Risk of Material Misstatement for Investments
Overview
Risk of material misstatement is a combination of inherent risk and control risk. Likewise, risk of material misstatement for investments is the risk that investment accounts contain material misstatement but the internal control cannot prevent or detect such misstatement.
Hence, the level of risk of material misstatement for investments will depend on whether their inherent risk is high or not and whether there are effective control procedures to reduce the chance of risk occurring or to timely detect such risk before it has a significant impact on financial statements.
In short, inherent risk and control risk of investments will decide the level of risk of material misstatement and auditors will have to modify detection risk to properly respond to the assessed risk of material misstatement.
Inherent Risk of Investments
Inherent risk is the risk that could occur on the accounts or balances before considering any control in place. In this case, inherent risk of investments is the risk that investments contain material misstatement before taking internal control into consideration.
In short, inherent risk of investment accounts is their susceptibility to misstatement. Likewise, the level of inherent risk is based on nature and types of transactions. For example, we usually consider the inherent risk of transactions that involve derivative instruments to be high due to their complex nature.
Examples of inherent risk of investments may include:
- Improper valuation of investments due to their complexity (especially when dealing with derivative instruments)
- Incorrect value of investments (e.g. due to changes in market value has not been recorded)
- Impairment of investments are not properly measured and recorded
- Investment transactions are recorded in the wrong accounting period
- Incorrect method of accounting used in investments
- Losses from investments may be hidden or delayed reporting (e.g. with the improper method of valuation)
- Wrong classification of investments (e.g. due to the staff’s lack of knowledge)
- Revenues from investments are overstated
- Fictitious investments are recorded
- Investments are stolen
- Investments are intentionally overstated to cover fraud
- Inadequate disclosure about investments in financial statements
Control Risk of Investments
Control risk is the risk that the client’s internal controls cannot prevent or detect material misstatement on the financial statements. In this case, the control risk of investments is the risk that investment accounts contain material misstatement, but the related control procedures cannot prevent or detect such misstatement.
Auditors usually assess the control risk when they obtain an understanding of the client’s business and control environment. In this case, after identifying the inherent risk of investments, auditors would usually try to assess whether there are control procedures in place to prevent or detect such risk, especially when they conclude that inherent risk is high.
Likewise, if the inherent risk of investments is high, the level of risk of material misstatement will depend entirely on the control risk. Hence, only adequate internal control procedures may reduce the risk of material misstatement for investments to some extent.
Examples of internal control procedures that can reduce the risk of material misstatement for investments may include:
- Proper authorization controls (e.g. all purchases and sales of investments need to be approved by the board of directors)
- Proper segregation of duties (e.g. the persons, who have the right to make investments and persons who are responsible for the custody of investments, are different persons)
- Monthly reconciliation of investments schedule to the general ledger
- Proper physical controls of investments to prevent them from loss
- Adequate policies on valuation and classification of investments
- Periodic performance review of investments
- Periodic internal audit
It is useful to note that when auditors assess that the control risk of investments is low and want to rely on internal controls to reduce some of their substantive works, they need to perform the test of controls to obtain sufficient appropriate audit evidence to support their assessment.
On the other hand, if they assess that the control risk is high, they will just ignore the test of controls and go directly to substantive tests (by performing more work). After all, there is no point of trying to prove that internal control is weak and ineffective in preventing or detecting the risk of material misstatement that could occur in the investment accounts.