Audit risk

Definition

Audit risk is the risk that the auditor gives an unmodified opinion on financial statements that are materially misstated. AU-C 200 asks the auditor to reduce it to an acceptably low level. It is a function of the risk of material misstatement (the client's side) and detection risk (the auditor's side).

Why it matters in an audit or review

Audit risk is the reason the whole audit is designed the way it is. The auditor cannot change the risk of material misstatement, only assess it. What the auditor controls is detection risk: the nature, timing and extent of procedures. A higher assessed risk of material misstatement means the auditor needs a lower acceptable detection risk, which means more or better evidence.

Audit risk is never zero. That is why the report speaks of reasonable assurance, not absolute assurance.

Example

A client has a complex revenue arrangement and weak billing controls, so the risk of material misstatement for revenue is assessed as high. To hold audit risk at an acceptable level, the team sets low detection risk: testing contracts near year end, confirming a larger sample of receivables, and using more senior staff on the area. For a simple, well-controlled prepaid balance, the team accepts higher detection risk and relies on analytical procedures.

Common mistakes

Treating audit risk as something the team can assess line by line. Audit risk applies to the audit as a whole; the assessments by assertion feed into it.

FAQ

Is audit risk the same as business risk?

No. Business risk is the entity's risk of not meeting its objectives. Audit risk is the auditor's risk of a wrong opinion. Business risks matter only as far as they can lead to material misstatement.

Sources

• AICPA, AU-C Section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards (audit risk, reasonable assurance)
• AICPA, AU-C Section 315 (as amended by SAS No. 145)