Auditing & Assurance: Checking Some to Trust All

A company's managers know its numbers better than anyone, and they are also the people with the most to gain if the numbers look good. Lenders deciding whether to lend, investors deciding whether to hold, and workers deciding whether a firm will pay next year cannot see inside. So societies invented a stranger: someone with no stake, who looks at the books, tests them and signs a one-page statement saying whether they can be trusted.

That page is short and widely misread. It does not say the company is healthy, or that no fraud occurred, or that every number is right. It says that, in the auditor's professional opinion, the statements are free of material misstatement, after a sample of work built around where mistakes were most likely. Each of those italicised words is a whole chapter of the course, and the best-known frauds of the last quarter-century slipped through the gaps between them.

A graduate of this course reads an audit report the way a pilot reads a weather briefing: as a calibrated statement of what was checked and how sure anyone can be. The sections below build that calibration one idea at a time.

This describes how auditing works. It is not legal, tax or investment advice. The ledgers and companies in the tools are invented; real cases are described from public records and dated.

Assurance: why a stranger signs off on the numbers

Economists call it the agency problem: the owners hire managers to run a firm, the managers know more than the owners, and their interests are not identical. Audits are one of the cheapest answers anyone has found. The auditor is paid by the company, appointed by the owners or their committee, and forbidden by ethics rules (and in many countries law) from having a stake in the result.

The vocabulary is exact. The standards that govern most of the world's audits are the International Standards on Auditing (ISAs), issued by the IAASB, a body working under the International Federation of Accountants; the United States has its own standards for public companies, set by the PCAOB, which Congress created in the Sarbanes–Oxley Act of 2002. Both give the auditor reasonable assurance, a high but not absolute level of comfort. That is not modesty: the cost of absolute assurance would be checking everything, and a determined fraudster who forges documents and colludes can beat even a careful test.

The report ends in one of four opinions. An unmodified (clean) opinion says the statements give a true and fair view, or present fairly in all material respects, depending on the country's wording. A qualified opinion says "except for" one confined problem. An adverse opinion says the statements are materially and pervasively wrong. A disclaimer says the auditor could not gather enough evidence to form a view. These are the categories of ISA 705. The choice depends on two questions: is the problem big enough to matter, and is it confined or everywhere?

Without JavaScript: a $200,000 misstatement is below a $500,000 materiality and the opinion is clean; a confined $900,000 one gives a qualified opinion; a pervasive one gives adverse; a pervasive limit on the evidence gives a disclaimer.

Notice how rarely the dramatic opinions appear in practice, and why. Companies fix misstatements the auditor finds, or negotiate, before the report is signed. So a clean opinion carries information only because it can be withheld. A separate paragraph about going concern (ISA 570) tells readers whether the auditor doubts the firm can survive twelve months.

Materiality: how big a mistake matters

No ledger is perfect. A cashier makes a rounding error, an accrual is estimated a little high. The standards do not ask for perfection; they ask whether an error could change the decision of a reasonable user of the statements. That threshold is materiality. ISA 320 says the auditor sets it by judgement, usually from a benchmark chosen to match what readers care about: profit before tax for a steady profitable firm, revenue or assets where profit is volatile, equity for a charity or a bank.

The percentages themselves are not in the standard. Firms use rules of thumb: commonly around 5% of profit before tax or a fraction of 1% of revenue, with ranges that vary by firm and company. Two lower lines sit under it. Performance materiality (often something like half to three-quarters of the headline) is the working figure, set lower so that many small undetected errors do not add up past the line. And a clearly trivial amount (often around 5% of materiality) is a floor below which differences are not even logged.

Without JavaScript: profit before tax of $4.0m at 5% gives materiality of $200,000; at 65% performance materiality is $130,000 and the trivial level is $10,000.

Try a bad year: drop profit to $0.4m with the profit benchmark and materiality shrinks to $20,000, so tiny misstatements become material and the audit explodes in cost. That is why auditors switch to a steadier benchmark. Materiality has a qualitative side too. A $10,000 payment to a director is small in size but may matter to a reader worried about integrity, and a tiny misstatement that tips a company over a loan covenant or turns a loss into a profit can be material.

Audit risk: where to look hard

An audit cannot check everything, so it decides what to check by asking where mistakes are likely. The classic model puts it in three words multiplied together. Inherent risk is how prone an item is to error before any controls: a simple cash balance is low, a long-term contract valued on forecasts is high. Control risk is the chance the company's own checks fail to prevent or catch the error. Detection risk is the chance the auditor's tests miss it.

Solve it the other way round: detection risk = acceptable audit risk ÷ (inherent × control). Where inherent and control risk are both high, the auditor can only accept a low detection risk, so tests must be extensive. Where they are low, lighter tests will do. Under ISA 315 the auditor starts by understanding the business and its controls, because that is how the first two numbers are estimated. (Many firms now assess the two together, but the logic is unchanged.)

Without JavaScript: with 5% acceptable audit risk, 80% inherent risk, 50% control risk and a 5% tolerable error rate, detection risk is 12.5% and about 41 items need testing; with maximum risks it is 5% and 59.

The practical consequence is that audits are not uniform. A firm with a weak control environment, a recent change of system, aggressive bonus targets or a complex product gets more work on exactly those areas. The standard also tells auditors to treat revenue as a presumed fraud risk (ISA 240), because inflating sales is a common way to flatter results.

Sampling: checking some to learn about all

A company has 300 customer invoices. The auditor wants to know whether the receivables total is right. Checking all of them would cost more than the audit is worth, so the auditor checks a sample and reasons about the rest. If you draw items at random, the chance a sample of n items misses every one of the wrong items is (1 − the wrong items' share)ⁿ, and that is the idea behind every sampling plan.

In monetary unit sampling the unit sampled is a dollar, not an invoice: each dollar in the ledger is equally likely to be picked, and the invoice containing it is checked. Large invoices are then likely to be picked automatically, which is what an auditor wants, since a big error matters more. The method suits overstatements, which is the usual worry with receivables and inventory. Statistical sampling lets the auditor state the result with a confidence level; judgemental sampling does not, and ISA 530 allows both if the sample is representative.

The tool below has an invented ledger of 300 invoices. Six of them (the ringed squares) were overstated. Squares are invoices; darker means picked.

Without JavaScript: the six bad invoices are about 1.6% of the ledger's value, so a sample of 40 dollar-picks catches at least one about 48% of the time, 100 about 80% and 150 about 91%.

The sobering lesson is the size of the sample needed to find rare errors. When the wrong items are a small share of value, even a sample of 100 misses them about one time in five. Auditors therefore combine sampling with targeted tests of high-risk items, which they inspect in full, and with analytics.

Evidence and scepticism: not all proof is equal

Audit evidence comes in many forms: a count of stock, a signed contract, an email, a bank statement, a spreadsheet, an explanation from the finance director. ISA 500 says its reliability depends on its source and the way it is gathered. In general it is stronger when it comes from outside the company, when the auditor gets it directly, when it is documented and original, and when the controls that produced it are effective. A conversation is weaker than a document; a photocopy is weaker than an original; something the auditor saw is stronger than something they were told.

The attitude that goes with this is professional scepticism: a questioning mind, alert to conditions that suggest a misstatement, and a critical look at the evidence. It is not assuming dishonesty; the standards say the auditor also should not assume honesty. It is the habit of asking, "how would I know if this were false?" A common worry is that the longer an auditor works with a client, the easier it is to relax. That is one reason many countries limit auditors' non-audit work for the same client or rotate firms; the rules differ by jurisdiction and are argued about.

Without JavaScript: stronger evidence comes from outside the company (a statement received directly from the bank over one handed over by the client), is seen by the auditor (a stock count the auditor attends over a manager's estimate), is external over internal (a delivery receipt signed by the customer over the company's own order) and is an original over a copy.

Fraud: the triangle, the digits and the cases

Why do honest-looking people cheat? The criminologist Donald Cressey, interviewing convicted embezzlers in the early 1950s, concluded that three things came together: a pressure (debt, a target, a failing business), an opportunity (weak controls, a position of trust) and a rationalisation ("I'll put it back"). That fraud triangle is now standard in audit training. Later authors added capability, producing a "fraud diamond". It is a way to look for conditions, not a test of character.

How common is it? The Association of Certified Fraud Examiners studies cases its members investigate. Its 2026 report analysed 2,402 cases from 143 countries, and participating examiners estimate that organisations lose about 5% of revenue to fraud each year. These are samples of detected frauds, not measurements of all fraud, and they are mostly about theft by employees, a different thing from financial-statement fraud by senior managers, which is rarer and much larger when it happens.

Auditors use analytics to spot oddities in the numbers. One of the best known is Benford's law. In many natural collections of numbers that span several orders of magnitude, the leading digit is 1 about 30% of the time, 2 about 18% and 9 under 5%. Simon Newcomb saw it in logarithm tables in 1881 and Frank Benford documented it widely in 1938. Invented numbers rarely follow it: people spread their leading digits too evenly, or cluster just below an approval limit. Mark Nigrini turned the idea into a forensic-accounting tool, with the mean absolute deviation (MAD) as a measure of fit and published bands: roughly under 0.006 is close conformity, 0.006 to 0.012 acceptable, 0.012 to 0.015 marginal, above that nonconforming.

Without JavaScript: a natural ledger tracks Benford's 30.1%, 17.6%, 12.5%… for leading digits 1, 2, 3; an invented one is flat at about 11% each; one with many payments just under a $5,000 approval limit has a spike at digit 4.

Benford is a screen, not a verdict. It fails for sequential numbers such as invoice numbers, for prices set at thresholds such as $9.99, and for data that do not span orders of magnitude. A ledger can pass and still be false. In practice it is one of dozens of tests, run to decide where to dig.

The famous failures share a pattern. Parmalat, the Italian dairy group, collapsed in December 2003 after a document purporting to show about €3.95 billion in a Bank of America account of its Cayman subsidiary was found to be forged; its administrators later reported debts of about €14 billion. Satyam, an Indian IT firm, ended in January 2009 when its chairman wrote to the board confessing to inflating the accounts, including bank balances that did not exist; the US SEC fined the Indian arm of its auditor PricewaterhouseCoopers $6 million in 2011, and India's SEBI barred the firm from auditing listed companies for two years in 2018. Wirecard, a German payments company, said on 18 June 2020 that €1.9 billion had gone missing, two Philippine banks said the money had never been with them, and it filed for insolvency on 25 June; the criminal trial of its former chief executive opened in Munich in December 2022 and had not reached a verdict as of mid-2026. (Enron, the American case, is told in Accounting (34/50).)

The common thread is cash, the one asset an auditor can in principle verify from the outside. In each case the evidence the auditors relied on passed through channels the fraudsters could influence. That is why bank confirmations are now controlled by the auditor from request to reply. Critics ask whether auditors should bear more responsibility for finding fraud; the UK's Brydon review of 2019 urged clearer duties, while the profession has long answered that the standards promise reasonable assurance and that the stronger controls lie with boards. Both views are held by serious people.

What a graduate just sees

• An audit opinion is a calibrated statement of reasonable assurance, not a guarantee that no fraud exists.
• A mistake matters only if it could change a reader's decision, so materiality depends on who is reading and on the benchmark.
• Risk decides the work: high-risk areas get more testing, in proportion.
• A sample can find large, common errors easily and small, rare ones hardly at all.
• Evidence from outside the company, obtained directly, in original form, beats what management says.
• Fraud needs pressure, opportunity and a story the person tells themselves.
• Digit patterns flag; they do not prove. Always ask what would make the data legitimately odd.
• When money is missing, ask who controlled the evidence that said it existed.

Where it shows up next

• Financial Accounting & Reporting (36/45): every judgement the auditor tests, from revenue timing to impairment, is described there.
• Business Law & Ethics (34/55): independence rules, auditors' liability and the duties of directors.
• Financial Statement Analysis & Valuation (36/52): analysts use the same red flags (receivables outrunning sales, accruals) and add statistical screens.
• Probability & Statistics (34/05): sampling and the Benford test are applied statistics.
• In the world: the clean-opinion paragraph in an annual report, a bank's loan covenant that needs audited accounts, a charity's audit, and an internal auditor reviewing procurement.

If you want to go deeper

• 📘 Textbook. Alvin Arens, Randal Elder and others, Auditing and Assurance Services (Pearson, 18th Global Edition, 2024), the most widely assigned text; or Whittington and Pany, Principles of Auditing and Other Assurance Services (McGraw Hill). Check for the current edition.
• 📘 Gentler. Dan McCrum, Money Men (2022), the reporter's account of the Wirecard story; and Howard Schilit and Jeremy Perler, Financial Shenanigans (McGraw Hill), a catalogue of reporting tricks and their warning signs.
• 🌐 Free text. The IAASB's International Standards on Auditing at iaasb.org (ISA 200, 240, 320, 500, 530, 570) and the ACFE's free Occupational Fraud report at acfe.com/rttn.