Determining the overall risk assessment and developing the substantive audit program

For each significant financial statement account assertion, the inherent risk and control risk are assessed. The work performed around understanding the business provides the inherent risk assessment, while the results of any control testing provide the control risk

assessment. This risk of material misstatement determines the nature, timing, and extent of the substantive procedures to be performed; that is, the detection risk to be mitigated by auditors. The risk of material misstatement is determined using the following matrix: