THE RISK OF MATERIAL MISSTATEMENT (RMM) AUDIT PROCEDURES - RESPONSE TO RISKS & EVALUATING THE AUDIT VERIFICATION OBTAINED

Meaning the RMMa material misstatement in a relevant assertion the
 auditor should obtain evidence about how controls
Auditors must consider audit risk and must determinewere applied at relevant times during the period
a materiality level for the financial statements takenunder audit. If substantially different controls were
as a whole." Auditors also "must obtain a sufficientused at various times, the auditor should consider
understanding of the entity and its environment,each time period separately.
including its internal control, to assess the risk of 
material misstatement the risk of materialTests of controls may be designed to be performed
misstatement has been assessed for major accounts,concurrently with test of details. When performing
transaction streams and disclosures, the auditor mustthese dual-purpose tests, the auditor should consider
develop an audit plan in which he or she documentshow the outcome of the test of controls may affect
the audit procedures that, when performed, arethe extent of substantive procedures to be
expected to reduce audit risk to an acceptably lowperformed.
level 
  
  
In additional: The auditor is required to assess the risk 
of material misstatement (RMM) according to AuditA material misstatement that is detected by the
Risk and Materiality in Conducting an Audit. RMM isauditors, but not identified by the entity, should be
the auditor's combined assessment of inherent riskconsidered as at least a significant deficiency. It may
and control risk. Auditors are also required to performalso be a strong indicator of a material weakness in
audit procedures to respond to assessed RMM. Theinternal controls that should be communicated to
auditor should obtain an understanding of the entitymanagement. When evidence about the operating
and its environment, including its internal control,effectiveness of controls is obtained during an interim
sufficient to identify and assess the risks of materialperiod, consideration should be given to what further
misstatement of the financial statements whetherevidence is needed for the remaining period. If the
due to fraud or error, and sufficient to design andauditor plans to use audit evidence about the
perform further audit procedureseffectiveness of controls that was obtained in a prior
 period,
  
In my article   have tried to clearly discuss how theThe auditor should also increase the extent of testing
auditor responds to the risk of material misstatementof controls as the rate of expected deviation
(RMM) in designing and performing audit procedures.increases. In some instances the expected rate of
 deviation may be too high to obtain evidence that will
 sufficiently reduce the control risk. Tests of controls
 would then be inappropriate.
Overall Responses: 
 Once the auditor determines that automated controls
 are working effectively, the auditor should perform
The auditor's overall responses to address thetests to determine that the controls continue to
assessed risks of material misstatement at thework as intended, especially if changes are made to
financial statement level may include emphasizing tothe program.
the audit team the need to maintain professional 
skepticism in gathering and evaluating audit evidence, 
assigning more experienced staff or those withConsidering the Nature, Timing, and Extent of Further
specialized skills or using specialists, providing moreAudit Procedures
supervision, or incorporating additional elements ofNature:
unpredictability in the selection of further audit 
procedures to be performed. Additionally, the auditorThe nature of further audit procedures refers to
may make general changes to the nature, timing, ortheir purpose (tests of controls or substantive
extent of further audit procedures as an overallprocedures) and their type, that is, inspection,
response, for example, performing substantiveobservation, inquiry, confirmation, recalculation,
procedures at period end instead of at an interimreperformance, or analytical procedures. The auditor
date.should obtain audit evidence about the accuracy and
 completeness of information produced by the entity's
 information system when that Information is used in
The auditor's overall responses to the assessed RMMperforming audit procedures. For example, if the
includeauditor uses non-financial information or budget data
 produced by the entity's information system in
1. Maintaining professional skepticism in gathering andperforming audit procedures, such as substantive
evaluating audit evidence.analytical procedures or tests of controls, the auditor
2. Assigning more experienced staff.should obtain audit evidence about the accuracy and
3. Using specialists.completeness of such information
4. Greater supervision of staff. 
5. Element of unpredictability in selection of furtherTiming:
audit procedures. 
6. Changes in nature, timing, and extent of further 
audit procedures.Timing refers to when audit procedures are
7. Increase the number of locations to be included inperformed or the period or date to which the audit
the audit scope.evidence applies. The higher the risk of material
 misstatement, the more likely it is that the auditor
The effectiveness of the control environment has amay decide it is more effective to perform
significant bearing on whether the auditor will employsubstantive procedures nearer to, or to perform
a primarily substantive approach or a combinedaudit procedures unannounced or at unpredictable
approach that uses tests of controls as well astimes. Certain audit procedures can be performed
substantive procedures.only at or after period end, for example, agreeing the
AUDIT PROCEDURES RESPONSIVE TO RISKS OFfinancial statements to the accounting records, or
MATERIAL MISSTATEMENTexamining adjustments made during the course of
 preparing the financial Statements. If there is a risk
The auditor should design auditing procedures tothat the entity may have entered into improper sales
achieve the objective of a high level of assurancecontracts or that transactions may not have been
that the financial statements are free of materialfinalized at period end, the auditor should perform
misstatement. Those further auditing proceduresprocedures to respond to that specific risk.
consist of either tests of controls or substantive 
procedures. In designing further audit procedures, the 
auditor should consider such matters as:ExtenT:
  
The significance of the riskExtent refers to the quantity of a specific audit
 procedure to be performed, for example, the extent
• The likelihood that a material misstatement willof an audit procedure is determined by the judgment
occurof the auditor after considering the tolerable
• The characteristics of the class of transactions,misstatement, the assessed risk of material
account balance, or disclosure involvedmisstatement, and the degree of assurance the
• The nature of the specific controls used by theauditor plans to obtain. An auditor may use
entity, in particular, whether they are manual ortechniques such as computer-assisted audit
automatedtechniques to enable him or her to extensively test
• Whether the auditor expects to obtain auditelectronic transactions and account files. Such
evidence to determine if the entity's controls aretechniques can be used to select sample transactions
effective in preventing or detecting materialfrom key electronic files, to identify transactions with
misstatements.specific characteristics, or to test an entire population
 instead of a sample. This Statement regards the use
The nature of the audit procedures is of mostof different audit procedures in combination as an
importance in responding to the assessed risks.aspect of the nature of testing as discussed above.
 However, the auditor should consider whether the
 extent of testing is appropriate when performing
There should be a clear linkage between auditdifferent audit procedures in combination.
procedures and the risk of material misstatement atControls:
the relevant assertion level for each class of 
transactions, account balance, and disclosure. TheThe timing of tests of controls depends on the
higher the auditor's assessment of risk, the moreauditor's objective and the period of reliance on
reliable and relevant thethose controls. When the auditor tests controls at a
Evidence must be to satisfy the auditor's objectives.particular time, the auditor may obtain audit evidence
The higher the RMM, the more likely it is that thethat the controls operated effectively only at that
auditor will perform the procedures at the end oftime. The auditor should test controls for the
period or at unpredictable or unannounced times.particular time, or throughout the period, for which
Certain procedures may only be performed at orthe auditor intends to rely on those controls. Audit
after the period end date.evidence pertaining only to a point in time may be
 sufficient for the auditor's purpose,
  
The extent or quantity of audit procedures is 
determined by the auditor's judgment. The auditorConclusion: The auditor's assessment of the identified
should consider the assessed risk of materialrisks at the relevant assertion level provides a basis
misstatement, the tolerable misstatement,for considering the appropriate audit approach for
And the degree of assurance desired. Generally,designing and performing further audit procedures. In
sampling is used to achieve audit objectives. Tests ofsome cases, the auditor may determine that
controls should be performed if controls areperforming only substantive procedures is appropriate
expected to be effective in preventing or detectingfor specific relevant assertions and risks.