Audit Planning, Materiality, Risk Assessment and Internal Control

The heaviest single application chapter in this paper

This chapter carries the largest weightage in the Advanced Auditing syllabus, and it earns that weight precisely because it combines the Intermediate-level foundation (SA 300 planning, SA 315 risk assessment, SA 320 materiality) with several genuinely new standards this paper introduces for the first time (SA 450, SA 520, SA 540, SA 610, SA 620, SA 265, SA 330). A Final-level question in this area routinely weaves several of these standards together within one integrated scenario, which is exactly why this is the chapter deserving the most sustained practice across the paper.

Applying SA 300 and SA 315 at Final-level depth

Planning as a continuous, iterative process, established at Intermediate, is now tested through scenarios where planning must be genuinely revised mid-audit — a Final-level question typically describes a planning decision made early in the audit, followed by new information emerging during fieldwork, and asks you to identify how the audit plan should be revised in response, testing whether you treat planning as a living document rather than a fixed, one-time exercise.

Risk assessment procedures under SA 315 — inquiries of management, analytical procedures, observation and inspection — are applied at Final level to genuinely complex entities: multi-location groups, entities with significant related party transactions, entities in industries with complex or unusual accounting requirements. Significant risks — risks requiring special audit consideration, typically involving a high degree of estimation uncertainty, unusual or non-routine transactions, related party transactions, or a heightened risk of management bias or fraud — are tested through scenarios requiring you to identify which specific elements of a described risk elevate it to "significant" status, not merely to recite the definition.

SA 330: the auditor's responses to assessed risks

The link between risk assessment and audit response. Having assessed risk under SA 315, SA 330 requires the auditor to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level, and to design and perform further audit procedures whose nature, timing and extent are responsive to the assessed risks at the assertion level. This is the direct causal link this paper tests constantly: a higher assessed risk requires more persuasive audit evidence, obtained through more effective procedures (nature), performed closer to or at the period end rather than at an interim date (timing), and through a larger sample size or more extensive testing (extent) — a candidate who assesses risk correctly but then fails to scale the actual audit response to match that assessed risk has only completed half the exercise SA 330 requires.

Tests of controls versus substantive procedures. Where the auditor plans to rely on the operating effectiveness of controls (reducing planned substantive testing), SA 330 requires the auditor to test those controls' operating effectiveness directly, not merely their design; substantive procedures — tests of details and substantive analytical procedures — must always be performed for material classes of transactions, account balances and disclosures, regardless of the assessed level of control risk, since SA 330 does not permit a purely controls-based approach with no substantive testing at all, reflecting that even well-designed and well-operating controls carry inherent limitations no control-reliance strategy alone can fully eliminate.

SA 320 materiality at Final level

Materiality and performance materiality, already established at Intermediate, are now tested through scenarios requiring revision of the original materiality assessment as the audit progresses — where new information reveals that the entity's actual financial results differ materially from what was expected at the planning stage (a company's actual profit turning out far lower than the profit figure materiality was originally based on, for instance), SA 320 requires materiality to be revised, and the auditor must then reconsider whether the nature, timing and extent of already-planned or already-performed audit procedures remain appropriate given this revised, typically lower, materiality figure.

SA 450: evaluation of misstatements identified during the audit

Aggregating misstatements. The auditor accumulates all misstatements identified during the audit, other than those that are clearly trivial, and evaluates whether the financial statements as a whole are free from material misstatement, considering the aggregate effect of accumulated, uncorrected misstatements against materiality — a single misstatement below materiality on its own may nonetheless contribute to an aggregate that exceeds materiality once combined with other individually immaterial misstatements identified elsewhere in the audit.

Qualitative considerations. SA 450 explicitly requires the auditor to consider not only the quantitative size of an uncorrected misstatement but its qualitative significance — a misstatement that, while small in rupee terms, changes a loss into a profit, affects compliance with a loan covenant, or conceals an unlawful transaction, may be material by its nature even though its quantitative size alone would appear immaterial, precisely the qualitative-materiality theme that recurs across this whole subject wherever a "small number, big implication" scenario is tested.

SA 520: analytical procedures

Beyond the risk-assessment-stage analytical procedures already covered at Intermediate, this paper tests analytical procedures used as substantive procedures in their own right, and as part of the overall review at the end of the audit; a substantive analytical procedure is genuinely persuasive only when the auditor has developed a sufficiently precise expectation, evaluated the reliability of the data the expectation is based on, defined an amount of difference from that expectation that can be accepted without further investigation, and genuinely investigated any difference exceeding that threshold — a candidate who simply states "the auditor performed analytical procedures" without addressing these specific preconditions has not demonstrated the depth SA 520 actually requires at this level.

SA 540: auditing accounting estimates

Why estimates are a distinctly higher-risk area. Accounting estimates, by definition, cannot be measured with precision and involve management judgement based on the information available at the measurement date, and this inherent estimation uncertainty is exactly why SA 540 requires the auditor to obtain an understanding of how management identifies transactions requiring an estimate, and to evaluate the degree of estimation uncertainty, including whether that uncertainty gives rise to a significant risk.

Three broad approaches to auditing a specific estimate, and a Final-level answer should identify which is most appropriate for the specific estimate described: testing management's process used to make the estimate (evaluating the data and assumptions used, and the underlying calculation); developing an independent expectation and comparing it to management's estimate; and reviewing subsequent events occurring between the reporting date and the date of the auditor's report that confirm or contradict the estimate (though this final approach is only available, and only genuinely conclusive, where a sufficiently relevant subsequent event has actually occurred by the time of the audit).

SA 610 and SA 620: using the work of others

SA 610, using the work of internal auditors, permits the external auditor to use internal audit's work, and even to use internal auditors directly to provide assistance under the external auditor's direction, but only after evaluating the internal audit function's objectivity, the technical competence of internal auditors, whether internal audit applies a systematic and disciplined approach, and, critically, only for work of a nature the external auditor judges appropriate to use, reflecting that the external auditor retains sole responsibility for the audit opinion and cannot delegate away that ultimate responsibility merely by relying on internal audit's own work.

SA 620, using the work of an auditor's expert, applies where the auditor uses the work of an individual or organisation possessing expertise in a field other than accounting or auditing (an actuary valuing a complex insurance liability, a valuer assessing a specialised asset) — the auditor must evaluate the expert's competence, capabilities and objectivity, obtain a sufficient understanding of the expert's field to evaluate the adequacy of the expert's work for the auditor's purposes, and evaluate the appropriateness of the expert's work as audit evidence, again reflecting that using an expert's work does not transfer the auditor's own ultimate responsibility for the audit opinion to that expert.

SA 265: communicating deficiencies in internal control

Where the auditor identifies deficiencies in internal control during the audit, SA 265 requires the auditor to communicate significant deficiencies in writing, on a timely basis, to those charged with governance, and to communicate other, less significant deficiencies to management at an appropriate level of responsibility — a significant deficiency is one or a combination of deficiencies in internal control that, in the auditor's professional judgement, is of sufficient importance to merit the attention of those charged with governance, a judgement call requiring you to weigh the likelihood and potential magnitude of misstatement a specific control deficiency could permit, exactly the kind of professional judgement application this whole chapter is built around testing.

Why this chapter is the paper's centre of gravity

Nearly every other chapter in this paper — group audits, bank audits, specialised engagements — assumes the planning, risk assessment, materiality and evidence discipline this chapter develops as a baseline, applying it to a more specific engagement type or industry context. Treat mastery of this chapter's integrated application of SA 300, 315, 320, 330, 450, 520, 540, 610, 620 and 265 together, within a single, realistic scenario, as the single highest-leverage preparation investment in the entire paper.