Audit risk model

Audit Risk (AR)

• The risk that the auditor gives the wrong opinion (e.g., says FS are true & fair, but actually materially misstated).
• Auditors want audit risk to be low.

 Audit Risk (AR) = Inherent Risk (IR) × Control Risk (CR) × Detection Risk (DR)

The relationship is:

AR = IR × CR × DR

IR × CR = risk of material misstatement (RMM) in the financial statements before the audit.

DR = how much risk the auditor is willing to take that their procedures might miss something.

If IR and CR are high, then:

• Auditor must lower DR
• Do more work (larger sample, more tests, more evidence)

Type of Risk	Belongs To	Meaning (Simple)
Inherent Risk	Client/business	Risk due to nature of items/business (before controls).
Control Risk	Client’s controls	Risk controls fail to prevent/detect misstatements.
Detection Risk	Auditor	Risk auditor’s work fails to detect misstatements.