Materiality, audit risk, and fraud risk are easy to study as three separate topics. But when we connect them, the logic of an audit becomes much clearer.
Materiality asks: What could matter to financial statement users?
Audit risk asks: How could the auditor reach the wrong conclusion?
Fraud risk adds another question: What if someone is deliberately trying to hide the problem?
This article brings these ideas together, using practical examples to explain how auditors evaluate misstatements, assess risk, and respond to possible fraud.
Part 1: Materiality Starts With the User
A misstatement is not limited to an incorrect number. It can also involve an inaccurate disclosure or information that should have been disclosed but was omitted.
When evaluating materiality, we need to consider both the amount and the circumstances.
Imagine two companies with the same $50,000 error.
For a large business with billions in revenue, that amount might have little effect on a user’s assessment. For a small business earning $80,000 before tax, it could change the picture substantially.
Now consider a different situation: a relatively small adjustment changes a reported loss into a profit.
The amount may be small compared with total assets, but its effect on how users understand performance could be significant.
That is why materiality involves two dimensions:
- Quantitative: How large is the misstatement?
- Qualitative: What does it change, conceal, or imply?
We also cannot evaluate every error separately. Several individually small misstatements may become material when considered together.
Part 2: Establishing Overall Materiality
A common starting point is:
Appropriate benchmark × Selected percentage = Preliminary materiality
Possible benchmarks include profit before tax from continuing operations, revenue, gross profit, total assets, or net assets.
The choice should reflect the entity and the information that matters to its financial statement users.
For example, profit may be useful for a business with stable earnings. It may be less useful when earnings fluctuate sharply or are close to zero.
There is no single percentage that automatically works for every audit.
An Illustrative Firm Policy
Suppose an audit firm uses the following illustrative policy:
- Select the larger benchmark: revenue or total assets.
- If revenue is selected, apply 0.5%.
- If total assets are selected, apply 1%.
- Under the stated low-risk conditions, set tolerable misstatement at 70% of overall materiality.
Assume the client has:
| Item | Amount |
|---|---|
| Revenue | $20,000,000 |
| Total assets | $15,000,000 |
Following this hypothetical policy, revenue is the selected benchmark:
$20,000,000 × 0.5% = $100,000 overall materiality
The specified tolerable misstatement would be:
$100,000 × 70% = $70,000
These percentages and the instruction to choose the larger benchmark are assumptions in this example, rather than universal auditing requirements. In practice, the auditor applies the firm’s methodology alongside professional judgment and the applicable standards.
Part 3: Why Auditors Work Below Overall Materiality
If overall materiality is $100,000, why would the auditor use a lower amount when planning procedures?
Because the auditor may not discover every misstatement, and identified errors may remain uncorrected.
A lower planning amount provides room for that combined exposure.
Under AICPA standards, performance materiality is established below the applicable materiality level to address the possibility that uncorrected and undetected misstatements together exceed that level. It informs risk assessment and the design of further procedures. See AU-C Section 320.
Performance Materiality and Tolerable Misstatement
The terminology depends on the framework and context:
| Context | How the term is used |
|---|---|
| AICPA audit planning | Performance materiality guides planning and performance of the audit. |
| AICPA audit sampling | Tolerable misstatement applies performance materiality to a particular sampling procedure and may equal or be below it. |
| PCAOB audits | Tolerable misstatement is established at the account or disclosure level below applicable materiality. |
These concepts are related, but treating them as interchangeable can lead to mistakes. The distinctions appear in the AICPA standards and PCAOB AS 2105.
An error exceeding performance materiality does not automatically require a modified opinion. It calls for further evaluation, which may include additional procedures, revised assessments, and a request for correction.
Part 4: Specific Materiality and Clearly Trivial Items
Some information can matter to users at amounts below overall materiality. In those circumstances, the auditor establishes a lower materiality level for the relevant transactions, balances, or disclosures.
This is sometimes described as specific materiality.
At the other end is clearly trivial.
Clearly trivial does not simply mean “below overall materiality.” It describes matters that are plainly inconsequential in amount, nature, and circumstances, individually and collectively. Identified misstatements other than those that are clearly trivial are accumulated for evaluation. The GAO Financial Audit Manual explains this distinction with reference to AU-C 450.
Materiality can also change during an audit. If preliminary earnings differ significantly from actual results, the auditor may need to revise materiality and reconsider the work already planned or performed.
All else equal, a lower testing threshold generally means more audit work.
Part 5: Understanding Audit Risk
Audit risk is the possibility that an auditor expresses an inappropriate opinion when the financial statements contain material misstatements.
The familiar model is:
AR = IR × CR × DR
Or:
Audit Risk = Risk of Material Misstatement (RMM) × Detection Risk
The components answer different questions:
| Component | Practical question |
|---|---|
| Inherent risk | How susceptible is this item to a material misstatement before considering controls? |
| Control risk | Could the company’s controls fail to prevent, or detect and correct, that misstatement? |
| Detection risk | Could the auditor’s procedures fail to find it? |
Inherent risk and control risk arise from the entity and its circumstances. The auditor assesses them. Detection risk is addressed through the nature, timing, and extent of audit procedures.
For a given acceptable audit risk, higher assessed risk of material misstatement requires lower acceptable detection risk—and more persuasive substantive evidence. See PCAOB AS 1101.
A Simple Example
Imagine a company selling complex products under contracts with unusual acceptance and return terms.
The revenue accounting may involve substantial judgment. That creates inherent risk.
Now assume the company has weak review controls over those contracts. Control risk may also be high.
The auditor’s response should address the resulting exposure. Possible procedures include inspecting contract terms, examining evidence of customer acceptance, and investigating transactions near year-end.
The equation helps explain the relationship. Professional judgment determines the actual procedures.
Part 6: Three Types of Misstatements
Misstatements can be grouped into three useful categories.
Factual misstatement: There is no doubt that an error exists.
For example, an invoice for $12,000 is recorded as $21,000.
Judgmental misstatement: Management uses a judgment or estimate that the auditor considers unreasonable or otherwise inappropriate.
For example, management records almost no allowance for doubtful accounts despite substantial evidence of collection problems.
A difference between two reasonable estimates does not automatically create a judgmental misstatement.
Projected misstatement: The auditor estimates misstatement in a population using errors identified in a sample.
If a sample contains errors, the evaluation may extend beyond those specific items. The sample can provide evidence about the population from which it was selected.
Part 7: Fraud Changes the Audit Problem
The distinction between error and fraud is intent.
Accidentally recording an invoice twice is an error. Deliberately recording a fictitious sale to inflate revenue is fraud.
The same incorrect amount could result from either.
Two categories matter especially in financial statement auditing:
- Fraudulent financial reporting: Deliberately manipulating amounts or disclosures to mislead users.
- Misappropriation of assets: Stealing assets or causing the company to pay for goods or services it did not receive.
Management, with oversight from those charged with governance, has primary responsibility for preventing and detecting fraud. The auditor seeks reasonable assurance that the financial statements are free from material misstatement due to fraud or error.
Fraud can be harder to uncover because the people involved may conceal evidence, forge documents, collude, or override controls. These difficulties explain why professional skepticism matters throughout the audit.
Part 8: Turning Skepticism Into Procedures
Professional skepticism means keeping a questioning mind and critically assessing evidence.
Consider a large sale recorded on December 31. Management explains that it is legitimate.
The next step is to evaluate supporting evidence:
- What do the contract terms require?
- When did the relevant transfer of control occur?
- Are there acceptance provisions, return rights, or side agreements?
- Is the explanation consistent with other evidence?
Fraud brainstorming follows the same practical approach. The team considers how financial reporting could be manipulated, how assets could be stolen, and how the audit should respond.
Revenue Recognition
Revenue deserves particular attention. The auditor ordinarily presumes a fraud risk involving revenue recognition and identifies the affected revenue streams, transactions, or assertions.
Examples include:
| Possible manipulation | Relevant concern |
|---|---|
| Recording fictitious sales | Occurrence |
| Recording next year’s revenue this year | Cutoff |
| Concealing return rights or side agreements | Recognition and other affected assertions |
A justified rebuttal of the revenue fraud presumption requires documentation.
Management Override
Even otherwise effective controls can be bypassed by management.
Required responses address journal entries and other adjustments, possible bias in accounting estimates—including retrospective review—and the business purpose of significant unusual transactions. These procedures are discussed in PCAOB AS 2401.
Part 9: Responding to Possible Fraud
The response operates at several levels.
At the engagement level, the team may assign more experienced staff, increase supervision, and introduce unpredictability.
At the procedure level, it may change:
- Nature: Obtain evidence better suited to the suspected manipulation.
- Timing: Focus procedures on periods when the risk is greatest.
- Extent: Increase coverage where the assessed risk warrants it.
For example, possible fictitious revenue may lead the auditor to seek external corroboration and investigate unusual customers or contract terms.
Discovering possible fraud also raises broader questions: Can management’s explanations still be relied upon? Are other accounts affected? Do previous risk assessments remain appropriate?
Fraud does not automatically mean an adverse opinion or immediate withdrawal. The outcome depends on the facts, including remaining material misstatements, available evidence, and the extent of the effects.
The auditor also needs appropriate communication and documentation: what risks were identified, what procedures were performed, what was found, and how the findings affected the audit.
Bringing the Three Topics Together
Suppose a company reports $5 million in profit, and overall materiality is $250,000.
The auditor identifies $180,000 of prematurely recognized revenue.
Stopping at “$180,000 is below $250,000” would miss much of the analysis.
The auditor still needs to ask whether other misstatements exist, whether this amount affects an important performance measure, and whether the transaction indicates deliberate manipulation.
If management intentionally accelerated the revenue, the finding may change the assessment of management integrity and the reliability of other evidence. If additional errors are identified, their combined effect may also change the materiality conclusion.
This is where the three topics meet:
Materiality helps evaluate significance. Audit risk guides the evidence needed. Fraud risk challenges how that evidence may have been manipulated.
Understanding these relationships makes the individual concepts easier to apply. Instead of asking only whether an amount exceeds a threshold, follow the issue through the audit: what could be wrong, why it matters, what evidence would reveal it, and how the findings affect the final conclusion.
Leave a Reply