Inherent risk factors and the spectrum of inherent risk

• Apply the five inherent risk factors to an assertion.
• Assess inherent risk using likelihood and magnitude.
• Explain why a low-likelihood, high-magnitude risk can be higher on the spectrum.

Inherent risk, defined

AU-C 315.04 describes inherent risk as the susceptibility of an assertion about a class of transactions, account balance or disclosure to a misstatement that could be material, individually or aggregated, before consideration of any related controls.

A risk of material misstatement exists when there is a reasonable possibility of a misstatement occurring (likelihood) and, if it occurred, a reasonable possibility of it being material (magnitude) (AU-C 315.05).

The five inherent risk factors

AU-C 315.12 defines inherent risk factors as characteristics of events or conditions that affect susceptibility to misstatement, before controls. They include:

• Complexity. Calculations, contract terms or transaction structures that are hard to process correctly. Multi-element revenue contracts, inventory costing with overhead allocations.
• Subjectivity. Limits in the knowledge or data available, so management must choose among reasonable approaches. Most estimates.
• Change. New products, systems, regulations, accounting standards, personnel or business lines.
• Uncertainty. Amounts that cannot be measured precisely with direct observation, like litigation or credit losses.
• Susceptibility to misstatement due to management bias or other fraud risk factors. Pressure from targets, covenants or bonuses, and opportunity to influence amounts.

AU-C 315.A11 adds two more considerations: the quantitative or qualitative significance of the item, and the volume or lack of uniformity of items processed.

Likelihood and magnitude

AU-C 315.35 requires you to assess inherent risk for each identified assertion-level risk by assessing likelihood and magnitude, taking into account how and to what degree inherent risk factors affect susceptibility, and how financial statement level risks affect assertion-level inherent risk.

AU-C 315.A242-.A243 explain the combination:

• The higher the combination of likelihood and magnitude, the higher the assessment.
• A risk does not need both to be high. A lower likelihood with very high magnitude can produce a higher assessment.

That second point catches teams who rate everything "low likelihood, so low risk." A rarely occurring but very large potential misstatement, such as a missed impairment on a plant that is half the balance sheet, belongs higher on the spectrum.

The spectrum

The assessment is a judgment within a range from lower to higher (AU-C 315.A239). AU-C 315.A244 allows you to use categories along the spectrum: low, medium and high; lower and higher; numeric scales. Whatever method you use, the assessment is appropriate when your responses are appropriately designed and implemented to address it, and when the reasons for the assessment are clear.

Firms commonly use four or five points: low, moderate, elevated, high, with "significant" at the top. Use enough categories that responses actually differ between them. If moderate and elevated drive identical procedures, they are one category on paper only.

Documenting the rationale

AU-C 315.42(d) requires documentation of the identified and assessed risks and the rationale for significant judgments. For inherent risk, that means naming the factors in play and the likelihood and magnitude conclusion. A matrix column with "M" and no reason does not show judgment. The RMM matrix by assertion has a column for each factor.

Common findings

• Every account rated "moderate."
• No factors cited; only a rating.
• Magnitude ignored because the item rarely goes wrong.
• Financial statement level risks, like a weak tone at the top, not carried into assertion-level assessments.

Next, see how the top of the spectrum becomes a significant risk.

Placing three risks on the spectrum