Audit objectives, risk and professional judgement

What the audit is trying to achieve

A financial statement audit supports users' confidence through an evidence-based opinion on compliance, in material respects, with the reporting framework. Under a fair presentation framework, the conclusion addresses fair presentation or a true and fair view. The opinion concerns the statements as a whole, without guaranteeing every transaction.

The objective is reasonable assurance: high assurance supported by sufficient appropriate evidence and acceptably low audit risk. Estimates, judgement, evidence limitations and concealed deception prevent absolute certainty. These limitations do not excuse inadequate work; difficulty, time pressure or expense alone cannot justify weak evidence.

These notes follow the supplied guide's 2024 study context. The historical standards linked here verify the concepts for that context; later publication or access dates do not automatically change the study rules.

Concept sources: ASA 200, December 2022 — audit purpose, reasonable assurance and inherent limitations.

Allocate responsibility before considering procedures

Concept sources: ASA 210, preconditions; ASA 240, December 2023, responsibilities for fraud — original allocation table.

Error is unintentional; fraud involves intentional deception. A mistaken formula creates an error; deliberately changing it to conceal a liability may indicate fraud. Relevant fraud includes manipulated reporting and stolen assets that cause misstatement. Investigate indications without assuming every discrepancy proves a legal offence.

Management fraud is particularly difficult to detect because those directing the business may override controls or coordinate misleading explanations. Past honesty does not remove the need to remain alert. Identified or suspected non-compliance may also create reporting, communication and documentation duties under law or ethics beyond the financial statement opinion.

Separate the three sources of audit risk

Audit risk concerns an inappropriate opinion on materially misstated financial statements. It differs from commercial risks such as losing the client or being sued.

Concept sources: ASA 200, definitions — original comparison applying the guide's risk concepts.

Inherent and control risk belong to the entity and exist before the audit. Together they constitute risk of material misstatement. The auditor assesses them and manages detection risk through the work performed. A useful conceptual model is audit risk = inherent risk × control risk × detection risk. It describes a relationship rather than prescribing numerical scores or a universally acceptable audit-risk percentage.

For the same acceptable audit risk, higher assessed inherent and control risks require lower acceptable detection risk. The response may involve stronger evidence, different procedures, more experienced staff, testing closer to year-end or greater coverage. Increasing sample size is only one possibility: a large sample from the wrong population remains unhelpful.

Assess both the breadth and severity of the risk

A financial statement level risk can affect many assertions, such as a finance function unable to produce reliable records. An assertion level risk concerns a particular claim about transactions, balances or disclosures, such as whether a warranty provision is adequately valued. A pervasive problem can also generate specific assertion risks; the two levels interact.

Inherent risk lies on a spectrum. Assess both the likelihood of a misstatement and its potential magnitude. Complexity, subjectivity, change, uncertainty and susceptibility to management bias or fraud influence that assessment. A risk near the upper end may be a significant risk; other standards can also require significant-risk treatment. Assess inherent risk separately from control risk at the assertion level.

Concept sources: ASA 315, December 2022; IAASB's 2022 implementation guide — dynamic risk assessment, presented as an original learning sequence.

References: Audit objectives, risk and responsibilities

• ASA 200, December 2022 — objectives and audit-risk concepts.
• ASA 240, December 2023 — fraud responsibilities in the study period.
• ASA 315, December 2022 — risk identification and assessment.

Question the evidence and decide what it means

Professional scepticism is an alert, questioning approach to evidence. Professional judgement uses relevant knowledge, training and experience to make reasoned decisions in the circumstances. Scepticism helps identify what requires investigation; judgement determines the investigation and evaluates the result. Both apply throughout acceptance, planning, testing and reporting.

An auditor neither assumes management is dishonest nor accepts its honesty as a substitute for evidence. Remain alert to unusual transactions, inconsistent explanations, possible management override and information that contradicts expectations. Written representations can support the audit, but cannot replace other necessary evidence. Evaluate evidence that challenges a conclusion as carefully as evidence that supports it.

Concept sources: ASA 200, December 2022 — scepticism and judgement requirements.

Make judgement visible in each decision

Concept sources: ASA 200 — judgement; original decision prompts covering the guide's applications.

Judgement cannot justify ignoring requirements. Document significant facts, alternatives, evidence and conclusions. Consultation improves difficult decisions without transferring the partner's responsibility for quality.

Recognise pressures and biases before they distort the work

Short deadlines, unrealistic budgets, weak understanding of the client, difficult management and inaccessible evidence can encourage shortcuts. Automated tools create another risk if their output is trusted without understanding the data or logic. Recognising an obstacle is useful only if the team changes how it works.

Concept sources: ASA 220, December 2023 — discussion of scepticism impediments and bias; original illustrations and responses.

The partner may add expertise, allocate more time, increase timely review, support staff in challenging management or communicate evidence-access problems to governance. Consultation and escalation should occur while they can still influence the work. A review after an impossible deadline cannot supply evidence that was never obtained.

Connect firm systems with engagement leadership

Concept sources: AUASB's quality management standards collection; ASA 220 — original three-level comparison.

The team may use firm systems, but must consider relevant information indicating they are unsuitable or ineffective for the engagement. Appropriate collective competence does not mean every junior auditor already has specialist expertise. It means that skills, time, direction and supervision together support the work assigned.

Direction explains responsibilities, risks and procedures. Supervision tracks progress, addresses problems and identifies consultation needs. Review evaluates compliance, evidence, conclusions and significant matters. Complex work, higher risk or inexperienced personnel require closer attention. Resolve differences through the firm's process; seniority alone cannot resolve an unsupported technical conclusion.

Use the team discussion to connect the risks

The engagement team discusses where the statements could be materially misstated and how fraud or error might occur. Experienced members contribute knowledge, specialists identify technical vulnerabilities and less experienced members can expose assumptions through fresh questions. Decide who attends, when discussions occur and what absent members need to know.

Concept sources: ASA 315 — engagement-team discussion; original discussion sequence.

Share new allegations and unexpected results promptly: they may affect colleagues testing other balances.

Sources and further reading

• ASA 220, December 2023 — engagement leadership, resources, review and scepticism.
• AUASB quality management implementation resources — supporting materials for ASQM 1, ASQM 2 and ASA 220.
• ASA 315, December 2022 — team discussion and risk assessment.