How do auditors use their knowledge about the risk of material misstatement, including their knowledge of the design effectiveness of controls, in developing an audit approach? Comment on extensiveness of testing, types of audit procedures, and the rigor of audit procedures in higher- versus lower-risk settings.