6.1 Meaning of audit risks

Audit risk is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated: in practice, the risk of giving an unmodified ("clean") opinion on financial statements that contain a material error or fraud. It is defined in ISA 200, Overall Objectives of the Independent Auditor, which ICPAK has adopted for use in Kenya along with the other International Standards on Auditing. Because an auditor tests samples rather than every transaction and relies on judgement and on evidence that is persuasive rather than conclusive, audit risk can never be eliminated; the auditor's job is to reduce it to an acceptably low level by planning and performing the right procedures. Example: an audit firm in Karatina auditing a tea factory company sets its acceptable audit risk at a low level because the accounts will be used by a bank deciding on a large loan.

Key concepts

• Material misstatement: An error or omission (including fraud) that, alone or together with others, could reasonably be expected to influence the economic decisions users make on the basis of the financial statements.
• Materiality: The threshold above which misstatements matter, set by the auditor's judgement, often as a percentage of a benchmark such as profit before tax, revenue or total assets.
• Reasonable assurance: A high, but not absolute, level of assurance that the financial statements are free from material misstatement; audit risk is what remains.
• Risk of material misstatement (RMM): The risk that the financial statements are materially misstated before the audit; it belongs to the client and is made up of inherent risk and control risk.
• Detection risk: The risk that the auditor's procedures fail to detect a material misstatement; it is the part the auditor controls.

The audit risk model

Audit risk = Inherent risk × Control risk × Detection risk
AR = IR × CR × DR

Since the auditor cannot change inherent or control risk, the model is used to find the level of detection risk that can be accepted:

DR = AR ÷ (IR × CR)

A lower acceptable detection risk means more, better-timed and more reliable substantive procedures.

Worked example: acceptable detection risk

An auditor sets acceptable audit risk at 5%, assesses inherent risk at 80% and control risk at 50% for trade receivables.

DR = AR ÷ (IR × CR)
= 0.05 ÷ (0.80 × 0.50)
= 0.05 ÷ 0.40
= 0.125, that is 12.5%

If controls are found to be weak and control risk is reassessed at 100%:

DR = 0.05 ÷ (0.80 × 1.00)
= 0.05 ÷ 0.80
= 0.0625, that is 6.25%

Halving the acceptable detection risk means the auditor must do considerably more substantive testing, for example confirming more customer balances at the year end rather than at an interim date.

In practice auditors usually assess these risks as high, medium or low rather than as exact percentages, but the relationship is the same.

Why audit risk matters

• Directs the audit: Risk assessment decides where effort is concentrated and how much evidence is needed.
• Protects the auditor: An inappropriate opinion can lead to legal claims, disciplinary action by ICPAK and loss of reputation.
• Protects users: Shareholders, lenders, KRA and regulators rely on the audit opinion.
• Efficiency: Low-risk areas receive less work, saving time and cost.
• Quality management: Firms must document their risk assessments to show that the audit meets the standards.

Factors affecting the level of acceptable audit risk

• Users of the financial statements: The more people rely on them (for example listed companies and banks), the lower the acceptable audit risk.
• Likelihood of financial difficulty: A client close to insolvency increases the consequences of a wrong opinion.
• Public interest: Public sector entities audited under the Public Audit Act 2015 and regulated entities attract greater scrutiny.
• Management integrity: Doubts about management increase overall risk.

Sources of audit risk in computerised environments

Computerised accounting systems add sources of audit risk that a manual system does not have. They come from the technology itself and from the way it is set up and used, so the auditor must ask about them when assessing risk at the planning stage.

• Technological complexity: Software can contain programming errors that repeat on every transaction. Example: a bug in a SACCO's loan system that miscalculates interest misstates every affected member account until it is corrected.
• Data integrity and security: Hacking, unauthorised changes to data or ransomware can damage the accuracy and availability of financial records. A county government office with weak access controls may expose its payment records to alteration.
• System changes and upgrades: Frequent updates, or a move to a new enterprise resource planning (ERP) system, can introduce errors or switch off controls if the change is not managed. A manufacturing company in Thika that migrates its ledgers may lose or duplicate balances during data conversion.
• User competence: Controls work only if users understand the system. Hospital finance staff who are unfamiliar with their software may override controls or post to the wrong accounts.
• Reliance on automated controls: A single weakness in a system control can affect an entire class of transactions, so the auditor tests it once but considers its effect widely.

Effect of audit risk on audit planning

Understanding audit risk lets the auditor design procedures that match the danger of giving a wrong opinion. Where audit time and fees are limited, as with many small Kenyan audit firms, directing effort by risk improves both quality and efficiency.

• Risk assessment procedures: The auditor first gathers information about the client and its computerised systems, such as the IT infrastructure behind inventory records at a supermarket chain, to find the areas of higher risk.
• Tailoring procedures: High inherent or control risk calls for more substantive testing, larger samples and stronger evidence. If a SACCO has weak IT controls, the auditor may enlarge transaction samples or add data analytics.
• Use of computer-assisted audit techniques (CAATs): CAATs allow the auditor to test whole populations of data instead of samples, which lowers detection risk. A bank auditor may recompute interest on the entire loan portfolio.

Managing audit risk in the Kenyan context

Managing audit risk takes professional scepticism, technical skill and knowledge of local law, and the approach must follow both international standards and Kenyan requirements.

• Developing an audit risk profile: The auditor records industry risks, regulatory compliance and the sophistication of the client's systems. The profile of a county government office would include risks arising from the Public Finance Management Act.
• Continuous monitoring: Risk changes as transactions occur and systems change, so the auditor reviews the assessment throughout the audit, using audit software where possible to flag new risks early.
• Collaboration with IT specialists: Where systems are complex, auditors work with IT audit specialists to judge access controls, backups and system security. At an insurance company, the specialist may test who can change policy and claims data.