External audit

Learning outcome statements

The learning outcome statements relevant for this section are:

1. define inherent risk, control risk, and detection risk
2. demonstrate an understanding of external auditor responsibilities, including the types of audit opinions that external auditors issue

External audit

External auditors are independent professionals or firms engaged to examine an organization’s financial statements and express an opinion on their fairness and conformity with applicable accounting standards, typically Generally Accepted Accounting Principles (GAAP) or International Financial Reporting Standards (IFRS). Their core responsibilities include planning and conducting audits, assessing the risk of material misstatement, testing internal controls, evaluating accounting estimates, and forming a professional judgment on whether the financial statements are free from material misstatement.

In the United States, these responsibilities are governed by auditing standards issued by the Public Company Accounting Oversight Board (PCAOB) for audits of public companies, and by the AICPA’s Auditing Standards Board (ASB) for private entities. Additionally, under the Sarbanes-Oxley Act of 2002 (SOX), auditors of publicly traded companies must evaluate and report on the effectiveness of internal control over financial reporting (Section 404).

By adhering to regulatory standards and maintaining independence from management, external auditors help promote transparency, accountability, and trust in financial reporting. Their work provides assurance to shareholders, regulators, creditors, and the investing public.

Reasonable assurance

Auditors do not guarantee absolute accuracy or the complete absence of misstatements. Instead, they aim to provide reasonable assurance, which is a high, but not absolute, level of confidence that the financial statements are free from material misstatement. Reasonable assurance recognizes that audits are conducted within the limits of time, cost, and available evidence, and that judgment is involved in both performing audit procedures and interpreting results.

Audit risk and components

A core concept in external auditing is audit risk.

Definitions

Audit risk

The possibility that the auditor may unknowingly fail to appropriately modify their opinion on financial statements that are materially misstated.

In other words, despite conducting an audit in accordance with professional standards, there remains a risk that the auditor will issue an unqualified opinion on financial statements that contain significant errors or fraud.

Audit risk is composed of three interrelated components:

Definitions

Inherent risk

The susceptibility of an assertion to a material misstatement, assuming no related controls are in place. This risk arises from the nature of the business, industry conditions, complexity of transactions, and level of judgment involved. For example, companies in high-tech or financial sectors with rapidly changing environments or reliance on estimates and assumptions may have higher inherent risk.

Control risk

The risk that a material misstatement will not be prevented or detected and corrected on a timely basis by the entity’s internal control system. Control risk depends on the design and operating effectiveness of internal controls. Weak or poorly implemented controls increase the likelihood that errors or fraud may occur and remain undetected.

Detection risk

The risk that the auditor’s own procedures will not detect a material misstatement that exists. Detection risk is influenced by the nature and extent of audit procedures, auditor judgment, and the possibility of sampling errors. Auditors try to keep detection risk low by designing appropriate audit tests, using professional skepticism, and ensuring sufficient audit evidence is obtained.

These risks are commonly visualized in the Audit Risk Model:

$$\text{Audit risk (AR)}=\text{Inherent risk (IR)}\times \text{Control risk (CR)}\times \text{Detection risk (DR)}$$

$$\text{Risk of material misstatement (RMM)}=\text{IR}\times \text{CR}.$$

This is assessed by the auditor during planning phase of the audit to tailor the audit procedures.

The auditor sets audit risk at an acceptably low level, then assesses inherent risk and control risk, neither of which the auditor can change. Detection risk is the only component the auditor controls, so it’s solved for: $\text{DR}=\text{AR}÷\text{RMM}$. The higher the assessed RMM, the lower detection risk must be, which means more, and more effective, substantive procedures.

Audit responses to RMM

If RMM is high, auditors increase the nature, timing, and extent of their audit procedures: e.g., more detailed testing, performing procedures at year-end instead of interim, or using more experienced staff.

If RMM is low, auditors may rely more on internal controls and reduce substantive procedures.

Types of audit opinions

At the conclusion of the audit, the external auditor issues an audit opinion. Types include:

• Unqualified opinion: The financial statements present fairly, in all material respects, in accordance with the applicable financial reporting framework. This is the most favorable outcome and indicates that the financial statements are reliable. For companies, it enhances investor confidence and may positively influence credit ratings and share price.
• Qualified opinion: The auditor concludes that, except for a specific issue, the financial statements are fairly presented. This issue is material but not pervasive. While the financial statements are mostly accurate, the qualification can raise concerns among investors or lenders, prompting follow-up questions about the nature of the issue.
• Adverse opinion: The auditor determines that the financial statements contain material and pervasive misstatements and do not present fairly, in all material respects, in accordance with the applicable financial reporting framework. This is the most serious type of opinion and can severely damage a company’s credibility, trigger regulatory investigations, and negatively affect market value and stakeholder trust.
• Disclaimer of opinion: The auditor is unable to obtain sufficient appropriate audit evidence and thus does not express an opinion on the financial statements. This often results from limitations on audit scope or unresolved uncertainties. A disclaimer can lead to significant doubt about the integrity of the company’s financial reporting and may hinder its ability to attract investment or financing.

Which modified opinion applies depends on both the cause of the issue and how severe it is:

Cause	Material but not pervasive	Material and pervasive
Misstatement in the financial statements	Qualified opinion	Adverse opinion
Scope limitation (can’t obtain sufficient evidence)	Qualified opinion	Disclaimer of opinion

A later chapter covers the Sarbanes-Oxley Act in more detail.