Audit Risk Model: Inherent Risk, Control Risk and Detection Risk Under SAS 145

The audit risk model is the logic that connects what the auditor knows about an entity to how much testing the auditor does. It has been part of US auditing standards for decades, but SAS No. 145, effective for audits of financial statements for periods ending on or after December 15, 2023, changed how the pieces are assessed. Inherent risk and control risk must now be assessed separately, and inherent risk is assessed on a spectrum using defined inherent risk factors.

This guide explains each component, how SAS 145 changed the assessment, and how the conclusions should flow into the audit plan. It paraphrases AU-C 200, AU-C 315 and AU-C 330.

What is audit risk?

Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. In practice it means issuing a clean opinion on statements that contain a material misstatement. Under AU-C 200, the auditor reduces audit risk to an acceptably low level to obtain reasonable assurance.

Audit risk is a function of two things:

1. The risk of material misstatement (RMM): the risk that the financial statements are materially misstated before the audit.
2. Detection risk: the risk that the auditor's procedures do not detect a misstatement that exists and could be material.

The audit risk model

The model is usually written as:

Audit risk = Risk of material misstatement x Detection risk

and, at the assertion level,

Risk of material misstatement = Inherent risk x Control risk

So the full expression is:

Audit risk = Inherent risk x Control risk x Detection risk

The model is conceptual. The standards do not expect auditors to multiply percentages, and most firms assess each component on a scale such as low, moderate and high, or on a more granular spectrum. What matters is the relationship: for a given target audit risk, the higher the RMM, the lower detection risk must be, which means more persuasive substantive evidence.

Inherent risk

Definition

Inherent risk is the susceptibility of an assertion about a class of transactions, account balance or disclosure to a misstatement that could be material, individually or with other misstatements, before consideration of any related controls.

Inherent risk exists because of the nature of the item and its environment, not because of anything the entity's controls do or fail to do.

Inherent risk factors

SAS 145 introduced inherent risk factors that the auditor considers when identifying and assessing inherent risk. Paraphrasing AU-C 315, they include:

• Complexity: arising from the nature of the information or the way it is prepared, such as complex calculations, many data sources or complicated contracts.
• Subjectivity: arising from limits on the availability of knowledge or information, so that management must make judgments, such as estimates.
• Change: arising from events or conditions that affect the entity's business or the financial reporting framework, such as a new accounting standard, a new system or a new business line.
• Uncertainty: arising when the required information cannot be prepared based only on precise, directly observable data, such as fair values without market prices.
• Susceptibility to misstatement due to management bias or other fraud risk factors: arising from conditions that create opportunity or pressure for intentional or unintentional bias.

These factors can interact. A revenue stream with complex contracts, judgments about performance obligations and incentive compensation tied to revenue scores on several factors at once.

The spectrum of inherent risk

SAS 145 requires the auditor to assess inherent risk by evaluating the likelihood and magnitude of a possible misstatement. The combination places the risk somewhere on a spectrum of inherent risk, from lower to higher.

The standard does not require a specific number of points on the spectrum. Firms build their own scales. What the file needs to show is that both likelihood and magnitude were considered and the inherent risk factors drove the assessment.

Significant risks

A significant risk is an identified risk of material misstatement for which the inherent risk assessment is close to the upper end of the spectrum, because of the degree to which inherent risk factors affect the combination of likelihood and magnitude, or one that is treated as significant under other AU-C sections. Two common examples:

• the presumed fraud risk in revenue recognition (AU-C 240), unless rebutted
• the risk of management override of controls (AU-C 240), which cannot be rebutted

Significant risks require a specific response, such as understanding and evaluating the design and implementation of related controls, and substantive procedures that specifically respond to the risk.

Control risk

Definition

Control risk is the risk that a misstatement that could occur in an assertion, and that could be material, will not be prevented, or detected and corrected, on a timely basis by the entity's system of internal control.

Separate assessment under SAS 145

Before SAS 145, US auditors could make a combined assessment of RMM without separately documenting inherent and control risk. SAS 145 requires a separate assessment of each at the assertion level.

When control risk is at the maximum

If the auditor does not plan to test the operating effectiveness of controls, the control risk assessment is set so that the RMM equals the assessment of inherent risk. In other words, control risk is assessed at the maximum. This is common in small nonissuer audits, where testing controls is often less efficient than substantive testing.

Two points follow:

1. Evaluating design and implementation of controls is not the same as testing operating effectiveness. Design and implementation work supports the understanding of internal control under AU-C 315 but does not, by itself, let the auditor assess control risk below maximum.
2. To assess control risk below maximum, the auditor must plan to test operating effectiveness under AU-C 330 and obtain evidence that the controls operated effectively throughout the period of reliance.

Detection risk

Definition

Detection risk is the risk that the procedures performed by the auditor to reduce audit risk to an acceptably low level will not detect a misstatement that exists and that could be material.

Detection risk is the only component the auditor controls

Inherent risk and control risk are properties of the entity. The auditor assesses them but cannot change them. Detection risk is a function of the auditor's procedures: their nature, timing and extent.

The inverse relationship

Detection risk also has a non-sampling element: the risk that the auditor uses an inappropriate procedure, misapplies a procedure or misinterprets the results. Supervision, review and professional skepticism address that element.

How the model drives the audit plan

From assessment to response

For each relevant assertion of each significant class of transactions, account balance or disclosure:

1. Assess inherent risk on the spectrum using the inherent risk factors.
2. Assess control risk, at maximum unless controls will be tested.
3. Combine into the RMM.
4. Design further procedures whose nature, timing and extent respond to the RMM under AU-C 330.
5. Document the link.

Nature, timing and extent

• Nature: higher RMM calls for more reliable evidence, for example external confirmations instead of internal documents.
• Timing: higher RMM favors procedures at or near the period end rather than interim.
• Extent: higher RMM increases sample sizes. In statistical and nonstatistical sampling under AU-C 530, assessed RMM is a direct input to sample size.

Materiality and the model

Materiality and audit risk work together. Performance materiality set under AU-C 320 reduces the risk that uncorrected and undetected misstatements together exceed overall materiality. Higher assessed risk often leads firms to set performance materiality lower within their policy range. Use the materiality calculator to see how benchmark and percentage choices change the amounts.

Revising the assessment

The risk assessment is not fixed at planning. If audit evidence contradicts the original assessment, for example a substantive test finds misstatements in an area assessed as low risk, the auditor revises the assessment and the planned procedures. Accumulated misstatements under AU-C 450 are a key signal.

A worked example

Consider an illustrative regional distributor with a calendar year-end.

Inventory valuation. The company holds a large inventory of seasonal products. Some lines are slow-moving and there is an obsolescence reserve based on management's judgment.

• Inherent risk factors: subjectivity (reserve judgment), uncertainty (future demand), susceptibility to bias (bonus tied to gross margin).
• Likelihood: moderate to high. Magnitude: high relative to materiality.
• Inherent risk: upper end of the spectrum; the auditor concludes it is a significant risk.
• Control risk: the auditor evaluates design and implementation of the review of the reserve but does not test operating effectiveness, so control risk is at maximum.
• RMM: equal to inherent risk, high.
• Response: low detection risk. Substantive procedures at year-end: test the aging data, analyze subsequent sales and margins, compare prior-year reserve to actual write-offs, develop an independent estimate or range for the reserve.

Prepaid insurance.

• Inherent risk factors: none significant. One policy, simple amortization.
• Likelihood: low. Magnitude: low.
• Inherent risk: lower end. If the balance is material, the AU-C 315 evaluation of material classes, balances and disclosures that were not assessed as significant asks the auditor to confirm that conclusion. AU-C 330 also requires substantive procedures for each material class of transactions, account balance and disclosure whatever the assessed risk, so a material prepaid balance still gets limited procedures, such as recalculating the amortization.

The difference in effort between these two areas is the point of the model.

Documentation

Under AU-C 230 and AU-C 315, the file should show:

• the identified risks and the assertions affected
• the inherent risk assessment, including the inherent risk factors considered and the evaluation of likelihood and magnitude
• the control risk assessment and, if below maximum, the basis for it
• the significant risks and why they were designated
• the linkage from each assessed risk to the planned response

See audit assertions for the assertion framework and SAS 145 risk assessment changes for the other changes in the standard.

FAQ

What is the difference between inherent risk and control risk?

Inherent risk is the susceptibility of an assertion to material misstatement before considering controls. Control risk is the risk that the entity's internal control will not prevent, or detect and correct, that misstatement on a timely basis.

Does SAS 145 require separate assessment of inherent risk and control risk?

Yes. AU-C 315 as revised by SAS 145 requires the auditor to assess inherent risk and control risk separately at the assertion level.

If I do not test controls, what is control risk?

Control risk is assessed at the maximum, so the risk of material misstatement equals the inherent risk assessment.

What is detection risk?

Detection risk is the risk that the auditor's procedures fail to detect a material misstatement that exists. It is the only component the auditor controls, through the nature, timing and extent of procedures.

What is the spectrum of inherent risk?

It is the range from lower to higher on which the auditor places each inherent risk, based on the likelihood and magnitude of possible misstatement. Risks close to the upper end are significant risks.

Sources

• AICPA, AU-C Section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards
• AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as revised by SAS No. 145; effective for audits of financial statements for periods ending on or after December 15, 2023)
• AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
• AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
• AICPA, AU-C Section 320, Materiality in Planning and Performing an Audit
• AICPA, AU-C Section 450, Evaluation of Misstatements Identified During the Audit

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error