Audit Risk: The Risk Model and How It Drives the Scope of an Audit

The audit risk model

ISA 200 defines three concepts (paragraph 13):

• audit risk: the risk of an inappropriate opinion on materially misstated financial statements; it is a function of the risks of material misstatement and detection risk;
• risk of material misstatement: the risk that the statements are materially misstated before the audit; at assertion level it consists of inherent risk and control risk;
• detection risk: the risk that the auditor’s procedures will not detect an existing material misstatement.

Inherent risk and control risk are the company’s risks

Inherent risk is the susceptibility of an item to misstatement before considering any controls. It is higher, for example, for complex calculations and for accounting estimates subject to significant estimation uncertainty (ISA 200, paragraph A38). Control risk is the risk that the company’s internal control will not prevent or detect a misstatement on a timely basis (paragraph 13).

Importantly, both are risks of the entity and exist independently of the audit (paragraph A37). The auditor does not create them but assesses them. Even well-designed internal control can only reduce, not eliminate, the risk of material misstatement (paragraph A39).

How risk is assessed under ISA 315 (Revised 2019)

• ISA 315 requires separate assessment of inherent risk and control risk at assertion level (paragraph 5).
• Inherent risk is assessed by considering the likelihood and magnitude of misstatement, taking into account inherent risk factors (paragraph 31): complexity, subjectivity, change, uncertainty and susceptibility to management bias or fraud (Appendix 2).
• The standard describes the degree of inherent risk as the “spectrum of inherent risk” (paragraph 5).
• A significant risk is one for which the assessment of inherent risk is close to the upper end of the spectrum, or one that other ISAs require to be treated as significant (paragraph 12); the auditor must determine such risks (paragraph 32).
• If the auditor does not plan to test the operating effectiveness of controls, the assessed risk of material misstatement equals the assessed inherent risk (paragraph 34).

Why risk assessment drives the scope of work

For a given level of audit risk, the acceptable detection risk is inversely related to the assessed risk of material misstatement: the higher the risk of misstatement, the lower the acceptable detection risk and the more persuasive the evidence the auditor needs (ISA 200, paragraph A42). Detection risk is managed through the nature, timing and extent of procedures (paragraph A43).

This explains why similar-looking companies get different audit scopes. A company with complex revenue, large estimated provisions, a change of accounting system or weak controls has higher inherent and control risk, so the auditor enlarges samples, performs more substantive procedures and moves some work to the reporting date. Where controls work and their effectiveness can be tested, part of the evidence comes from tests of controls.

Example: two companies with the same revenue

The first company sells a standard product on prepayment terms, revenue is posted automatically from the accounting system, and bank and warehouse reconciliations are done monthly. The second signs long-term contracts with staged delivery of work, records large provisions and moved to new accounting software during the year.

The second company has higher inherent risk over revenue and estimates: complexity, subjectivity and change are named directly as inherent risk factors in ISA 315. So, at the same materiality, the auditor has to gather more evidence for it, and the audit scope will be noticeably larger.

What the risk model does not promise

• The auditor cannot reduce audit risk to zero: audit evidence is persuasive rather than conclusive (ISA 200, paragraph A45).
• Detection risk can only be reduced, not eliminated; some detection risk will always exist (paragraph A44).
• Audit risk is a technical term: it does not include the auditor’s business risks, such as litigation (paragraph A33).
• Risk assessment is a matter of professional judgement rather than precise measurement (paragraph A32); the ISAs allow assessments in quantitative or non-quantitative terms (paragraph A40).

Risk assessment procedures

To assess risks, the auditor performs risk assessment procedures (ISA 315, paragraph 14):

• inquiries of management and other appropriate individuals, including internal audit where it exists;
• analytical procedures;
• observation and inspection.
• If new information contradicts the original assessment, the auditor revises the identification or assessment of risks (paragraph 37).

What a company can do before the audit

• document key processes and controls: revenue, purchases, payroll and estimated provisions;
• prepare calculations for accounting estimates with assumptions and data sources;
• tell the auditor in advance about related party transactions, unusual transactions and any change of accounting system;
• provide access to primary documents and accounting system data for analytical procedures.