a material effect on the financial statements. This threshold is deliberately set well below performance materiality, rather than at the same level, because performance materiality itself is already a figure set below overall materiality specifically to provide an appropriate margin reducing the risk that the aggregate of individually immaterial misstatements exceeds overall materiality; if the 'clearly trivial' threshold for disregarding misstatements entirely were set at the same level as performance materiality, the auditor could end up disregarding, and therefore not tracking or aggregating at all, individually immaterial misstatements that, once combined across many such items, could genuinely approach or exceed overall materiality, defeating the very purpose of SA 450's aggregation requirement; setting the clearly trivial threshold well below performance materiality ensures that essentially every misstatement with any meaningful potential to contribute to a material aggregate is actually tracked and accumulated, with only genuinely inconsequential, negligible items excluded from this tracking altogether.

Question 13

An auditor performs two distinct procedures on a company's payroll: (a) re-performing the system's automated three-way match between an employee's approved hours, the pay rate on file, and the amount actually paid, to confirm the control is operating correctly; (b) comparing total payroll expense for the year against an expectation built from average headcount and average salary, investigating any material variance. Classify each procedure and explain the different type of evidence each provides.

Accepted Answer

(a) is a test of controls, since it directly tests whether a specific control, the automated three-way match, is actually operating effectively as designed, providing evidence about the operating effectiveness of the control itself rather than direct evidence about whether the payroll expense balance is free from material misstatement; a positive result supports reduced substantive testing (under SA 330's controls-reliance logic) but does not, by itself, directly verify the payroll balance's accuracy. (b) is a substantive analytical procedure, since it directly compares the recorded payroll expense against an independently developed expectation, providing direct substantive evidence about whether the payroll expense balance itself appears reasonable, addressing the assertion of accuracy/valuation for the payroll expense directly rather than testing the design or operation of any specific control; this is precisely the SA 520 substantive procedure category, requiring the specific preconditions (precise expectation, reliable data, predetermined threshold, investigation of exceedances) this chapter's earlier problem addressed. The key distinction is that (a) provides indirect evidence about the balance's accuracy by verifying a control that, if operating effectively, reduces the risk of misstatement, while (b) provides direct substantive evidence about the balance itself, and SA 330 requires at least some substantive evidence of this second kind for every material balance regardless of how positively the first kind of evidence, controls testing, comes out.

Question 14

An auditor plans a substantive analytical procedure comparing a retail company's reported sales against an expectation built from footfall data and average transaction value, where the footfall data is sourced from a third-party sensor system the company itself has never independently verified for accuracy. Explain why the auditor must specifically evaluate the reliability of this footfall data before relying on the resulting analytical procedure as persuasive evidence.

Accepted Answer

SA 520 requires the auditor to evaluate the reliability of the data used to develop an expectation before relying on a substantive analytical procedure as persuasive evidence, because an expectation built on unreliable underlying data cannot itself provide a reliable benchmark against which the recorded figure can meaningfully be compared, regardless of how sophisticated or precise the analytical technique applied to that data might otherwise be; if the footfall data itself is inaccurate, whether due to sensor malfunction, miscounting, or some other data quality issue, an expectation built from this data would be similarly inaccurate, and comparing recorded sales against a fundamentally flawed expectation could either mask a genuine misstatement (if the flawed expectation happens to be close to the misstated recorded figure) or generate a false, misleading variance requiring unnecessary investigation (if the flawed expectation diverges from an actually correct recorded figure for reasons unrelated to any genuine sales misstatement). Since the footfall data comes from a third-party system the company itself has never independently verified, the auditor should specifically consider whether this data can be relied upon for this purpose, potentially through independent testing of the sensor system's own accuracy, corroboration against other independent evidence, or, if the data's reliability cannot be adequately established, concluding that this specific analytical procedure cannot be relied upon as sufficient, persuasive substantive evidence on its own, and that additional or alternative procedures are needed instead.

Question 15

A company recognises a provision for an ongoing product liability lawsuit, based on external legal counsel's assessment of the likely range of outcomes. No settlement or judgement has occurred by the time the audit is being finalised. Explain why the auditor might reasonably combine more than one SA 540 approach in this specific scenario, rather than relying on a single approach alone.

Accepted Answer

Since no settlement or judgement has occurred by the time the audit is being finalised, the subsequent events approach is not available here at all, as there is no concrete, resolving event to review; the auditor must instead rely on some combination of testing management's process and developing an independent expectation. Testing management's process would involve evaluating the qualifications and objectivity of the external legal counsel providing the assessment, understanding the basis for their assessed range of likely outcomes, and evaluating whether management's chosen point estimate within that range, and the assumptions underlying it, are reasonable given the information available. Developing an independent expectation, potentially by engaging the auditor's own legal expert under SA 620 to independently assess the likely range of outcomes, or by comparing management's estimate against outcomes in genuinely comparable litigation matters the auditor is aware of, provides a further, independent cross-check on management's own estimate rather than relying solely on an evaluation of management's own process and its underlying inputs. Combining both approaches is reasonable, and often advisable, precisely in a case like this, where the estimate carries significant estimation uncertainty (litigation outcomes are inherently difficult to predict with precision) and no subsequent event is available to provide the kind of direct, concrete confirming evidence a settlement or judgement occurring before the report date would otherwise offer, making the auditor's own independent corroboration a more valuable complement to, rather than a wasteful duplication of, evaluating management's own process alone.

Practice — Audit Planning, Materiality, Risk Assessment and Internal Control

Sign in to save attempts to your dashboard and track your accuracy over time

Find a verified tutor

Join a live course

Browse coaching centres

About

Categories

Support

Documentation

Get Study Tips & Updates

Download Our App

Download for iOS

Download for Android

Popular Cities