Definition
Control risk is the part of the risk of material misstatement that comes from the entity's controls failing to stop or catch a misstatement. Under AU-C 315 as amended by SAS 145, the auditor assesses control risk for each relevant assertion, separately from inherent risk.
Why it matters in an audit or review
If the auditor plans to rely on controls to reduce substantive testing, the auditor assesses control risk below the maximum and has to test operating effectiveness under AU-C 330. If the auditor does not plan to test controls, control risk is assessed at the maximum and the risk of material misstatement equals the inherent risk assessment.
This is the decision that drives the choice between a controls-reliance approach and a substantive-only approach, so it is documented in the risk assessment.
Example
A client posts payroll through a system with automated approval limits and a monthly supervisor review. The auditor walks through the process, concludes the controls are designed and in place, tests a sample of months, and finds no exceptions. Control risk for payroll expense is assessed as low, so the substantive work shrinks to analytics and a smaller test of terminations. At a client with no review, the auditor assesses control risk at the maximum and tests more transactions.
Common mistakes
Assessing control risk as low from inquiry alone. Inquiry is not enough to support reliance; the auditor needs tests of operating effectiveness.
Sources
- AICPA, AU-C Section 315 (as amended by SAS No. 145), separate assessment of inherent risk and control risk
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks (tests of controls)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error