Assessing Risk of Material Misstatement

Why this topic matters

Identifying and assessing the risk of material misstatement (RMM) drives every later decision in an audit. Statement on Auditing Standards (SAS) No. 145 made the process more granular: separate inherent and control risk assessments, a spectrum of inherent risk, and a "stand-back" requirement. Auditing and Attestation (AUD) Area II tests assertions, significant risks, and how risks link to responses.

Two levels of risk

Level	Nature	Examples	Response
Financial statement level	Pervasive — affects many assertions	Weak control environment, management lacking integrity, going concern doubts, inadequate accounting records	Overall responses: more experienced staff, more supervision, more professional skepticism, unpredictability, changes to timing
Assertion level	Specific to a class of transactions, account balance, or disclosure	Complex revenue contract terms, subjective inventory obsolescence reserve	Further audit procedures: tests of controls and substantive procedures

Management's assertions

Classes of transactions and events	Account balances	Presentation and disclosure
Occurrence — recorded transactions happened and pertain to the entity	Existence — assets, liabilities, and equity exist	Occurrence and rights and obligations of disclosed events
Completeness — all transactions that should be recorded are recorded	Completeness	Completeness of disclosures
Accuracy — amounts recorded appropriately	Rights and obligations — the entity holds or controls the rights to assets; liabilities are its obligations	Classification and understandability
Cutoff — recorded in the correct period	Accuracy, valuation, and allocation	Accuracy and valuation of disclosures
Classification — recorded in the proper accounts	Classification
Presentation — appropriately aggregated and described	Presentation

A relevant assertion is one with an identified risk of material misstatement — that is, the likelihood of misstatement is more than remote and the misstatement could be material. Only accounts with relevant assertions are significant classes of transactions, account balances, or disclosures.

Assessing inherent risk

Inherent risk is assessed on a spectrum (from lower to higher), based on the likelihood and magnitude of a possible misstatement, using the inherent risk factors:

• Complexity — complicated calculations, contracts, or accounting requirements.
• Subjectivity — reliance on judgment (estimates, fair values).
• Change — new systems, regulations, products, or personnel.
• Uncertainty — outcomes that can't be measured precisely.
• Susceptibility to misstatement due to management bias or other fraud risk factors.

Assessing control risk

• Control risk is assessed separately from inherent risk.
• If the auditor does not plan to test the operating effectiveness of controls, control risk is assessed at the maximum, and RMM equals the inherent risk assessment.
• Assessing control risk below maximum requires tests of operating effectiveness — evaluating design and implementation alone is not enough.

Significant risks

A significant risk is an identified risk for which the inherent risk assessment is close to the upper end of the spectrum, or one that generally accepted auditing standards (GAAS) require to be treated as significant. Examples:

• Fraud risks, including the presumed risk of fraud in revenue recognition (rebuttable) and management override of controls (never rebuttable).
• Significant unusual transactions outside the normal course of business, and significant related party transactions.
• Estimates with high estimation uncertainty.

For each significant risk the auditor must:

• Evaluate the design and implementation of the related controls.
• Perform substantive procedures specifically responsive to that risk — if only substantive procedures are used, they must include tests of details.
• Test the related controls in the current period if relying on them (no rotation).

Risks where substantive procedures alone are not enough

In highly automated environments with little or no documentary trail (for example, electronic ordering and invoicing), the auditor may be unable to obtain sufficient evidence through substantive procedures alone and must test controls.

The stand-back requirement

For material classes of transactions, account balances, and disclosures that the auditor did not identify as significant, the auditor must still evaluate whether that conclusion remains appropriate — and must perform substantive procedures for each material item regardless of assessed risk.

Revising the assessment

Risk assessment is iterative. If evidence obtained later contradicts the original assessment — for example, tests of controls find deviations, or substantive tests find unexpected misstatements — the auditor revises the assessment and modifies planned procedures.

Documentation

• The discussion among the engagement team about susceptibility to material misstatement, including fraud.
• Key elements of the understanding of the entity and internal control.
• The assessed RMM at the financial statement and assertion levels, significant risks, and the rationale for significant judgments.

How it is tested

• Match an audit concern to the assertion most at risk.
• Identify whether a risk is pervasive (statement level) or specific (assertion level).
• Recognize significant risks and the required responses.
• Apply the SAS No. 145 concepts: inherent risk factors, separate control risk assessment, stand-back.