Factors that can increase inherent risk include subjective estimates, non-routine transactions, and the use of complex financial instruments. Generally, the more complicated a company’s business model and transactions are, the higher the inherent risk is. For example, if audit planning is poor, not all kinds of risks are defined, and the audit program used to detect those risks is deployed incorrectly. The common cause of detection risk is improper audit planning, poor engagement management, wrong audit methodology, low competency, and lack of understanding of audit clients.
Although, audit risk can never be zero, auditors strive to keep this risk as low as possible. Detection risk is the only component of the audit risk model that the auditor can control. Auditors control detection risk by deciding which audit procedures to perform, when to perform them, and how extensively to perform them.
Types of Audit Risk
Unqualified audit opinions state that financial statements are presumed to be free from material misstatements. Inherent risk is the auditor’s assessment of the susceptibility to material misstatement of an assertion about a transaction class, an account balance, or an attached disclosure, quoted individually or an aggregation. The assessment is performed before the audit risk model formula consideration of relevant internal controls in place. Inherent risk is essentially the perceived systematic risk of material misstatement based on the firm’s structure, industry, or market it participates in. Where the auditor’s assessment of inherent and control risk is high, the detection risk is set at a lower level to keep the audit risk at an acceptable level.
- This will catch any loopholes or vulnerabilities that may have been missed in the past or perhaps introduced by regulatory changes.
- The company also lacks an internal audit department which is a key control especially in a highly regulated environment.
- This book is authored by well-known authors in audit, accounting, and finance areas, Karla M. Johnstone, Ph.D., C.P.A. The author holds a Ph.D. in accounting and information systems.
- Some detection risk is always present due to the inherent limitations of the audit such as the use of sampling for the selection of transactions.
- The risk of material misstatement is under the control of management of the company and the auditor can only directly manipulate detection risk.
- In addition, a common mistake is to identify a risk such as going concern and then give this answer over and over again.
For example, control risk is high when the client does not perform bank reconciliation regularly. In this case, auditors will not perform the test of controls on the bank reconciliation. Likewise, more substantive works will be required in order to reduce audit risk to an acceptable level.
How to Evaluate Audit Risk
Detection Risk is risk of auditors being unable to detect material misstatements in the financial statements of the company. This risk mainly occurs in the case where auditors’ methods or procedures is insufficient to detect the existing shortcomings of the financial statements. In other words, detection risks mainly occur because of the inefficacy of the stated financial statements. As far as Risk of Material Misstatement is concerned, it can be seen that this is the risk that the financial reports contain several material misstatements before the audit process is undertaken.
- It embeds trust and reduces risk with market-leading technology designed for organisations that want to optimise their audits.
- The threshold of materiality in this regard varies from organization to organization.
- It is important to note that no matter how much testing is done, there is always some sort of risk involved in an audit.
- Regardless of the fact that in most cases, these risk values are not easily quantifiable, auditors are supposed to use their professional judgement in order to assess the underlying risk involved.
- Therefore, in order to do that, there is a need to assess all the relevant components within the risk model to understand which particular denomination can be compromised upon.
- Though this model seems simple enough, the problem is how to derive the inputs to the model.
Acceptable audit risk is the confidence an auditor has that their auditor’s opinion may bring on a misstatement. It is important to note that no matter how much testing is done, there is always some sort of risk involved in an audit. The model uses a multiplicative relationship between inherent, detection, and control risks. Acceptable audit risk is the concept that auditors need to obtain sufficient appropriate audit evidence to draw reasonable conclusions on which to base the audit opinion. Inherent risk comes from the size, nature and complexity of the client’s business transactions. The more complex business transactions are, the higher the inherent risk the client will have.
