Audit Risk Model: Inherent, Control and Detection Risk

Audit risk is the risk that the auditor gives a clean opinion on financial statements that are materially misstated. The audit risk model shows how the auditor keeps that risk low by adjusting the amount of testing.

Audit risk = inherent risk × control risk × detection risk

The standards are AU-C 200, 315 and 330 for private companies, ISA 200, 315 and 330 (and their CAS equivalents), and AS 1101 for public companies.

The three parts

Part	What it means	Who controls it
Inherent risk	How likely an assertion is to be misstated before any controls, because of complexity, judgment, change or fraud risk	The entity's circumstances
Control risk	How likely the entity's controls are to miss or fail to correct a misstatement	The entity's controls
Detection risk	How likely the auditor's own procedures are to miss a misstatement	The auditor

Inherent risk and control risk together are the risk of material misstatement. The auditor assesses that risk but cannot change it. Detection risk is the only part the auditor sets, through the nature, timing and extent of substantive testing.

Working it backwards

The auditor picks an acceptable audit risk, assesses the risk of material misstatement, and solves for the detection risk that is left.

Detection risk = audit risk ÷ (inherent risk × control risk)

Example for revenue occurrence:

• Acceptable audit risk: 5%
• Inherent risk: high, say 100%, because revenue recognition is a presumed fraud risk
• Control risk: 50%, because the auditor tested controls over order approval and found them effective

Detection risk = 5% ÷ (100% × 50%) = 10%

A 10% detection risk means the substantive testing must be fairly strong. If controls had not been tested, control risk would be taken as 100%, detection risk would fall to 5%, and the auditor would need more substantive testing: larger samples, more work at year end instead of at an interim date, and more reliable evidence.

Most firms use levels such as low, moderate and high instead of percentages. The logic is the same.

What changed with SAS 145 and ISA 315 (Revised 2019)

For audits of periods ending on or after December 15, 2023, AU-C 315 (as revised by SAS 145) requires:

• Separate assessments of inherent risk and control risk. The combined assessment of the risk of material misstatement is no longer enough.
• A spectrum of inherent risk, judged with inherent risk factors: complexity, subjectivity, change, uncertainty, and susceptibility to misstatement from bias or fraud.
• Control risk at maximum unless the auditor plans to test the operating effectiveness of controls.
• More work on IT general controls and the IT environment.

ISA 315 (Revised 2019) made the same changes for periods beginning on or after December 15, 2021.

Significant risks

Risks at the top of the inherent risk spectrum are significant risks, and need procedures aimed at them specifically. Two are presumed on every audit: management override of controls and fraud in revenue recognition. See our guide to auditing revenue.

Where Warp Accounting fits

Warp Accounting runs the testing that controls detection risk: tests of details on samples the firm sizes from its risk assessment, and controls testing when the firm plans to rely on controls. Every result links to its source document. See test of details, controls testing and our guide to materiality.