financial-audit

Financial Audit (risk, controls, evidence, findings)

The method is risk-first, not checklist-first

1. Plan: understand the entity, set materiality, identify where the statements are most likely to be materially wrong (risk assessment by account and assertion).
2. Test controls where you intend to rely on them; otherwise go straight to substantive work.
3. Substantive procedures sized to residual risk: more risk → more evidence.
4. Conclude and report: findings with condition/criteria/cause/effect, a management letter, and workpapers that let a stranger re-perform the audit.

Effort follows risk. Auditing every account equally means over-auditing petty cash and under-auditing revenue.

Materiality

overall materiality      ≈ benchmark × rule-of-thumb %
common rules of thumb:     5% of pre-tax profit, 0.5–1% of revenue, 1–2% of total assets
performance materiality  ≈ 50–75% of overall (working threshold, leaves room for aggregation)
trivial threshold        ≈ 3–5% of overall (below this, don't accumulate)

These percentages are convention, not law — pick the benchmark users of the statements care about and document why. Materiality is also qualitative: a small misstatement that flips a covenant, turns a loss into a profit, or involves management override is material regardless of size.

Assertions — what you're actually testing

Every balance is tested against assertions: existence/occurrence (it's real), completeness (nothing missing), accuracy/valuation, cutoff (right period), rights and obligations, presentation. Direction matters: existence testing samples from the ledger to source documents; completeness samples from source documents (or the world) back to the ledger. Testing the wrong direction finds nothing — you cannot prove completeness by vouching ledger entries.

Controls: walkthrough, then test

• Walkthrough: trace one transaction end-to-end to confirm the process is as described. It proves design, not operation.
• Control testing: sample the control's operation across the period (common convention: 25–40 items for a frequent manual control, 1 for an automated control plus IT general controls). A deviation triggers evaluation — root cause, possible sample extension, and deficiency assessment — never a silent waiver as "isolated".
• Segregation of duties: no one person should initiate, approve, record, AND hold the asset. In small entities where this is impossible, compensating review by the owner is the fallback — test that the review actually happens (evidence of it, not assertion of it).