Audit risk is the risk that the auditor gets the answer wrong. Every decision about how much testing to do follows from how large that risk is. This topic covers the risk-based approach, the audit risk model, its three components (inherent, control and detection risk), how they combine to set the amount of testing, and the risks within an assurance engagement.
Examiners ask you to define the components, to explain how the auditor uses the model in planning, and to spot inherent, control and detection risk in a scenario. In the November 2025 diet the model answer on fair value measurements was built on these three risks. Learn the definitions, and learn how to apply them to a set of facts.
In 30 seconds
Audit risk is the risk that the auditor reaches an inappropriate conclusion on the area under audit. The model is AR = IR × CR × DR. Inherent risk is the susceptibility of an item to misstatement because of its nature or the entity’s industry, before controls. It operates independently of controls and cannot be controlled.
Control risk is the risk that the client’s controls fail to prevent or detect a misstatement. The initial assumption is that it is very high, tests of controls may lower it, and it is never zero. Detection risk is the risk that the audit tests fail to detect a misstatement. It is the one the auditor controls, by doing more or less testing.
The auditor sets an acceptable audit risk, assesses inherent and control risk, then sets detection risk. When inherent risk × control risk is high, detection risk must be low, so testing and sample sizes increase. Audit risk is never eliminated. In an assurance engagement the firm also manages risk through identification, measurement, mitigation, reporting and monitoring, and governance.
The risk-based approach
A key feature of modern auditing is the risk-based approach. At planning, ISAs 300 and 315 require the auditor to identify and assess the main risks of the business. The auditor then designs and carries out responses to those assessed risks under International Standard on Auditing (ISA) 330. These include:
- overall responses, such as the choice of team and the attitude of scepticism; and
- audit procedures that respond to the risks of material misstatement at assertion level, which means a suitable mix of tests of controls and substantive procedures.
Whatever risks are assessed, the auditor must design and perform substantive procedures for each material class of transactions, account balance and disclosure. The auditor must also consider whether external confirmation procedures (ISA 505) should be used as substantive procedures. The risk-based approach then lets the auditor conclude whether the financial statements give a true and fair view.
The audit risk model
Audit risk is the risk that the auditor reaches an inappropriate conclusion on the area under audit. If audit risk is 5%, the auditor accepts a 5% chance that the item is misstated and a 95% chance that it is materially correct.
An audit gives a high level of assurance, but not an absolute level. The auditor therefore aims to reduce audit risk to an acceptable level and does not try to remove it. To manage risk, the auditor needs to measure the risk in a given situation and set a maximum acceptable limit. That need led to the audit risk model.
Audit risk = Inherent risk × Control risk × Detection risk
AR = IR × CR × DR
Risks are expressed as proportions, so a risk of 10% is entered in the formula as 0.10. IR × CR is the risk that the financial statements are misstated. That part is outside the auditor’s control. Detection risk is the part the auditor controls.
Inherent risk
Inherent risk is the risk that items may be misstated because of their own characteristics. It comes from either:
- the nature of the items. For example, estimates are inherently risky because their measurement depends on judgement and not a precise measure; or
- the nature of the entity and its industry. For example, a construction company works in a volatile, high-risk environment, so its figures are more likely to be misstated than those of a food and drink manufacturer.
When inherent risk is high, there is a high risk that an item is misstated. Inherent risk operates independently of controls, so it cannot be controlled. The auditor must accept that it exists and will not go away.
Assessing inherent risk
The assessment rests mainly on knowledge gained in previous audits and on the current environment in which the entity operates. It is normally made at two levels.
| Level | What the auditor considers |
|---|---|
| Financial statement level | The integrity, skills and abilities of management; the nature of the business; industry-wide and macroeconomic factors |
| Account balance and transaction level | The degree of subjectivity in the balance or transaction; the complexity of a transaction and how it is processed; the characteristics of the client’s assets and the risk that they may be misappropriated |
Example. The chief executive of a client is also its majority shareholder and plans to sell some shares soon after the financial statements are issued. There is an inherent risk at the financial statement level, because he has a personal interest in favourable reported profit and net assets and may have window-dressed the draft statements.
Background: The revised ISA 315 (2019) lists inherent risk factors: complexity, subjectivity, change, uncertainty, and susceptibility to misstatement from management bias or other fraud risk factors. It describes a spectrum of inherent risk, and a significant risk is one near the upper end of the spectrum that needs special audit consideration.
ISA 240 treats management override of controls as a significant risk, and presumes a fraud risk in revenue recognition unless the auditor rebuts it.
Control risk
Control risk is the risk that a misstatement would not be prevented or detected by the client’s internal control system. In preparing the audit plan, the auditor assesses control risk for different areas. Evidence comes from tests of controls on each major transaction cycle.
- The starting assumption is that control risk is very high and that existing controls are not enough to prevent material misstatement.
- Tests of controls may give enough evidence to justify a lower assessment for planning.
- Control risk is unlikely to be zero, because every control system has inherent limits.
The design and operation of controls is management’s responsibility. Management may introduce better controls, perhaps on the auditor’s recommendation, but that lowers control risk in future audits. It does not lower control risk for the period already under audit.
Detection risk
Detection risk is the risk that the audit procedures fail to detect a misstatement in a transaction or balance. If detection risk is 10%, there is a 10% chance that the audit tests will miss a material misstatement. It can be lowered by carrying out more tests. To reduce it from 10% to 5%, the auditor does more work.
In planning, the auditor usually:
- sets an overall level of audit risk judged acceptable for the audit;
- assesses inherent risk and control risk; and
- adjusts detection risk to reach the overall level required.
Background: The syllabus (competency C1(d)) names two parts of detection risk. Sampling risk is the risk that a conclusion drawn from a sample differs from the conclusion that testing the whole population would give. Non-sampling risk is the risk of reaching a wrong conclusion for any other reason, such as choosing an inappropriate procedure, misreading evidence or failing to recognise a misstatement.
| Risk | What it is | Who can change it |
|---|---|---|
| Inherent | Susceptibility of an item to misstatement before controls | Nobody in the audit. It comes from the item or the industry and is accepted and assessed |
| Control | Controls fail to prevent or detect a misstatement | Management, by better controls, but only for later periods |
| Detection | Audit tests fail to detect a misstatement | The auditor, through the amount and quality of testing |
Putting the model to work
The model can be rearranged to find the detection risk the auditor can accept:
DR = AR ÷ (IR × CR)
The table shows the effect, with a target audit risk of 5% (0.05). The percentages are for illustration.
| Inherent risk | Control risk | IR × CR | Detection risk allowed | Testing needed |
|---|---|---|---|---|
| 100% | 100% | 1.00 | 5% | Very extensive |
| 100% | 50% | 0.50 | 10% | Extensive |
| 50% | 50% | 0.25 | 20% | Moderate |
| 40% | 25% | 0.10 | 50% | Limited |
The summary of the approach is:
| IR × CR high | IR × CR low | |
|---|---|---|
| Detection risk the auditor can accept | Low | High |
| Amount of testing | High: extended testing | Lower |
| Sample sizes | Larger | Smaller |
In practice firms often use words such as high, medium and low rather than percentages. The logic is the same.
Business risk, financial statement risk and audit risk
Business risk is a risk management must deal with. Audit risk is a risk the auditor faces: that of giving an inappropriate opinion when the financial statements are materially wrong. The links run in a chain. Business risk can lead to financial statement risk, and financial statement risk drives audit risk. The auditor therefore assesses financial statement risks as a step towards assessing audit risk.
Most audit risks in a case turn out to be financial statement risks. Typical ones are overstated revenue (for example, when revenue is recognised before the performance obligation is met), overstated current assets such as receivables and inventory, overstated non-current assets where impairment is missed, understated liabilities and provisions, understated operating expenses, and misstated accounting estimates. The next topic develops these links with cases.
Risk in an assurance engagement
Every engagement carries risk that can lead to loss, litigation or damage to the firm’s reputation. Risk changes over time and responds to new technology. The syllabus gives five components for managing the risk of an assurance engagement.
| Component | What it involves |
|---|---|
| Identification | Defining the likely risks for each engagement, such as regulatory, political, operational, legal or information technology (IT) risk. Some risks must be accepted and some are not important enough to avoid |
| Measurement | Gathering information on each risk and its probability, comparing it with standards, setting priorities, and assessing it qualitatively and quantitatively. Scenario analysis and stress testing may be used |
| Mitigation | Deciding how to remove or reduce the risk: declining the engagement if the risk is too high, using specialists, appointing an experienced quality reviewer and holding professional indemnity insurance |
| Reporting and monitoring | Regular reporting and review so that risk stays at an acceptable level, with proper records. Risk assessment is repeated, not fixed |
| Governance | Clear job descriptions and roles so that staff work in line with the risk framework, and prompt review so mistakes are corrected |
The rules in more depth
Why audit risk can never be zero
Audit evidence is persuasive and not conclusive. The auditor tests samples, relies on judgement and works within time and cost limits. That is why the assurance is reasonable and not absolute. A target of zero risk would need unlimited testing and could never be reached.
Why detection risk is the balancing figure
The auditor cannot change inherent risk and cannot change control risk for the current period. The only risk the auditor can alter is detection risk, through the amount and quality of work. So once the target audit risk is set and inherent and control risk are assessed, detection risk is what is left to adjust.
Why inherent risk is assessed before controls
Inherent risk is judged as if no controls existed. That keeps the question about the item separate from the question about the system. A balance such as an estimate may be high risk even with good controls, and a simple balance may be low risk even where controls are weak.
Why a recommendation does not help this year
Control risk reflects the controls that operated during the period. A control introduced after the period, or after the audit, cannot have prevented errors in that period. The auditor’s recommendations will still be useful in the next period.
Why estimates and fair values carry high inherent risk
An estimate cannot be measured exactly, so it depends on judgement, assumptions and models. Fair values measured with inputs that cannot be observed in a market are the clearest case, because a small change in one assumption can move the value by a material amount. Where an open market exists, inherent risk is much lower. Management bias adds to the risk.
Why using an expert can raise detection risk
An auditor who lacks the knowledge to check a valuation must rely on an expert. If the expert’s work is not properly directed and evaluated, errors in the valuation may go unnoticed, which raises detection risk. The auditor remains responsible for the opinion, so the expert’s competence and objectivity, and the quality of the work, must be assessed.
Risk of material misstatement
Background: ISA 200 describes audit risk as a function of the risks of material misstatement and detection risk. The risk of material misstatement is inherent risk and control risk taken together, and ISA 315 (Revised) allows the auditor to assess them separately or combined. The model in the syllabus is a clear way to reason about it.
Worked example: the audit risks in receivables
Scenario. Orji Trading Ltd has receivables of ₦480 million, 70% of which are owed by three customers in the oil services sector, which is in a downturn. Credit control is done by one clerk who also posts cash received. Management’s bonus depends on reported profit. The audit firm was appointed late and has four weeks to finish. Identify the inherent, control and detection risks.
- Inherent risk: high. The allowance for expected credit losses is a subjective estimate. The balance is concentrated in three customers in a weak sector. Management’s bonus gives an incentive to overstate profit by understating the allowance, which is a risk at financial statement level.
- Control risk: high. One clerk does credit control and also posts cash. There is no segregation of duties, so errors and misappropriation may not be prevented or detected. The auditor should assume control risk is very high and place no reliance on the controls.
- Detection risk: must be set low. With high inherent and control risk, the auditor needs extensive substantive evidence. Examples are confirmations to the three major customers, a review of the aged analysis, receipts after the year end and a review of the customers’ financial condition.
- The risk to detection. The late appointment and four-week timetable could cut the testing done. If time is cut, detection risk rises. The auditor should add staff or ask for more time, and not accept a higher detection risk.
Conclusion. The combined risk of material misstatement in receivables is high, so detection risk must be low and the testing extensive, with extra attention to the allowance for credit losses.
How to score full marks
- Define each risk in a sentence, then say whether the auditor can control it.
- Write the formula and explain what happens when IR × CR is high and when it is low.
- In a scenario, label the risk and quote the fact that proves it. “One clerk posts cash and does credit control: control risk high”.
- Link the risk to the work. High risk means low detection risk, more testing and larger samples.
- Keep inherent risk and business risk apart. Business risk belongs to the entity.
- Show the arithmetic if asked. DR = AR ÷ (IR × CR).
- Time. Spend time in proportion to marks.
Common mistakes in the exam
- Saying that the auditor can reduce inherent risk.
- Saying that audit risk can be reduced to zero.
- Mixing up control risk, which is the client’s, with detection risk, which is the auditor’s.
- Saying that high inherent and control risk allow high detection risk. It is the reverse.
- Claiming that a management letter this year lowers control risk for this year.
- Listing business risks in a question about audit risks, without linking them to the financial statements.
- Forgetting that substantive procedures are needed for every material balance whatever the risk assessment.
Quick revision
- Audit risk: the risk of an inappropriate conclusion. AR = IR × CR × DR.
- Inherent risk: from the nature of the item or industry. Independent of controls. Cannot be controlled.
- Control risk: controls fail to prevent or detect. Assume very high at first. Never zero. Better controls help later periods.
- Detection risk: tests fail to detect. The auditor controls it by testing more or less.
- Planning: set acceptable audit risk, assess IR and CR, adjust DR. High IR × CR: low DR, more testing, larger samples.
- Risk-based approach: assess risks (ISAs 300 and 315), respond (ISA 330), always do substantive procedures on material areas.
- Assurance engagement risk: identification, measurement, mitigation, reporting and monitoring, governance.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. Audit risk is best described as the risk that:
- The client becomes insolvent
- The auditor reaches an inappropriate conclusion on the area under audit
- Fraud occurs in the client
- The client pays too much tax
Show the answer
B. It is the risk of a wrong conclusion about a balance or the statements.
Question 2. The audit risk model is:
- AR = IR + CR + DR
- AR = IR × CR × DR
- AR = IR − CR
- AR = DR ÷ IR
Show the answer
B. The three risks are multiplied.
Question 3. Which risk is under the control of the auditor?
- Inherent risk
- Control risk
- Detection risk
- Business risk
Show the answer
C. The auditor changes it by doing more or less testing.
Question 4. Inherent risk is:
- The risk that controls fail
- The susceptibility of an item to misstatement before considering controls
- The risk that tests miss an error
- The risk that a sample is unrepresentative
Show the answer
B. A is control risk, C is detection risk and D is sampling risk.
Question 5. Which of the following items has the highest inherent risk?
- A bank balance confirmed by the bank
- An estimate that depends on management judgement
- Share capital agreed to the register
- A fixed asset that is physically present and recently purchased
Show the answer
B. Estimates are subjective, so inherent risk is high.
Question 6. The initial assumption about control risk in planning is that it is:
- Zero
- Very high
- Low
- Not relevant
Show the answer
B. Tests of controls may justify a lower assessment.
Question 7. If inherent risk and control risk are both high, detection risk must be:
- High
- Low
- Ignored
- Increased
Show the answer
B. A low detection risk means more testing.
Question 8. Detection risk is lowered by:
- Fewer tests
- More tests and larger samples
- Relying on management’s assurances
- Avoiding sampling
Show the answer
B. More evidence lowers the chance of missing a misstatement.
Question 9. The auditor’s recommendations to improve controls will mainly affect control risk in:
- The current audit
- The next period’s audit
- Neither
- The previous audit
Show the answer
B. Control risk for the period audited reflects the controls that operated in it.
Question 10. Which of the following is a component of risk management in an assurance engagement?
- Risk mitigation
- Revenue recognition
- Inventory counting
- Materiality
Show the answer
A. The five are identification, measurement, mitigation, reporting and monitoring, and governance.
Written questions
Question 11 (10 marks). Define audit risk and explain its three components.
Question 12 (20 marks). (a) Explain how the auditor uses the audit risk model in planning an audit. (8 marks) (b) Explain the factors the auditor considers in assessing inherent risk at financial statement level and at account balance level. (6 marks) (c) Explain how detection risk is managed and its effect on audit testing. (6 marks)
Question 13 (10 marks). Tide Marine Ltd holds a portfolio of unquoted shares measured at fair value. The valuation is made by the finance team using an internal model with unobservable inputs, and nobody outside the team reviews it. The audit team has no valuation expertise. Explain the audit risks in the valuation, using inherent, control and detection risk. (10 marks)
Model answers
Show the model answer to Question 11
Audit risk (2 marks). The risk that the auditor reaches an inappropriate conclusion on the area under audit. It is expressed by the model AR = IR × CR × DR, and the auditor aims for an acceptable level, not zero. (2)
Inherent risk (3 marks). The risk that an item is misstated because of its own characteristics. (1) It comes from the nature of the item, such as an estimate, or from the entity and its industry. (1) It is independent of controls and cannot be controlled, only assessed. (1)
Control risk (3 marks). The risk that the client’s internal controls will not prevent or detect a misstatement. (1) It is assumed very high at first and can be lowered only by tests of controls, and it is never zero. (1) Management is responsible for improving controls, and better controls help future periods. (1)
Detection risk (2 marks). The risk that audit procedures fail to detect a misstatement. (1) The auditor controls it through the amount and quality of testing, so it is the figure the auditor adjusts. (1)
Show the model answer to Question 12
(a) Use of the model (8 marks).
- The model is AR = IR × CR × DR, and the auditor sets an acceptable level of audit risk for the audit. (1.5)
- The auditor assesses inherent risk and control risk from knowledge of the client, the environment and tests of controls. (1.5)
- The auditor then adjusts detection risk to reach the target.
(1.5) If IR × CR is high, detection risk must be low, which means extended testing and larger samples. (1.5) If IR × CR is low, detection risk can be higher, so less testing and smaller samples. (1.5) Audit risk is reduced to an acceptable level and never eliminated. (0.5)
(b) Inherent risk factors (6 marks). At financial statement level: the integrity, skills and abilities of management; the nature of the business; industry-wide and macroeconomic factors. (3, 1 each) At account balance and transaction level:
- the degree of subjectivity
- the complexity of the transaction and how it is processed
- the characteristics of the client’s assets and the risk of misappropriation
(3, 1 each)
(c) Detection risk (6 marks). Detection risk is the risk that audit tests fail to detect a misstatement. It can be lowered by doing more tests, for example reducing it from 10% to 5%. (2) The auditor sets an overall acceptable audit risk, assesses inherent and control risk and then adjusts detection risk.
(1.5) Inherent risk cannot be controlled, and the auditor’s recommendations on controls affect control risk only in the future, so detection risk is the lever. (1) A lower detection risk means more extensive testing, larger samples, and more reliable evidence in the nature, timing and extent of procedures. (1.5)
Show the model answer to Question 13
Inherent risk (4 marks). Fair value of unquoted shares is subjective and imprecise. (1) The internal model is complex and may be unreliable, since there is no open market for the shares. (1) With unobservable inputs, small changes in assumptions such as future earnings and discount rates can produce a material difference in value. (1) The finance team may be biased towards a favourable value. (1)
Control risk (3 marks). The valuation is made outside normal routine operations. (1) Nobody outside the finance team reviews it, so controls over the valuation process are likely to be weak. (1) The entity’s systems may therefore fail to prevent or detect valuation errors. (1)
Detection risk (3 marks). The auditor should keep detection risk low, but lacks the expertise to verify the model. (1) Using an expert is necessary, which adds the risk that errors are not found if the expert is not properly directed. (1) The auditor should test the data and assumptions, compare them with market evidence, run sensitivity analysis and use an independent valuer. (1)
Pathfinder on audit risk and the audit risk model
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
For a company holding derivatives and carbon credit contracts valued with internal, unobservable inputs, you set out the risks the auditor must recognise in auditing fair value measurements. The model answer is built on inherent, control and detection risk, which this topic explains. The full audit of estimates is in the topic on ISA 540.
Revise first: The audit risk model
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
