The Audit Risk Model, Business Risk and Audit-Planning Decisions

Author(s): Richard W. Houston, Michael F. Peters and Jamie H. Pratt

Source: The Accounting Review, Vol. 74, No. 3 (Jul., 1999), pp. 281-298

Published by: American Accounting Association

Stable URL: http://www.jstor.org/stable/248489 .

Accessed: 08/05/2014 20:40

The Audit Risk Model, Business Risk and Audit-Planning Decisions

Richard W. Houston, University of Alabama, Michael F. Peters, University of Maryland, Jamie H. Pratt

Indiana University

ABSTRACT: This study identifies conditions under which the audit risk model does, and does not,
describe audit-planning (investment and pricing) decisions. In an experiment, audit partners and
managers examined one of two cases where a material misstatement-error or irregularity-was
discovered. The auditors assessed the elements of the audit risk model, assessed business risk and
provided recommendations for the audit investment and fee. When the likelihood of an error was high,
the audit risk model dominated business risk in the explanation of the audit investment, and the fee did
not contain a risk premium. When the likelihood of an irregularitywas high, business risk dominated the
audit risk model in the explanation of the audit investment, and the fee contained a risk premium. These
results suggest that the ability of the audit risk model to describe auditor behavior and the inclination of
auditors to charge a risk premium depend upon the nature of the risks present in the audit. In the
presence of errors, the audit risk model adequately described audit-planning decisions; in the presence
of irregularities it did not.

Key Words: Audit risk model, Business risk, Audit fees, Audit evidence.

Data Availability: Contact the authors.

I. INTRODUCTION

Auditors have been shown to adjust the elements of the audit risk model (ARM) and increase the audit
investment in response to increasing risk that client financial statements contain material misstatements
(e.g., Joyce 1976; Gaumnitz et al. 1982;

Kaplan 1985; Libby et al. 1985; O'Keefe et al. 1994). There is also evidence that auditors respond to
business risk-the risk of loss or injury to an auditor's professional practice due to client relationships-by
increasing the investment in the audit and/or charging fees above the amounts required to cover the
costs of conducting audits (e.g., Pratt and Stice 1994;
Walo 1995). While this research suggests that auditors react to both audit and business risk, it does not
identify the conditions under which audit decisions reflect business risks not captured by the ARM. In
such cases, the ARM, a standard of professional audit practice, fails to describe audit behavior.

The ARM primarily addresses the risks associated with issuing unqualified audit opinions on client
financial statements that contain material misstatements. Business risk, on the other hand, is present
even when auditors comply with generally accepted auditing standards (GAAS) and render appropriate
audit opinions. The primary costs associated with business risk relate to litigation, whether the exposure
leads to auditors being held liable for client stakeholder losses. Other costs relate to sanctions imposed
by regulatory bodies, impaired reputation and failure to collect fees. Business risk encompasses more
than the risks associated with issuing unqualified opinions on materially misstated financial statements.
A client with a weak internal control system experiencing financial difficulty, for example, introduces
two kinds of risks: the risk of a material misstatement and the risk of financial failure. The ARM reflects
only the first; business risk encompasses both.

The ARM has been designed to serve as a guide for audit planning (Cushing et al. 1995; AICPA 1997a).
Sometimes the guidance provided by the ARM is clouded when business risk is brought into
juxtaposition with the risk captured by the ARM. Arens and Loebbecke (1997, 259) suggest that there is
disagreement about whether auditors should, or should not, adjust acceptable audit risk for differences
in business risk. They report that some auditors believe that acceptable audit risk should be lower for
clients that present high levels of business risk, while others do not. We contend that differences in the
nature of the underlying circumstances that give rise to business and audit risk will lead to different
responses by auditors. In some cases, auditors will adjust their audit plans for the underlying
circumstances in ways completely captured by the ARM, but in other cases auditor re- sponses will not
be captured by the ARM. In the former cases, the ARM will describe auditor behavior; in the latter cases
it will not.

Auditors are responsible for providing reasonable assurance that financial statements are free of
material misstatements. Misstatements, however, can arise from either of two sources-errors
(unintentional misstatements) and irregularities (intentional misstatements)-and, as we argue below,
the ability of the ARM to describe audit behavior appears to depend upon the source. We monitor two
aspects of auditor responses to audit and business risk-the amount of investment planned for the audit
and the extent to which the audit fee contains a premium to compensate auditors for bearing risk.

We hypothesize that the variance in the audit investment explained by business risk, over and above
that explained by elements of the ARM, is greater when the risk stems from irregularities rather than
from errors. When the audit involves a risk of undetected irregularities, the ARM fails to capture
dimensions of business risk that auditors consider when planning the audit investment. When the risk of
undetected errors is high, on the other hand, relevant dimensions of business risk are reflected in the
ARM.

We also predict that audit fees contain (do not contain) a risk premium when the risk of irregularities
(errors) is high. When the risk of irregularities is high, standard audit procedures cannot reduce the risks
to tolerable levels, so a premium is added to the fee. Conversely, when the risk of errors is high,
standard audit procedures are sufficient to reduce risks to tolerable levels, and auditors will not perceive
a need for a risk premium.

We tested these hypotheses in an experiment using, as subjects, 34 audit partners and managers from
four Big 5 accounting firms. Each considered one of two high-risk cases where a material misstatement
was revealed while conducting preliminary analyses and inquiries of a prospective client's accounting
personnel. The two cases described the discovery of either an error or irregularity, thereby suggesting
that the risk of other, undetected errors or irregularities was high. Auditors assessed the elements of the
ARM and business risk and made recommendations for the audit investment and fee both before and
after discovering the misstatement.

The results support the hypotheses, suggesting that both the ability of the ARM to describe planned
audit investments and auditor inclinations to include risk premiums in audit fees depend upon the
nature of the risks present in the audit. In the error condition, the ARM explained significant variance in
the audit investment and business risk added no additional explanatory power; in the irregularity
condition, business risk dominated the ARM in the explanation of the audit investment. Further, the
audit fee did not contain a risk premium in the error condition-the fee reflected only the costs of the
audit investment; in the irregularity condition, auditors proposed a fee that exceeded the amount
needed to cover the planned audit investment.

These results question whether current audit standards are providing useful guidance in the presence of
irregularities (see Shibano [1990] for a related argument). An important purpose of professional
standards, like the ARM, is to promote consistency across audit engagements (Cushing et al. 1995), but
in the case of irregularities where auditors appear to depart from the ARM, it is unlikely that the
standard is helping to achieve that goal. The results also are consistent with Menon and Williams (1994),
who state that it is important that audit fees reflect the insurance service auditors provide for their
clients especially risky clients. Audit fees appear to include risk premiums when the risk of irregularities
is high.

Prior research examining relationships among audit risks, investment and fees has used both behavioral
and archival methods. Several behavioral studies, for example, have found relationships between
inherent and/or control risk and audit investment (e.g., Joyce 1976; Gaumnitz et al. 1982; Libby et al.
1985). More recently, Pratt and Stice (1994) related client characteristics to audit investment and
provided evidence of risk premiums in the presence of business risk. However, the authors neither
measured the elements of the ARM nor identified contextual factors that cause risk premiums.

Prior archival research generally has failed to find relationships between inherent and/ or control risk
and audit investment (e.g., Bedard 1989; Mock and Wright 1993; O'Keefe et al. 1994; Hackenbrack and
Knechel 1997). Such relationships may be difficult to identify in archival settings because direct and
timely measures of risk are not readily available. This limitation forces archival researchers to infer risk
assessments from the data and/or elicit them after completion of the audit-in some cases from auditors
who did not make the actual audit-planning judgments. In addition, archival studies must rely upon
relatively crude proxies for inherent and control risk (e.g., categorical variables coded as 0, 1) that are
unlikely to reflect the level of risks in specific audit contexts. Finally, while archival studies have shown
that audit fees increase in the presence of factors associated with business risk, they have been unable
to determine whether the fee increases are attributable to greater audit investments or risk premiums
(Simunic and Stein 1996).

Our experimental approach elicits direct measures of audit risk, business risk, and planned audit
investment and fees, holding constant factors such as client attributes, industry, auditor background and
the audit environment. We also manipulate the nature of the event underlying the risk-discovery of an
error or irregularity-enabling us to examine whether the relationships among audit risk, business risk
and audit investment depend upon whether the business risks arise from potential undetected material
errors or irregularities. In addition, we test the extent to which audit fees are explained by the audit
investment and/or business risk for errors and irregularities, in order to examine the conditions under
which fees contain risk premiums rather than extra compensation for additional audit effort.

The next section contains a description of the audit risk and audit-planning models, followed by the
development of the hypotheses. We then describe the experimental design and present the results.
Conclusions and suggestions for future research complete the paper.

II. THEORY AND HYPOTHESES

In this section, we use the ARM and an audit-planning model to provide a framework for developing the
hypotheses. We predict differences between errors and irregularities in terms of whether (1) business
risk provides explanatory power for the audit investment beyond the elements of the ARM; and (2) the
audit fee contains a risk premium.

Audit Risk Model and the Explanation of Audit Investment

SAS No. 47 requires auditors to use the ARM as part of the audit planning process (AICPA 1997a). The
following presentation of the ARM, including variable definitions, is adapted from SAS No. 47:

Detection Risk = Acceptable Audit Risk (1)

Inherent Risk X Control Risk

where:

Acceptable audit risk (AAR) is the probability that auditors are willing to accept that they will render
unqualified opinions on materially misstated financial statements. AAR is set by the auditor.

Inherent risk (IR) is the probability that an account balance or class of transactions contains a material
misstatement before considering the effectiveness of the internal control system. IR is assessed by the
auditor.

Control risk (CR) is the probability that a material misstatement is not prevented or detected on a timely
basis by the internal control system. CR is assessed by the auditor.
Detection risk (DR) is the tolerable level of risk that auditing procedures will not detect material
misstatements.

Materiality is the magnitude of an omission or misstatement of accounting information that, in light of

According to the ARM, auditors set materiality and choose AAR; IR and CR are then assessed, which
leads to a tolerable level of DR. Investments in auditing decrease DR, and the planned level of audit
investment reflects that point where a tolerable level of DR is achieved.

Audit-Planning Model and the Explanation of Audit Fees

Simunic (1980) developed a model to explain audit fees, later used by Pratt and Stice (1994) as a basis
for examining audit-planning decisions. We modify this model as follows to represent the expected costs
of auditing:

E(c) = cq + [E(d) X E(r)] + [E(f) x E(p)] (2)

where:

E(c) = total expected cost.

c = the per unit factor cost of external auditor resources to the auditor, including all opportunity costs.

q = the quantity of resources utilized by the auditor in performing the audit examination.

E(d) = expected present value of possible future losses incurred by client stakeholders that are
associated with undetected material misstatements in this period's financial statements.

E(r) = expected likelihood that the auditor will be held responsible for client stakeholder losses
associated with undetected material misstatements in this period's financial statements.

E(f) = expected present value of possible future losses caused by being identified with this period's
financial statements due to factors other than undetected material misstatements.

E(p) = expected likelihood that the auditor will suffer losses as a result of being identified with this
period's financial statements because of factors other than undetected material misstatements.

In the planning model, [E(d) X E(r)] and [E(f) x E(p)] represent the expected costs of business risk; [E(d) X
E(r)] represents costs associated with undetected material misstatements and [E(f) X E(p)] represents
costs associated with factors other than undetected material misstatements (e.g., reputation losses
caused by association with clients of questionable integrity). According to the model, audits are planned
in the following way: (1) assess the level of business risk and (2) invest in auditing, q, to the point where
the marginal reduction in the costs of business risk from an additional unit of auditing is equal to the
marginal cost of that unit of auditing. In equilibrium, audit fees are set to cover the total expected costs
of auditing, which include a normal profit.'

The ARM and Business Risk

The ARM is designed to help auditors manage risks associated with issuing unqualified opinions on
financial statements that contain undetected material misstatements. Consequently, the elements of
the ARM can be adjusted, and the audit investment increased, to reflect that portion of business risk
associated with [E(d) X E(r)] (Brumfield et al. 1983; Messier 1997; Arens and Loebbecke 1997). Changes
in audit investments attributable to changes in AAR, IR, CR and/or materiality are consistent with both
the ARM and changes in business risk associated with [E(d) X E(r)]. In other words, many factors that
relate to the likelihood of material misstatements similarly affect business risk. Examples include high
levels of accounts receivable and inventory, and excessive sales growth (Stice 1991).

Business risk encompasses an additional factor, [E(f) x E(p)], that is not associated with the risk of
undetected material misstatements and thus is not explicitly reflected in the ARM. Poor financial
condition and high stock price variability, for example, have been shown to introduce dimensions of
business risk that are independent of the risk of undetected material misstatements (Brumfield et al.
1983; Stice 1991). In the presence of these factors, audit standards provide limited guidance. SAS No. 47
(AICPA 1997a) states only that, in the presence of low business risk, auditors should not reduce the audit
investment below that implied by the ARM. This ambiguity may explain why audit firms set relatively
rigid guidelines in the implementation of the ARM, perhaps in an attempt to achieve consistency across
audits. Studies have shown, for example, that audit firms have policies that set AAR at predetermined
levels (Jiambalvo and Waller 1984; Daniel 1988; Knechel 1998; Ricchiute 1998), whether AAR is set
qualitatively (e.g., "low") or quantitatively (e.g., 5 percent).2

Hypothesis I

The discovery of an irregularity raises serious questions about management and casts doubt on the
integrity of the financial statements. In addition, auditors may suffer damaging reputation effects or be
sued (perhaps without merit) as a result of involvement with unscrupulous clients, whose financial
statements are later found to contain undetected immaterial misstatements, or who experience
business failure.3 Consequently, irregularities introduce high levels of business risk that are comprised
of two components: (1) high risk of undetected material misstatements [E(d) X E(r)] and (2) high
potential costs unrelated to undetected material misstatements [E(f) X E(p)]. The ARM does not reflect
the second component, so we predict that in the presence of irregularities, business risk will have
incremental explanatory power over the components of the ARM in the explanation of planned audit
investments. Errors, on the other hand, introduce levels of business risk comprised only of the first
component, [E(d) x E(r)]. This component is associated with the risk of a material error and is within the
scope of the ARM. Thus, in the presence of errors, we predict that business risk will have no incremental
explanatory power over the components of the ARM in the explanation of planned audit investments.

H1: The incremental effect of business risk-over and above that of audit risk-on planned audit
investment is greater when the risk of irregularities is high than when the risk of errors is high.
Hypothesis 2

Errors and irregularities also differ in terms of whether audit fees contain risk premiums. When the risk
of irregularities is high, normal audit procedures may not be able to control business risk sufficiently.
Irregularities are more difficult to detect than errors (Shibano 1990; Graham 1985)4 and they raise
additional issues (discussed in the development of HI) about the client that cannot be controlled by
gathering additional audit evidence. In other words, neither [E(d) X E(r)] nor [E(f) x E(p)] can be reduced
to acceptable levels by applying normal audit procedures. Consequently, auditors will add a risk
premium to the audit fee to compensate them for bearing the uncontrolled business risk.

When the risk of errors is high, the proposed audit fee should reflect only the level of audit investment.
In this case, [E(f) x E(p)] is negligible and the risks associated with [E(d)

2 We spoke to representatives from each of the four Big 5 firms that provided subjects about their
policies for setting AAR. While firm policies require auditors to consider factors that theoretically could
affect AAR, firm policies do not allow AAR to vary. Consistent with these policies, we report later that
auditors in this study did not decrease AAR after the discovery of an error or irregularity.

I Because juries often hold auditors to tighter standards than those described in professional audit
standards, stakeholders may be motivated to file lawsuits against auditors even in the absence of
undetected material misstatements.

4 Similarly, auditors simply may not know how to change audit programs to detect irregularities (e.g.,
see Hoffman 1997).

x E(r)] can be controlled by applying normal audit procedures. In terms of the audit planning model,
audit fees will reflect only the costs of the audit investment (i.e., cq) and not include a risk premium.

H2: The incremental effect of business risk-over and above that of audit investment-on audit fees is
greater when the risk of irregularities is high than when the risk of errors is high.

III. RESEARCH DESIGN

Subjects and Case Distribution

Audit cases describing one of two high-risk conditions involving the discovery of material misstatements
were distributed to 34 audit partners and managers from four Big 5 accounting firms (17 subjects- 14
managers and three partners-for each of the two conditions).5 Cases were randomly distributed by a
contact person within each firm and returned directly to the researchers in stamped, self-addressed
envelopes. Although contact people were asked to return undistributed cases so that we could
determine the response rate, some did not. However, 60 percent of the distributed cases were
completed.

The Case
Each subject analyzed one case, consisting of four parts; parts 1, 2 and 4 were the same across both
conditions. Part 1 contained a preliminary analysis of a potential new client, summarizing the client's
management, operations, financial statements, ratios and industry comparisons. Part 2 asked subjects
to assess the elements of the ARM, to assess business risk and to recommend an audit investment and
audit fee. In part 3, a short paragraph describing the information unique to each condition was
introduced. This paragraph indicated the subsequent discovery of a material misstatement-condition 1
described the discovery of an error (an unintentional inventory misstatement) and condition 2 described
the discovery of an irregularity (an intentional inventory misstatement) during preliminary analyses and
inquiries of the client's accounting personnel. In the irregularity condition, management knew that the
inventory accounting method was inconsistent with GAAP, but chose it anyway-openly communicating
the choice throughout the company. The discovery of the error (irregularity) was intended to convey an
increased risk that other, undetected errors (irregularities) exist. See table 1 for the exact wording of
each condition. In part 4, the subjects were asked to answer the same questions as in part 2. We
extensively pilot tested the case with several Big 5 audit partners and managers, some of whom were
involved in developing risk assessment policies for their firms.

Measures of the ARM, Business Risk and Audit Planning

Measures of the ARM included assessments of materiality, AAR, IR and CR. All risk measures were
defined in words, rather than in percentages, because Big 5 firms typically

I Nonparametric Mann-Whitney U-tests confirmed that manager and partner responses did not differ
within each of the experimental conditions. In addition, subjects indicated whether the case information
represented the important factors that they consider in actual audits (1 = Agree strongly to 11 =
Disagree strongly). The mean response was 3.4 (s.d. = 1.16; 33 of 34 subjects responded 4 or less),
suggesting that the case fairly represented the information that auditors consider during audit planning.

6 Although accounting methods inconsistent with GAAP are acceptable under certain circumstances
(e.g., when the financial statements would be misleading if GAAP were followed), nothing in the case
materials suggested that the purpose of the departure from GAAP in the irregularity condition was to
improve the quality of the financial statements.

TABLE 1

Description of the Two Conditions

Scenario 1: Error

In a new development, preliminary analyses and inquiries of the Corporation's accounting personnel
revealed an accounting treatment, instituted near the beginning of the current fiscal year, that is
inconsistent with GAAP. Further inquiry and two internal memos verify that the treatment was
unintentional and resulted from a miscommunication within the controller's office that was passed
along to regional accounting departments. Competent audit staff concluded that it is highly unlikely that
management was aware of this error. Nevertheless, the error affects all of the different segments of the
Corporation's geographically dispersed inventory. As a result, inventory and net income are likely to be
significantly overstated.

Scenario 2: Irregularity