Audit Risk Model

The model is often written as audit risk = inherent risk x control risk x detection risk. Inherent risk is the chance that a balance or disclosure is misstated before any controls are considered; complex estimates and unusual transactions score high. Control risk is the chance that the client’s own controls fail to prevent or catch such a misstatement. Together these two make up the risk of material misstatement, which the auditor assesses but cannot change. Detection risk is the chance that the auditor’s own procedures miss a material error, and this is the part the auditor controls. The auditor first decides how much overall audit risk is acceptable, then sets the amount, timing and reliability of testing so that detection risk fits. The formula is a way of thinking, not literal arithmetic. Planning meetings use it to decide where the team spends its hours.

An auditor of a manufacturer sees that inventory sits in many warehouses and depends on estimates for obsolete stock, so inherent risk is high. Controls over stock counts are weak, so control risk is high too. To keep detection risk low, the auditor attends the counts, tests a larger sample and checks valuation assumptions. Cash held at one bank, confirmed directly with the bank, needs far less testing.