Definition
Inherent risk is assessed before controls are considered. Under AU-C 315, as amended by SAS 145, the auditor assesses it on a spectrum from low to high using factors such as complexity, subjectivity, uncertainty, change and susceptibility to bias or fraud. An identified risk assessed close to the upper end of the spectrum is a significant risk.
Why it matters in an audit or review
The assessed risk of material misstatement, built from inherent and control risk, decides how much substantive work AU-C 330 requires. Higher inherent risk means more persuasive evidence, more testing close to year-end and less reliance on analytics alone.
Example
Illustrative: an allowance based on a loss model with several judgmental inputs has high inherent risk. Cash held in a single bank account, with simple transactions, has low inherent risk.
Common mistakes
- Reducing inherent risk because a control exists. That belongs to control risk.
- Using the same rating for every account in a cycle.
- Not updating the assessment when new facts emerge during fieldwork.
FAQ
Can inherent risk be reduced by controls?
No. Controls affect control risk. Inherent risk is assessed as if no controls existed, though the auditor still evaluates the controls to assess the combined risk.
Sources
- AICPA, AU-C Section 315, Identifying and Assessing the Risks of Material Misstatement (as amended by SAS 145): definitions of inherent risk and significant risk, inherent risk factors, spectrum of inherent risk
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error