Inherent risk is how likely an item is to be wrong before any controls are considered. Control risk is the chance the client's controls will fail to prevent or catch that error. Detection risk is the chance the auditor's own tests will miss it. Inherent and control risk together make the risk of material misstatement, and that assessment decides how much testing the auditor must do.
Last reviewed: 17 October 2026. Facts checked. We ran web searches on SA 315 (Revised) and opened the IAASB's page for ISA 315 (Revised 2019). That page did not give the definitions, and the standard itself needs a login, so we did not read it. We could not open the ICAI text of SA 315 (Revised). The definitions below describe the widely taught audit risk model; check the standard's wording before quoting it. We did not verify ICAI's effective date for SA 315 (Revised).
The idea first
Audit risk is the risk that the auditor gives a clean opinion on financial statements that contain a material error. The auditor cannot remove that risk, only reduce it to an acceptably low level.
The classic model breaks it into parts:
Audit risk = Inherent risk x Control risk x Detection risk
It is a way of thinking, not a calculation you do with exact numbers. Read it as: the more risk in the first two parts, the lower the third must be, which means more audit work.
The three risks in plain words
| Risk | Whose risk is it | Plain meaning | Can the auditor change it? |
|---|---|---|---|
| Inherent risk | The entity's | How exposed the item is to error or fraud, before controls | No, only assess it |
| Control risk | The entity's | The chance controls will not prevent or catch an error | No, only assess it (after testing controls) |
| Detection risk | The auditor's | The chance the auditor's procedures will not find an error that exists | Yes, through the nature, timing and extent of tests |
Inherent risk and control risk exist whether or not an audit happens. Detection risk is the one the auditor controls.
Inherent risk: what makes an item risky
Factors that push inherent risk up include:
- Complexity. Derivatives, revenue recognition with many conditions, or lease accounting.
- Judgement and estimates. Provisions, fair values, impairment, expected credit losses.
- Susceptibility to fraud. Cash, inventory that is easy to move, revenue targets.
- Unusual or one-off transactions. Mergers, related party deals, restructuring.
- Change. New systems, new management, new regulation.
A balance of petty cash is low in inherent risk compared with a valuation of unquoted investments. The revised SA 315 is described in IAASB material as aiming for more robust and consistent risk assessment, and it asks the auditor to think about where on a range an item sits, not just "high" or "low". We did not read the standard text, so verify that point against it.
Control risk: do the controls work
Control risk depends on the controls the entity has and whether they operate. If a company has a strong approval process and system block on duplicate payments, control risk for payments is lower. If the same person raises, approves and pays, control risk is higher.
An auditor who wants to rely on controls tests them. If the test shows they work, the auditor can do less substantive testing. If controls are weak or untested, the auditor assumes higher control risk and tests more directly. Our guide to tests of controls under SA 330 walks through a purchases example.
Detection risk: what the auditor can adjust
Detection risk moves in the opposite direction to the other two.
| If the assessed risk of material misstatement is... | Then acceptable detection risk is... | So the auditor... |
|---|---|---|
| Higher | Lower | Tests more, tests closer to year end, uses stronger evidence, or uses larger samples |
| Lower | Higher | Can rely on less, such as analytical procedures and smaller samples |
Detection risk also includes sampling risk (the sample is not typical) and non-sampling risk (using a wrong procedure or misreading evidence). See sampling with AI: full population or still a sample for how sampling fits in.
Worked example: trade receivables and a loan portfolio
Imagine two areas in the same audit.
- Trade receivables from a few large, long-standing customers who pay on time. Inherent risk is lower because the balance is simple and recoverable. If billing and collection controls are tested and work, control risk is also lower. The auditor accepts higher detection risk: confirm a few key balances and review subsequent receipts.
- Provision for doubtful debts based on management's judgement. Inherent risk is higher because it is an estimate. Suppose there is no formal review of the ageing. Control risk is higher. The auditor must keep detection risk low: test the data behind the ageing, challenge the assumptions and compare against later cash receipts.
The same audit team, two very different work plans, driven by risk.
Where assertions fit
The auditor assesses risk at two levels: the financial statements as a whole, and assertion level (for example existence, completeness, valuation). Assertion-level risks decide the procedures. Our guide to audit assertions explains them. Risks that need special attention, often called significant risks, get a response tailored to them.
For a framework to score risk consistently across areas, see the audit risk scorer assessment framework and the audit risk scorer tool.
Common mistakes
- Assessing control risk as low without testing controls. A low assessment needs evidence.
- Treating the model as arithmetic. Words like higher and lower guide judgement; do not invent percentages.
- Copying last year's risk assessment without checking what changed.
- Confusing inherent risk with fraud risk. Fraud is one factor, not the whole of it.
Frequently Asked Questions
What is inherent risk in simple words?
It is the natural chance that an item contains an error, before looking at controls. Complex, judgemental or fraud-prone items have higher inherent risk.
What is the difference between inherent risk and control risk?
Inherent risk is about the nature of the item. Control risk is about whether the entity's controls would stop or catch an error in it.
Which risk can the auditor control?
Only detection risk, by changing how much and what kind of audit work is done.
What is the risk of material misstatement?
It is inherent risk and control risk taken together. The auditor assesses it at the financial statement level and at the assertion level.
Does the audit risk model use real numbers?
In practice, mostly not. Most firms use judgement and ratings such as low, medium and high. The formula shows the relationship, not a calculation.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error