Audit risk

Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. It has two parts:

1. The risk of material misstatement (RMM) — the risk that the statements are misstated before the audit starts. It belongs to the entity and has two components at the assertion level: inherent risk (how susceptible an assertion is to misstatement before considering controls) and control risk (the risk that the entity's controls won't prevent or detect and correct it).
2. Detection risk — the risk that the auditor's procedures won't find a misstatement that exists. This is the part the auditor controls.

Because audit risk is held at an acceptably low level, the relationship is inverse: the higher the assessed RMM, the lower the detection risk the auditor can accept, and so the more persuasive the evidence must be.

ISA 315 (Revised 2019) requires inherent risk and control risk to be assessed separately. Inherent risk is placed on a spectrum of inherent risk using the inherent risk factors: complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or other fraud risk factors. A risk assessed as close to the upper end of the spectrum — or one another ISA requires to be treated as significant, such as the fraud risks in ISA 240 — is a significant risk. If the auditor doesn't plan to test the operating effectiveness of controls, control risk is assessed at the maximum, so the RMM equals the inherent risk assessment.

Risks also arise at two levels. Financial statement level risks are pervasive — a dominant owner who overrides controls, weak finance competence, going-concern pressure. They call for overall responses under ISA 330: more experienced staff, closer supervision, extra scepticism, more unpredictable procedures. Assertion level risks call for further audit procedures — tests of controls, substantive procedures, or both — whose nature, timing and extent respond to the assessed risk.

ISA 330 adds some firm rules: substantive procedures are required for every material class of transactions, balance and disclosure whatever the risk assessment (ISA 330.18); a significant risk needs substantive procedures specifically responsive to it, including tests of details if no controls are relied on (ISA 330.21); and controls relied on for a significant risk must be tested in the current period (ISA 330.15).