So, in this lesson, we're going to build on the basic building blocks of assertions and start talking about a set of steps for assessing RMM, what might that stand for, in verifying assertions. RMM is the risk of material misstatement. Risk of material misstatement is the product of inherent risk and control risk. Now, we'll cover that again, we covered all three inherent, control, and detection risk a few lessons ago. But you should now be getting comfortable with the risk of material misstatement being that part of the risk that the auditor mostly assesses. And then, when the auditor reacts to the risk of material misstatement by constructing verification procedures that is actually driving down detection risk. The goal, remember, is to have the risk of material misstatement times detection risk, equal a sufficiently low number, and that number is called audit risk. You want the overall audit risk to be acceptably low and that's going to be driven in part by risk of material misstatement, and in part by detection risk, in part by inherent and control risk, and in part by detection risk. So the first thing to do when you're trying to assess the risk of material misstatement, you have to actually identify the assertions being made by the asserter. And you will quickly come to understand that various accounts in a financial statement, have their usual suspects of higher versus lower inherent risks. Now, whether that's a higher or lower risk of material misstatement, really depends on what kind of firm you have. If it's a control conscious firm, with a strong tone at the top, they're going to invest in internal controls over financial reporting. Where are they going to do that? Well they'll do that precisely where the inherent risks are higher. So just because you have higher inherent risk, doesn't mean you have higher risk of material misstatement. So when you're thinking about inventory, are you usually going to be worried about the completeness of inventory, or the existence of inventory? Well, like most assets, you're going to be more worried about the existence of inventory, because that speaks to an overstatement potential for inventory. An overstatement of inventory will do what in terms of total assets? Overstate total assets. It will do what, in terms of net income? It will overstate net income. You see. So most companies tend to want to exaggerate the performance, rather than to under-report their performance. In fact, the only time they want to under report their performance is maybe if they think there's going to be like a labor strike, or they want to take a poison pill to look less attractive because they're being, potentially a takeover target. So you identify these assertions being made, and you know that different account balance have the usual suspects of higher risk assertions. The next step is that you assess and justify the risk of material misstatement. Well how do you assess and justify this risk? It will differ by firms. Firms don't assess a particular probability here. When I talk to my friends in the decision sciences or even meteorologists, they'll say the chance of rain or chance of thunderstorm is 30% tomorrow. We don't see this in auditing. They don't really say the inherent risk of the valuation assertion and inventory is 80%, it just doesn't happen. Audit textbooks sometimes use these numbers but that's just to be very infantile and helping you through the first few early problems. What the firms do instead is that they classify inherent risk into 2 to 5 buckets, usually 2 or 3. So, when I say that, it's either going to be lower or higher, or low, medium, high, that's what you usually see. The inherent risk assessments are done by professional judgment by a professional, who has a deep understanding of that client. So, if you're following Starbucks... I mean if you're an auditor of Starbucks and I think that's Deloitte these days, and has been for some time, you're going to be wanting to follow the coffee industry very very carefully, and you're going to be listening to the earnings calls of Starbucks regularly every quarter. You're going to become deeply familiar with that company and you will understand where in the financial statements at Starbucks there are greater and lower risks of material misstatement. A company like Starbucks with, what seems to me, to be a pretty strong tone at the top, in terms of financial reporting. You're probably not going to have terribly many super high inherent risks, but you may have some high and a few medium. You're going to do this by, again, looking at the things like integrity of management, the complexity of the estimation process used to derive the account balance. Sometimes these estimates are straightforward, like if you're doing straight-line depreciation, that's sort of pretty much plug and chug. If you're doing a fair value estimate, and you're looking at a situation where, if you know you're a gap there when it comes to fair value of some instruments, you have level 1, level 2, level 3. Once you get away from a situation when you're assessing fair value easily, because it's a level 1 situation where you can just look into the Wall Street Journal for stock price, there's a market price readily stated. Sometimes you have to develop a model to estimate the fair value. Well, if you're developing a model to estimate the fair value management is, it becomes a lot more subjective, a lot more susceptible to being wrong, inherently. How much risk of material misstatement is there? Well, you can't stop with inherent risk, you have to also look at control risk. To test control right, to assess control risk rather, you must actually test it. So if you think a control is well-designed, you cannot say, as an auditor... This is the rules, okay? In PCAOB, AICPA, and international audit standards all say this. If you see some controls and they look like they're well-designed, such that you think that you have something like a medium risk or low risk for control, which would really be helpful in reducing overall risk of material misstatement, wouldn't it? Well, you can't just look at the design of internal controls, you have to actually test the operating effectiveness of these controls. So how do you do that? Well you observe the controls being enforced, you maybe do some documentation tests on these controls. So, what you do here to assess risk of material misstatement, inherent risk is completely a judgment call, based on complexity of transactions, susceptibility to error, management's integrity, the nature of the industry, whether there's been a presence of material adjustments in this area in prior engagements, is this the first year or second year in engagement, things like that. Control risk is going to be a function of how strongly the controls are designed, but going a step further than that, when you test the controls that you think will be strong. You hopefully find evidence that they are in fact strong, which will justify you having a control risk assessments that is low. When you have a low control risk assessment, certainly even if you have a medium inherent risk assessment, you can make a case for overall risk of material misstatement being low as well. If you have a high inherent risk and a low control risk, you can certainly justify a medium risk of material misstatement. So one thing about this multiplicative model, is that it's very compensatory. Now how low of a risk of material misstatement you have is critical to the audit, because that tells the auditor how much evidence he or she needs to gather to drive detection risk down to an acceptably low level, so that ultimately audit risk is sufficiently low. So that's a little bit of background on how we go about assessing and justifying this risk. It's not just medium, it's actually quite evolved. Next step, you have to determine the attest objective for verifying the assertion. So, what I'm talking about is what broad action statement do you want to do? If you have residual risk after risk material misstatement that is medium, you're going to have to get that audit risk down to a lower level with some detection risk attacks, and you can get that detection risk down. So, you want to ask yourself, what do I need to do? So, maybe I want to ensure that all recorded revenue is in fact non-fictitious revenue, would be an example of testing the existence assertion. Four, you determine and attest procedure. This is, now we're getting into another nuts and bolts of auditing. You have to understand the company, you have to assess in a justifiable way these risks, and you have to know where your detection risk. You can get away with a higher detection risk because RMM is low, or where you need a lower detection risk because RMM is unfortunately, either medium or high. But it's not enough to simply have accurate risk assessment, and by the way, risk assessment is very, very hard. I'll show you some really cool data on that in a different lesson. But what you have to do as an auditor, you have to now know what procedures do I perform to attack that risk of material misstatement, via a lower detection risk? I need to know what procedures to perform. And this is like the physician, once they see a patient is at higher risk for a bacterial infection, there's one set of responses. What's the antibiotic that I can prescribe to which this patient is not allergic? They're not allergic to penicillin, I can give them... But if it's a viral infection, that would be a completely inappropriate tool to use, an antibiotic. As I understand, and I mean, I'm not a physician. But in the audit world, if you have a completeness high RMM, you're going to have to understand, that you're not going to be doing vouching as a procedure. You're going to do some tracing procedures.
