Audit risk is the risk that the auditor gets it wrong: that the work concludes a control operated when it did not, a balance is fairly stated when it is not, a process is adequate when it is failing. It is a different thing from the risks the organisation faces and from the risk assessment the audit function performs to build its plan, and the three are confused constantly, including in textbooks. This guide defines audit risk precisely, explains the model that external auditors have used since the 1980s and what it hides, translates the model into internal audit terms, shows how it drives sample sizes and the extent of testing, catalogues the sources of detection risk that actually cause wrong conclusions in practice, and works two examples: one where the model was applied well and one where control reliance turned out to be misplaced. It ends with how to document audit risk decisions so that a reviewer or a quality assessor can see the reasoning.
In this guide
- Audit risk defined, and the three components
- The audit risk model and what it hides
- The model in internal audit terms
- How audit risk drives sample sizes and testing extent
- Where detection risk actually comes from
- Audit risk at the plan level: coverage and assurance gaps
- Audit risk and the terms it is confused with
- Two worked examples
- Documenting audit risk decisions
- Frequently asked questions
- Related guides
Audit risk defined, and the three components
In the external audit standards, audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. In internal audit, where the conclusions are about controls, processes and risks rather than about financial statements, the definition generalises: audit risk is the risk that an engagement reaches an inappropriate conclusion, whether by missing a significant control failure, misjudging a rating or accepting evidence that did not support what it was taken to support. Both traditions decompose the risk into three components, and the decomposition is the useful part, because each component is managed differently.
| Component | Definition | Who controls it | What raises it | What the auditor does about it |
|---|---|---|---|---|
| Inherent risk | The susceptibility of the account, process or activity to a significant error, failure or misstatement before considering controls | The nature of the business; not the auditor | Complexity, judgment and estimation, transaction volume and velocity, change, cash and liquid assets, incentive pressure, history of problems | Assesses it, and directs more work to where it is high |
| Control risk | The risk that the organisation’s controls fail to prevent or detect the error or failure on a timely basis | Management; the auditor assesses it | Weak design, inconsistent operation, segregation gaps, override capability, manual processes, turnover in control performers | Assesses design, decides whether to rely, and tests operation if relying |
| Detection risk | The risk that the auditor’s own procedures fail to detect the error or failure that exists | The auditor | Small samples, weak evidence, poor procedure design, reliance on unverified reports, time pressure, skill gaps, bias | Sets it by choosing the nature, timing and extent of procedures; the only component the auditor can reduce directly |
The relationship between the three is the heart of the subject. Inherent and control risk together describe how likely a problem is to exist and to have survived management’s controls; the standards call that combination the risk of material misstatement in the financial audit context. Detection risk is the auditor’s response: the higher the risk that a problem exists, the lower the detection risk the auditor must accept, which means more or better procedures. The engagement-level risk assessment guide covers how the first two are assessed at the start of an internal audit engagement; this guide is about what follows from the assessment.
The audit risk model and what it hides
The audit risk model expresses the relationship as a product: audit risk equals inherent risk multiplied by control risk multiplied by detection risk. Auditors set the audit risk they are willing to accept (low, by convention), assess inherent and control risk, and solve for the detection risk they can afford, which then drives the extent of testing. The model appears in the US auditing standards (the PCAOB’s standard on audit risk and its risk assessment standards) and the international standards (ISA 200, 315 and 330), and in every auditing textbook. A numerical illustration shows how it behaves.
| Scenario | Acceptable audit risk | Inherent risk | Control risk | Implied detection risk | What it means for testing |
|---|---|---|---|---|---|
| Routine payables at a stable company with tested controls | 5% | 50% | 30% | 33% | Modest substantive work; reliance on controls carries much of the assurance |
| Revenue with complex contracts and untested controls | 5% | 90% | 100% (no reliance) | 5.6% | Extensive substantive procedures; large samples or full-population analytics |
| Cash at a cash-intensive retailer with a history of skimming | 5% | 100% | 60% | 8.3% | Heavy testing even with partial control reliance |
| An automated calculation with tested general controls | 5% | 40% | 10% | Above 100% (capped) | A test of one plus the general controls; further substantive work adds little |
The model is useful for the discipline it imposes: it forces the auditor to state the reliance being placed on controls and to connect the extent of testing to the assessed risk. It is also misleading if taken literally, for four reasons that every experienced auditor learns. The percentages are judgments dressed as probabilities; nobody measures inherent risk at 90 per cent. The components are not independent; weak controls often arise in the same places as high inherent risk, so the product understates the combined exposure. The model says nothing about non-sampling risk, the risk that the procedures were the wrong procedures or were performed badly, which in practice causes more wrong conclusions than sampling does. And the model treats detection risk as a dial the auditor can set, when in practice it is constrained by budget, access, data and skill. The right use of the model is as a structured way to argue about the extent of testing, not as arithmetic.
The model in internal audit terms
Internal auditors work the same model with different objects. The external auditor is concerned with misstatement of financial statement assertions; the internal auditor is concerned with whether a control operated, whether a process achieves its objectives, whether a risk is managed within appetite. The components translate as follows, and the translation explains why internal audit engagements vary so much in testing extent.
| Component | In a control-testing engagement | In an operational or process audit | In an advisory engagement |
|---|---|---|---|
| Inherent risk | How likely the control’s failure would matter: the risk the control addresses, its velocity and the exposure if it fails | How likely the process is to miss its objectives given complexity, change, volume and dependence on people | How consequential bad advice would be; the stakes of the decision being supported |
| Control risk | Design adequacy of the control and the general controls it depends on; whether operation can be relied on without testing (it cannot, for a conclusion on operation) | The management oversight, monitoring and second-line activity already covering the process | The client’s own capacity to challenge the advice |
| Detection risk | Sample size relative to control frequency and the assurance sought; evidence quality; whether the auditor tested the control or management’s description of it | Breadth of walkthroughs and interviews; whether data was analysed or described; whether the auditor saw the process or heard about it | Whether the engagement examined enough to know what it did not know |
| Acceptable audit risk | Low for a rated conclusion in a report the committee relies on; set by methodology | Set by the engagement’s purpose: an opinion on the control environment demands lower audit risk than a thematic review | Set with the client; advisory conclusions carry explicit limitations |
One translation deserves emphasis. In internal audit, control risk is not something to rely on without testing when the conclusion is about operating effectiveness. A walkthrough or a test of one establishes design; only samples over the period or full-population analysis establish operation, and the design vs operating effectiveness guide covers the distinction. Where reliance on controls is appropriate is in deciding how much substantive work to do on the outcome the control protects, which is the external auditor’s usual question and an internal auditor’s occasional one.
How audit risk drives sample sizes and testing extent
The most concrete consequence of audit risk is the sample size, and the sampling guidance every function uses is the audit risk model with numbers attached. For attribute sampling of controls, the sample size depends on the confidence level (one minus the acceptable risk of over-reliance), the tolerable deviation rate and the expected deviation rate. The familiar sizes of 25, 40 and 60 for frequently operating controls correspond to particular combinations of those parameters, and the sample sizes guide derives them. The table shows how the parameters respond to the assessed risk.
| Assessed risk of the control failing (inherent and control combined) | Reliance intended | Confidence level | Tolerable deviation rate | Zero-expected-deviation sample (frequent control) | If the control operates less often |
|---|---|---|---|---|---|
| Low | High reliance on the control | 90% | 10% | 22 to 25 | Monthly: 2 to 3; quarterly: 2; annual: 1, plus design testing |
| Moderate | Moderate reliance | 90% to 95% | 7% to 10% | 30 to 40 | Monthly: 3 to 5; weekly: 10 to 15 |
| High | Reliance sought despite high risk | 95% | 5% | 58 to 60 | Consider full-population analytics rather than a larger sample |
| High, with an expected deviation | Reliance doubtful | 95% | 5% with 1% expected | 90 or more | Usually a signal to test substantively instead; see the attribute sampling guide |
For substantive testing of balances and populations, the equivalent logic produces monetary unit sampling and value-weighted selection: the auditor sets the acceptable risk of incorrect acceptance, the tolerable misstatement and the expected misstatement, and the sample size follows; the monetary unit sampling guide works the arithmetic. Two practical points cut across both. First, the evaluation rule must be set before selection: if the sample is designed on a zero-expected-deviation basis, one deviation means the control cannot be concluded effective on that sample, and the handling test exceptions guide covers what happens next. Second, where the data allows, testing the full population through analytics removes sampling risk entirely and leaves only the non-sampling risk of a wrong query or an incomplete extract, which the documenting analytics as audit evidence guide addresses. The free mySampler tool stamps the seed on every selection so that the sample is reperformable, which is part of managing the risk that the sample itself is challenged.
Where detection risk actually comes from
Sampling risk, the possibility that the sample is unrepresentative, is the component of detection risk the standards quantify, and it is not the one that produces most wrong conclusions. Experience, quality assessments and the post-mortems that follow surprises point at non-sampling risk: the procedure did not test what it claimed, the evidence did not support what it was taken to support, the auditor stopped looking too soon. The table lists the sources that recur, with the discipline that addresses each.
| Source of detection risk | How it produces a wrong conclusion | How often it appears in post-mortems | The discipline that addresses it |
|---|---|---|---|
| Inquiry treated as evidence | Management explains; the auditor records the explanation as a result | Very often | Corroborate every explanation with a document, a recomputation or an observation; the audit evidence hierarchy |
| Reliance on unverified system reports | The population or the exceptions come from a report whose completeness nobody tested | Often | Test information produced by the entity before relying on it; the IPE testing guide |
| Testing the control description rather than the control | The auditor confirms that a sign-off exists, not that a review occurred | Often | Test what the reviewer looked at and could have caught; the management review controls guide |
| Scope boundaries drawn around the problem | The failing location, product or period was excluded from scope, sometimes at management’s suggestion | Often | Document every scope exclusion with a reason and state it in the report |
| Sampling risk | The exceptions existed outside the sample | Sometimes | Adequate sample sizes; random selection; full-population analytics where possible |
| Time and budget pressure | Procedures curtailed; conclusions reached on what was done rather than what was needed | Often | Report scope limitations rather than hiding them; the fieldwork guide covers the week-by-week discipline |
| Skill and knowledge gaps | The auditor did not recognise what was in front of them: a derivative, a configuration, a conduct pattern | Sometimes, with large consequences | Specialist involvement; co-sourcing; the competence requirement in Standard 3.1 |
| Confirmation bias and anchoring | The auditor expected a clean result and read the evidence accordingly; or anchored on last year’s rating | Often, invisibly | Deliberate skepticism; a reviewer who asks what would have to be true for the opposite conclusion; the professional skepticism guide |
| Wrong criteria | The control was tested against a superseded policy or the wrong threshold | Sometimes | Cite criteria by source and version in the workpaper |
The list has a pattern: most detection risk is a failure of evidence discipline rather than of statistics. A function that spends its training budget on sampling theory and none on evidence quality has addressed the smaller risk. The annotated workpaper example shows what a file that manages these risks looks like, section by section.
Audit risk at the plan level: coverage and assurance gaps
Audit risk is usually discussed at engagement level, but a function also carries it at the level of the plan: the risk that a significant issue exists in an entity the function did not audit, or audited too long ago, or left to another assurance provider who did not look. The Standards do not use the term for this, but quality assessors and regulators test it, and the mechanics of managing it are the mechanics of the annual risk assessment and the plan document.
| Plan-level source of audit risk | What it looks like | Mitigation | Where it is documented |
|---|---|---|---|
| Incomplete universe | An entity, system or legal entity exists but was never listed, so it was never scored | Annual reconciliation of the universe to the organisation’s structure, systems and change agenda | Universe refresh record; see the audit universe guide |
| Never-audited entities | Low scores that reflect absence of knowledge rather than presence of control | A never-audited floor and a maximum cycle length by rating | Scoring methodology |
| Deferred coverage | High-risk entities deferred for capacity reasons, year after year | Explicit deferred-coverage disclosure accepted by the committee; first in next year’s queue | Plan document, coverage section |
| Misplaced reliance on other providers | The second line or external audit was assumed to cover an area and did not, or did so superficially | Assurance mapping with the basis for reliance stated per entity | The assurance map |
| Stale risk assessment | The plan describes the organisation as it was in November | Trigger-driven re-scoring; mid-year refresh | Methodology and plan-change memos |
| Thin engagements | Entities “covered” by light reviews that could not have found a significant failure | Depth stated per engagement in the plan; the coverage claim matched to the procedures | Plan listing and engagement scoping |
The connection between the two levels is direct. A plan that spreads limited hours across many entities thinly reduces plan-level audit risk on paper and raises engagement-level detection risk in fact, because every engagement is too small to find anything. Functions that understand audit risk tend to audit fewer things properly and to state plainly what they have not reached, which is what the risk-based auditing primer means by prioritisation. The committee can only share in that judgment if it is told, in the plan, which entities are reached at what depth and which are not reached at all; a plan that reports coverage as a percentage of the universe without stating depth is reporting plan-level audit risk as lower than it is.
Audit risk and the terms it is confused with
Much of the confusion around audit risk comes from the word “risk” doing several jobs in one profession. The organisation has risks; the audit function assesses those risks to plan its work; each engagement assesses the risks of the activity it examines; and the auditor carries a risk of being wrong about all of it. Interviewers, examiners and quality assessors use the terms precisely, and candidates and files that blur them are marked down for it. The table separates the terms that are most often run together, and the types of internal audits guide shows how the acceptable audit risk differs by engagement type.
| Term | What it means | How it differs from audit risk |
|---|---|---|
| Audit risk | The risk that the auditor reaches an inappropriate conclusion | The subject of this guide |
| Business or enterprise risk | The risk that the organisation fails to achieve its objectives | The thing the organisation manages and the auditor assesses; it drives inherent risk but is not audit risk |
| Internal audit risk assessment | The function’s annual assessment of auditable entities to build the plan | A planning process; it manages plan-level audit risk but is a different concept from the engagement model |
| Risk of material misstatement | Inherent risk combined with control risk, in the financial audit context | The first two components of audit risk, before the auditor’s own procedures |
| Detection risk | The risk that the auditor’s procedures miss the problem | One component of audit risk; the one the auditor sets |
| Sampling risk and non-sampling risk | The parts of detection risk due to the sample being unrepresentative, and to everything else | Sub-components of detection risk |
| Engagement risk (for an audit firm) | The risk of loss or reputational harm to the auditor from association with a client | A commercial risk to the auditor, not a risk of wrong conclusion |
| Residual risk | The risk remaining after controls | A property of the organisation’s risk; related to control risk but measured for management’s purposes |
| Assurance risk or coverage risk | The informal terms for plan-level audit risk | The same idea as the plan-level section above, under other names |
Two worked examples
Example one: accounts payable, the model applied
An internal audit function plans a payables engagement at a manufacturer with 40,000 invoices a year. The engagement risk assessment rates inherent risk as moderate (high volume, low complexity, some manual coding, no history of significant error) and finds that the three-way match is automated with tested general controls, while the vendor master change control is manual and performed by one person. The auditor decides to rely on the automated match after a test of one and a review of the change-management evidence for the period, which reduces the substantive work on invoice accuracy to analytics on the full population (duplicates, pricing variances, matches overridden). For the vendor master control, no reliance is placed; the control is tested with a sample of 40 changes at 95 per cent confidence and a 7 per cent tolerable rate because the exposure if it fails is a fictitious vendor, and the full population of changes is matched against the employee master. The acceptable audit risk is set low because the engagement will produce a rated opinion for the committee. The file records each decision with its reason, and the extent of testing is visibly proportional to the assessed risk: light where controls are automated and tested, heavy where a single manual control stands between the company and a billing scheme. The planning memo template shows where these decisions are written down.
Example two: the reliance that was misplaced
A function auditing customer onboarding at a lender assesses control risk as low because the previous year’s audit rated the controls satisfactory and the second line’s testing in the current year reported no exceptions. The auditor reduces the sample to 25 and tests document completeness. Nine months later a regulatory review finds that a third of accounts opened through a new digital channel in the period lacked the required verification, because the channel bypassed the control the second line had tested. Every component of the model had been misjudged: inherent risk had risen with the new channel and nobody re-scored it; control risk was assessed on the old process; the second line’s testing had been relied upon without checking its scope; and detection risk was set high on the strength of those judgments. The post-mortem did not find a sampling problem. It found that the population tested had been drawn from the legacy system, so the digital channel was never in the sample at all, which is a completeness failure, and that the reliance on the second line had been placed without reading what it tested. The what regulators expect guide describes how such findings are read by supervisors; the lesson for audit risk is that change resets every component, and that reliance on anyone else’s work requires knowing its scope.
Documenting audit risk decisions
Audit risk judgments are only defensible if they are written down at the time, because the alternative is reconstructing them after the surprise. Three documents carry them. The engagement planning memo records the inherent and control risk assessment, the reliance decisions and the resulting approach, with the acceptable audit risk implied by the engagement’s purpose. The work program converts the approach into procedures with their extent. The workpapers record, for each test, the population and its completeness, the sampling parameters and evaluation rule, and the conclusion in the purpose’s terms. Quality assessors and regulators trace from the report back through these three, and the trace fails at predictable points: a reliance decision with no basis stated, a sample size with no parameters, a scope exclusion with no reason, a conclusion broader than the population tested. The methodology manual guide sets out where each decision belongs; the key vs non-key controls guide covers the rationalisation step that keeps the testing population to the controls that carry the assurance.
| Decision | Where recorded | What must be stated | Reviewer’s question |
|---|---|---|---|
| Inherent risk assessment | Planning memo | Factors considered, rating, source of information | Has anything changed since this was written? |
| Control risk assessment and reliance | Planning memo and work program | Design conclusion, basis for any reliance (own testing, tested general controls, other provider with scope read), what is not relied on | What did the other provider actually test? |
| Acceptable audit risk and resulting approach | Planning memo | Purpose of the engagement, the assurance level sought, the approach by area | Does the extent match the rating? |
| Sampling parameters | Workpaper | Confidence, tolerable rate, expected rate, size, method, seed, evaluation rule set before selection | Can the sample be regenerated? |
| Population completeness | Workpaper | Source, reconciliation to an independent total, period boundaries, exclusions with reasons | Could the failing sub-population be outside this population? |
| Scope exclusions | Planning memo and report | What was excluded, why, and the residual exposure | Who suggested the exclusion? |
| Conclusion | Workpaper and report | Stated in the purpose’s terms, bounded by the population tested and the exceptions found | Is the conclusion broader than the evidence? |
Frequently asked questions
What is audit risk?
The risk that an audit reaches an inappropriate conclusion: in external audit, that the auditor expresses an unmodified opinion on financial statements that are materially misstated; in internal audit, that an engagement concludes a control operated or a process was adequate when it was not. It is decomposed into inherent risk, control risk and detection risk.
What is the audit risk model?
Audit risk equals inherent risk multiplied by control risk multiplied by detection risk. The auditor sets an acceptably low audit risk, assesses inherent and control risk, and solves for the detection risk that can be accepted, which determines the nature, timing and extent of procedures. It is a structured way to reason about testing extent rather than literal arithmetic, and it does not capture non-sampling risk.
What is the difference between inherent risk, control risk and detection risk?
Inherent risk is the susceptibility of an activity to significant error or failure before controls; control risk is the risk that the organisation’s controls fail to prevent or detect it; detection risk is the risk that the auditor’s own procedures miss it. The first two belong to the organisation and are assessed; the third belongs to the auditor and is set through the extent and quality of testing.
How does audit risk affect sample size?
Higher assessed inherent and control risk means the auditor must accept lower detection risk, which means higher confidence levels and lower tolerable deviation rates, which produce larger samples: roughly 25 for high reliance at 90 per cent confidence and 10 per cent tolerable rate, 40 for moderate, 60 for 95 per cent confidence and a 5 per cent tolerable rate, for frequently operating controls. Where data allows, full-population analytics remove sampling risk altogether.
What is the difference between audit risk and the internal audit risk assessment?
Audit risk is the risk of a wrong audit conclusion. The internal audit risk assessment is the annual process of scoring auditable entities to decide where to audit. They are related only in that a poor risk assessment raises plan-level audit risk by leaving significant entities unaudited.
Can audit risk be eliminated?
No. Sampling, reliance on representations, the limits of evidence, judgment and time make some audit risk inevitable. It is reduced to an acceptable level by assessing inherent and control risk carefully, choosing procedures and sample sizes to match, insisting on evidence rather than inquiry, testing the completeness of populations, documenting scope limits, and applying skepticism, especially where last year’s result was clean.
Related guides
- Engagement-level risk assessment — from process understanding to test plan, where inherent and control risk are assessed.
- Attribute sampling end to end — plan, select, evaluate and conclude, with the math.
- Where 25, 40 and 60 come from — the sample sizes derived from confidence and tolerable rates.
- Monetary unit sampling — sample size, selection and evaluation for balances.
- Audit evidence — the hierarchy and the corroboration rule.
- IPE testing — what to check before relying on a system report.
- The annotated workpaper example — a model testing file that manages detection risk, section by section.
- Professional skepticism — the auditor’s core discipline, trained deliberately.
- The annual internal audit risk assessment — managing audit risk at the plan level.
- Assurance mapping — the basis for relying on other providers, stated per entity.
Leave a Reply