Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Inherent, Control, Detection, and Audit Risk
The big idea
No auditor checks everything. They look at samples, they have limited time, and they rely partly on the company’s own controls. So there’s always a chance that the auditor says “everything is fine” when there’s actually a significant problem hiding somewhere.
That chance is called audit risk. The auditor can’t make it zero, but they can keep it acceptably low, and the audit risk model explains how.
Think of it like a fishing trip in reverse. Errors are fish swimming towards the financial statements. The company has a net (its controls). The auditor has a second net (their tests). Audit risk is the fish that swims through both.
The three ingredients
1. Inherent risk: how easy is it to get wrong?
Inherent risk is the chance of a significant error happening if there were no controls at all. It’s about the nature of the thing itself.
Some areas are naturally riskier:
- complex calculations (interest, tax, insurance premiums)
- cash and payments, because they’re easy to steal or redirect
- high volumes processed automatically, where one bug repeats thousands of times
- estimates and judgement, where there’s no single right answer
- new systems, where nobody yet knows what can go wrong
Simple example. Paying 50 staff the same monthly salary has low inherent risk. Calculating commission for 500 sales people using tiered rates, bonuses and clawbacks has high inherent risk. Same department, very different chance of mistakes.
IS environments often have high inherent risk because systems process huge volumes automatically. A small error in the code gets repeated on every transaction.
2. Control risk: will the company’s net catch it?
Companies put controls in place to prevent or catch errors: approvals, reconciliations, system edit checks, segregation of duties. Control risk is the chance that these controls fail to stop or catch a significant error in time.
- If controls are missing, badly designed, or not actually followed, control risk is high.
- If controls are well designed and the auditor’s testing shows they work, control risk is low.
Simple example. Payments over 10,000 need a second person to approve them in the banking system. The auditor tests 25 payments and every one was approved by someone else: control risk is low. If anyone can release any payment alone, control risk is high.
3. Detection risk: will the auditor’s net catch it?
Detection risk is the chance that the auditor’s own tests miss an error that got past the company’s controls.
This is the one the auditor controls. They lower it by:
- testing more (bigger samples, or the whole population with data analytics)
- testing better (stronger evidence, such as re-performing a calculation rather than asking someone)
- testing later (closer to year end, so less can go wrong afterwards)
Detection risk has two parts:
| Part | What goes wrong | How to reduce it |
|---|---|---|
| Sampling risk | The sample happened to miss the bad items | Bigger samples, statistical sampling |
| Non-sampling risk | The auditor chose the wrong test, or misread what they saw | Good planning, training, supervision and review |
A bigger sample doesn’t fix non-sampling risk. If you’re looking at the wrong thing, looking at more of it doesn’t help.
Putting it together
The three multiply:
Audit risk = inherent risk × control risk × detection risk
The auditor decides how much audit risk is acceptable (usually low). Inherent risk and control risk are facts about the company. So the auditor works backwards and asks: how good does my net need to be?
| Inherent risk | Control risk | Detection risk the auditor can accept | Amount of substantive testing |
|---|---|---|---|
| High | High | Low | A lot |
| High | Low | Medium | Moderate |
| Low | High | Medium | Moderate |
| Low | Low | High | Limited |
Worked example. A payment system moves millions every day (high inherent risk). The auditor finds that anyone in finance can change a supplier’s bank details without approval (high control risk). The auditor can’t accept much detection risk, so instead of testing 25 changes, they use data analytics to examine every bank detail change made in the year.
How materiality fits in
Materiality is the size of error that would matter to someone relying on the audit. The two ideas work together: if a smaller error matters (lower materiality), the auditor needs a finer net, which means lower detection risk and more testing.
How the exam asks about it
| If the question says… | The answer is usually… |
|---|---|
| Which risk can the auditor control or influence? | Detection risk |
| Which risk is assessed without considering controls? | Inherent risk |
| The risk that controls won’t prevent or detect an error | Control risk |
| Inherent and control risk are both high: what happens? | Detection risk is set low, so more substantive testing |
| The auditor misinterpreted evidence and missed an error | Non-sampling risk (part of detection risk) |
| Why IS environments often have high inherent risk | Automated, high-volume processing repeats any error many times |
In short
- Audit risk is the risk that the auditor reaches the wrong conclusion, usually saying things are fine when there's a significant problem.
- Inherent risk is how likely errors are in the first place, before any controls. Think: how easy is it to get this wrong?
- Control risk is the chance that the company's own controls fail to stop or catch an error.
- Detection risk is the chance that the auditor's own tests miss an error that got past the controls.
- Audit risk = inherent risk × control risk × detection risk.
- The auditor can't change inherent or control risk, only measure them. The one thing the auditor controls is detection risk: how much, how well and when they test.
- High inherent and control risk mean the auditor must lower detection risk, which means more and better testing.
- Detection risk includes sampling risk (an unlucky sample) and non-sampling risk (the auditor's own mistakes).
Exam traps
- The auditor ASSESSES inherent and control risk but SETS detection risk. 'Which risk can the auditor control?' → detection risk.
- Inherent risk is judged as if there were no controls at all.
- Weak controls mean MORE substantive testing, not less.
- Choosing the wrong test or misreading evidence is non-sampling risk. A bigger sample won't fix it; training and supervision will.
- Business risk (the company failing to meet its goals) is not one of the audit risk components.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Three nets, one leak
Picture errors as balls rolling towards the financial statements. Some are created in the first place, some are caught by the company's controls, some by the auditor's tests. Whatever slips past both nets is audit risk.
Putting it together
The three multiply: Audit risk = inherent risk × control risk × detection risk. The auditor wants audit risk to stay low. Inherent and control risk are what they are, so detection risk is the dial the auditor turns.