Why an audit can never check everything
By now you know what an external audit sets out to do: give users reasonable assurance that the financial statements, taken as a whole, are free of serious error. Notice the word *reasonable* — not absolute. A large company posts millions of transactions a year, and no auditor on earth re-performs every one of them. There is not enough time, and the fee would dwarf the value. So the auditor does something more interesting than brute force: she decides, deliberately, where the danger of a serious error is highest, and concentrates her limited effort there. Everything in this guide is machinery for making that decision honestly.
Because the auditor samples rather than checks all, she accepts a real possibility of being wrong: she might sign off on statements that, unknown to her, still contain a serious error. The honest name for that possibility is audit risk — the risk that the auditor gives a clean opinion when the statements are in fact materially misstated. The auditor cannot drive this risk to zero (only checking everything could, and even that imperfectly), so instead she aims to push it *low enough* — and the tools below are how she earns the right to say she did.
The audit risk model: three risks multiplied
Auditors break audit risk into three pieces, and the audit risk model simply states that they multiply together. Inherent risk is the chance an account is misstated *before anyone considers controls* — just because of what it is. Cash you can count is low inherent risk; an estimate of a warranty liability, full of guesswork about future repairs, is high. Control risk is the chance that the company's own internal controls — the checks and approvals you studied earlier in this rung — *fail to catch* an error that did slip in. Detection risk is the chance the *auditor's own procedures* miss the error too. Multiply the three and you have the risk that, at the end of the chain, a real misstatement survives all the way into a clean opinion.
Audit risk = Inherent risk x Control risk x Detection risk
The auditor SETS a target for audit risk (say, 0.05 = a 5%
chance of being wrong) and ASSESSES the first two from the
client. Then she SOLVES for the detection risk she can allow:
Detection risk = Audit risk / (Inherent x Control)
Example: target AR = 0.05
inherent risk assessed at 0.80 (a tricky estimate)
control risk assessed at 0.50 (controls so-so)
Detection risk = 0.05 / (0.80 x 0.50) = 0.05 / 0.40 = 0.125
Only a 12.5% miss-rate is tolerable -> gather MORE evidence.
If controls had been strong (control risk 0.10):
Detection risk = 0.05 / (0.80 x 0.10) = 0.625
A 62.5% tolerable miss-rate -> she can test much less.Read the worked numbers slowly, because they reveal the whole logic of an audit. Inherent and control risk are *given* to the auditor by the client's situation — she can assess them, but she cannot change them. The only dial in her own hands is detection risk, and she turns it by gathering more or less evidence. So the model is really a budget for effort: weak controls or a treacherous estimate squeeze the allowable detection risk down, and the only way to honor that is to *test more*. This is the exact mechanism by which last guide's study of internal control flows into this one — strong controls literally let the auditor do less work, and that saving is not a loophole, it is the whole reward a company earns for controlling itself well.
Materiality: how wrong is too wrong?
The risk model keeps asking whether a *material* misstatement survives — but material to whom, and how big? Materiality is the threshold below which an error simply would not change the decision of a reasonable person relying on the statements. The classic test is decision-flipping: if knowing the true figure instead of the reported one would lead an investor or lender to act differently — lend or not, buy or not — the difference is material; if no sensible person would budge, it is not. A misclassified \$50 stapler in a company with \$2 billion in revenue changes nobody's mind. A hidden \$50 million of fictitious sales might change everyone's. Materiality is the line between those two worlds.
Because it depends on the user's decision, materiality is relative, not a fixed dollar figure — what is trivial for a giant is enormous for a corner shop. In practice auditors anchor it to size with rough benchmarks, often a small percentage of a stable base such as pre-tax profit (commonly around 5%), total revenue, or total assets. Set that planning materiality first, and it quietly steers the whole audit back through the risk model: it tells the auditor how fine a net to weave. An account that could not possibly hold an error as large as materiality needs little attention; an account that easily could is where the effort goes. So materiality is not only a year-end judgment about acceptable error — it is a planning tool that decides, in advance, what is worth chasing.
Evidence: what actually convinces an auditor
Having decided where the risk is and how big an error matters, the auditor goes out and gathers audit evidence — the facts that support, or fail to support, what the statements assert. Crucially, not all evidence is equally trustworthy. Evidence the auditor obtains *directly* beats what the client hands her; evidence from an *independent outside party* beats what the company produces about itself; *written* beats spoken; and evidence about *strong controls* makes the records themselves more believable. A bank statement mailed straight from the bank is powerful; the bookkeeper's word that the balance is right, far less so. The auditor is forever weighing each piece on this scale of reliability.
Auditors collect that evidence through a standard toolkit of audit procedures, and it is worth knowing each by name because they map onto exactly the reliability ideas above. *Inspection* examines records or physically counts assets — reading a contract, eyeballing the inventory on the warehouse floor. *Confirmation* asks an independent outsider to verify a fact directly to the auditor — a letter to a customer confirming the receivable balance, or to the bank confirming cash. *Observation* watches a process happening, such as standing by while staff count stock. *Recalculation* re-does the client's arithmetic, like re-footing a depreciation schedule. And *analytical procedures* compare the numbers to expectations — to last year, to the budget, to the industry — and flag whatever looks strange enough to investigate.
- Inspection — read documents or physically examine an asset (a signed lease; counting the goods in the warehouse).
- Confirmation — get an independent third party to verify a balance directly (the bank confirms cash; a customer confirms the receivable).
- Observation — watch a process as it happens (stand by during the physical inventory count).
- Recalculation — re-perform the client's math (re-foot the depreciation schedule; recompute interest expense).
- Analytical procedures — compare to expectations (this year vs last, actual vs budget, ratios vs the industry) and chase the outliers.
Notice how analytical procedures lean on every skill you built in the analysis rung — horizontal change, common-size ratios, turnover. An auditor who computes that gross margin jumped from 30% to 45% in a flat market has not proven fraud, but she has found a thread worth pulling. This is also where sampling lives: rather than confirm every one of ten thousand receivables, the auditor tests a carefully chosen subset and reasons from it to the whole — accepting, openly, that a sample can mislead, which is one more reason audit risk can never reach zero.
Professional skepticism: trust, but verify — then verify again
All the machinery above can be defeated by one human failing: believing the client too easily. The corrective is professional skepticism — a questioning mind that neither assumes management is dishonest nor assumes it is honest, but insists on evidence either way. It is the discipline of asking 'how would I know if this were wrong?' and not stopping at the comfortable answer. Management says the slow-moving inventory will sell; skepticism asks for the sales orders. The estimate looks reasonable; skepticism asks what assumptions it rests on and what happens if they shift. Skepticism is precisely what stops an auditor from collecting evidence that merely confirms what she already hoped to find.
Skepticism matters most exactly where the risk model says inherent risk is highest: estimates, related-party deals, revenue near year-end, anything management has an incentive to bend. The reason it cannot be relaxed is structural — the auditor is paid by the company she audits, and works alongside its people for weeks, which makes the slide into trusting them all too easy. That is why professional standards make skepticism a *duty*, not a mood: the auditor must actively look for reasons the numbers might be wrong, even when everyone is friendly and nothing seems amiss. The history of accounting scandals is, almost without exception, a history of skepticism quietly switched off.
Pull the four threads together and the audit becomes one coherent story. The risk model points the auditor toward the dangerous accounts; materiality tells her how large an error there would matter; the right procedures gather evidence reliable enough to settle the question; and professional skepticism keeps her honest while she weighs it. When the evidence finally satisfies her that any remaining error sits comfortably below materiality, she has earned the right to her opinion — the subject of the next guide.