The formula
AR = IR × CR × DR, so planned DR = AR ÷ (IR × CR). IR × CR is the risk of material misstatement. If the product is at or below the audit risk target, the quotient exceeds 100% and detection risk is capped at 100%.
When to use it
Use it when planning the nature, timing and extent of substantive procedures for an assertion and you want to see how a change in the control risk assessment moves the evidence the tests must provide. It is also a teaching aid for explaining why testing controls can reduce substantive work.
Limits
The model is multiplicative and treats the components as independent, which they are not always. Percentages for qualitative judgments are imprecise, so read the result as a direction rather than a measurement. It does not choose sample sizes on its own. Use the audit sample size and monetary unit sampling calculators for that.
Illustrative figures only. Check the result against your firm's methodology before relying on it.
Common questions
What is the audit risk model?
It expresses audit risk as the product of inherent risk, control risk and detection risk: AR = IR × CR × DR. AU-C 200 defines audit risk as the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated, and describes it as a function of the risks of material misstatement and detection risk.
Do the standards set numeric values for the components?
No. The standards treat the risks qualitatively. The numeric product is a planning device used in audit education and in some firm methodologies, so a percentage you enter here is a way to reason about evidence, not a number the standards prescribe.
How does detection risk relate to the amount of testing?
The lower the detection risk the auditor can accept, the more persuasive the substantive evidence has to be. A higher assessed risk of material misstatement means a lower acceptable detection risk and larger or more extensive tests.
What happens when inherent risk and control risk are both low?
The formula can return a detection risk above 100%, which means the model asks for no assurance from tests. The tool caps it at 100%. Substantive procedures are still required for each material class of transactions, account balance and disclosure.
Are inherent risk and control risk assessed separately?
Yes. AU-C 315, as revised by SAS 145 for audits of periods ending on or after December 15, 2023, requires separate assessments of inherent risk and control risk at the assertion level.
Runs in your browser. The figures you type are not sent to CORAA or stored. Check the result against your firm's methodology before relying on it.