Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Materiality and Evaluating Findings
What “material” means
Material simply means important enough to matter. If knowing about something would change what the board, management or a regulator decides, it’s material.
In a financial audit, that’s often a money figure, such as 5% of profit. In an IS audit, a control weakness rarely comes with a price tag. So the auditor asks a different question: what could this weakness lead to?
Same weakness, different importance
Missing activity logging on an internal staff wiki is a minor issue. The same gap on the system that releases supplier payments is serious, because fraud could happen there and nobody would see it.
What the auditor weighs up
- Criticality of the system and the business process it supports
- Value and volume of transactions flowing through it
- Sensitivity of the data: personal, financial, health, regulated
- Possible consequences: fraud, misstatement, regulatory fines, outages, harm to customers
- Pervasiveness: one application, or the whole environment
- Compensating controls that reduce the real exposure
- Nature: anything involving fraud, illegal acts or deliberate override is significant whatever the amount
Where materiality is used
| Stage | Effect |
|---|---|
| Planning | Which systems and controls are in scope, and where to focus |
| Testing | How much to test; lower materiality means more testing |
| Evaluating | Whether errors or weaknesses found are significant |
| Reporting | What goes in the formal report, and how prominently |
Evaluating findings
- Check the facts with the auditee, so the finding is accurate.
- Assess the risk: how likely, how damaging, and whether other controls reduce it.
- Add them up: small issues affecting the same control objective can together be significant.
- Rate each finding on a consistent scale, such as high, medium and low.
- Decide what goes in the formal report and what is passed to management informally.
Example. In an ERP review the auditor finds: two people who left still have active accounts; one quarterly access review was skipped; and five users can both create and approve suppliers. Each could be rated medium on its own. Together they mean nobody is reliably controlling who can create and pay suppliers. That’s a high-risk finding.
Writing a finding
A clear finding answers five questions:
- Criteria: what should happen (policy, standard, law)
- Condition: what actually happens
- Cause: why there’s a gap
- Effect: what could go wrong, and how badly
- Recommendation: what should change, aimed at the cause rather than the symptom
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| How materiality is judged in an IS audit | Mainly qualitatively: criticality, sensitivity, potential impact |
| Several minor weaknesses were found | Consider their combined effect before reporting |
| A weakness that hasn’t caused a loss yet | Judge it by potential impact; it may still be material |
| An immaterial finding | Communicate it to management, usually informally |
| Effect of a lower materiality threshold | More testing |
In short
- Something is material if it could change the decisions of the people relying on the audit, because of its size or its nature.
- In IS audits, materiality is mostly qualitative: how critical the system is, how sensitive the data is, and what the weakness could lead to.
- A weakness can be material even if no loss has happened yet, if it could allow a significant loss.
- Several small findings can be material together, so the auditor looks at their combined effect.
- Findings are rated by risk: the likelihood and impact of what the weakness could allow.
- A good finding states the criteria, condition, cause, effect and a recommendation that addresses the cause.
Exam traps
- No loss so far doesn't make a weakness immaterial. Judge the potential impact.
- Several small weaknesses affecting the same control objective may together be significant.
- Immaterial findings are still communicated to management, usually informally.
- IS materiality isn't just a money threshold.
- Anything involving fraud or deliberate override is significant regardless of the amount.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Same weakness, different importance
Writing a finding
1 / 9