Discussant's response to an analysis of the audit framework focusing on inherent risk and the role of statistical sampling in compliance testing;

              Discussant's Response to An Analysis of the Audit Framework Focusing on Inherent Risk and the Role of Statistical Sampling in Compliance Testing
William R. Kinney, Jr.
University of Michigan
Don Leslie has prepared a paper with many ideas that give rise to a number of implications for both the theory and practice of auditing and that merit careful thought, discussion, and debate. I agree with most of what he has to say but, of course, have some caveats, reservations, and qualifications.
The paper has nine sections, and I plan to comment on parts of all nine, concentrating on three central topics: the audit risk formula, assessment of the prior probability of material error, and the role of compliance tests. My closing comments will address some of the political aspects of Leslie's policy recommendations.
The Audit Risk Formula
Leslie is correct that the audit risk formula of SAP 54 and SAS 39 can understate the "final audit risk" (FAR)* relative to the approach suggested in Leslie, Teitlebaum, and Anderson (1979) and the CICA's Extent of Audit Testing (EAT). He is also correct that a reasonable interpretation of SAS 47 may lead to a formula that will always understate FAR relative to the EAT approach. Finally, he is correct that the difference between FAR calculated using SAS 39 and FAR using EAT is small when the prior probabiity of material error (PPE) is small.
Leslie implicity assumes that for the zero error population, every item in the population has zero error and any audit test will confirm this fact. I make a slightly less restrictive assumption that net error in the population is zero. Under the latter assumption, substantive tests of details (STD) may lead to incorrect rejection, and, of course, analytical review (AR) may lead to incorrect rejection even if every item has zero error. Under the zero net error assumption, the EAT formula understates FAR relative to a slightly more complete "Bayesian Risk Product" (BRP) calculation* because the EAT approach ignores the risk of incorrect rejection for both analytical review procedures and substantive tests of details.
* Since Leslie sometimes uses "final audit risk" and "posterior risk" interchangeably and since
posterior risk seems to be a misnomer as used here, I will use "final audit risk'' (FAR) throughout.
* I refer to this approach as the Bayesian risk product rather than Bayesian since it assumes that
decisions are made on the basis of the likelihood information and not the posterior that combines
the likelihood information with the prior distribution.
126