The Audit Risk Model Explained
The audit risk model is one of the most fundamental concepts tested on the AUD section of the CPA exam. Audit risk (AR) is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated. Under AU-C Section 315 and PCAOB AS 2110, auditors must understand the entity and its environment to assess the risks of material misstatement.
The model is expressed as:
AR = IR × CR × DR
Where AR is audit risk, IR is inherent risk, CR is control risk, and DR is detection risk. The auditor controls only detection risk - inherent risk and control risk exist independently of the audit.
Inherent Risk (IR)
Inherent risk is the susceptibility of an assertion to a material misstatement, assuming there are no related internal controls. Factors that increase inherent risk include:
- Complex transactions: Derivatives, fair value measurements under ASC 820, and revenue arrangements with multiple performance obligations under ASC 606 all carry higher inherent risk.
- Management estimates: Accounts requiring significant judgment - such as the allowance for doubtful accounts, warranty reserves, and goodwill impairment testing - are inherently riskier.
- Industry conditions: Companies in volatile industries or those subject to rapid technological change face elevated inherent risk.
- Related party transactions: Transactions not conducted at arm's length may be more susceptible to misstatement or manipulation.
- Prior misstatements: Accounts with a history of errors signal higher inherent risk for the current period.
Control Risk (CR)
Control risk is the risk that a material misstatement could occur in an assertion and not be prevented or detected on a timely basis by the entity's internal control. When evaluating control risk, auditors must:
- Understand the control environment: Evaluate management's integrity, the board's oversight, organizational structure, and the entity's commitment to competence (COSO framework components).
- Identify relevant controls: Map key controls to significant transaction classes, account balances, and disclosures.
- Test operating effectiveness: If the auditor plans to rely on controls (i.e., assess control risk below maximum), they must test that controls operated effectively throughout the period. This includes inquiry, observation, inspection, and reperformance.
Under PCAOB standards for integrated audits of public companies (AS 2201), the auditor must test controls over all relevant assertions for all significant accounts. Under AICPA standards for nonissuers, the auditor has more flexibility in their control testing approach.
Detection Risk (DR)
Detection risk is the risk that the auditor's substantive procedures will not detect a material misstatement that exists. This is the only component the auditor directly controls. When combined inherent and control risk is high, the auditor must reduce detection risk by:
- Increasing the extent of substantive testing (larger sample sizes)
- Using more effective procedures (external confirmations rather than analytical procedures)
- Adjusting the timing of procedures (testing at year-end rather than interim)
- Assigning more experienced staff to higher-risk areas
Applying the Model: Inverse Relationship
The critical relationship to understand for the CPA exam is the inverse relationship between the assessed risk of material misstatement (IR × CR) and the acceptable level of detection risk:
| Assessed RMM | Acceptable Detection Risk | Nature, Timing, Extent of Substantive Procedures |
|---|---|---|
| High | Low | More persuasive procedures, larger samples, year-end testing |
| Moderate | Moderate | Mix of analytical procedures and tests of details |
| Low | High | Smaller samples, more reliance on analytical procedures |
Exam Tips for the Audit Risk Model
The CPA exam frequently tests your ability to apply the audit risk model in scenario-based questions. Remember these key points:
- Detection risk can never be reduced to zero - there is always some risk that audit procedures will miss a misstatement.
- The auditor must always perform substantive procedures for significant accounts regardless of assessed control risk.
- Fraud risk is a component of inherent risk and is presumed to exist for revenue recognition (AU-C 240 / AS 2401).
- In an integrated audit, the auditor's assessment of control risk directly affects the nature of the opinion on internal controls over financial reporting.
Practice applying the audit risk model with CPA mini exams and reinforce your understanding with AUD flashcards.
Materiality and the Audit Risk Model
Materiality and audit risk work together in planning the audit. Under AU-C 320, the auditor establishes materiality for the financial statements as a whole and performance materiality (used at the individual account level). Lower materiality thresholds mean more work is required, effectively increasing the required precision of detection procedures. The auditor should reassess materiality and audit risk throughout the engagement as new information emerges.
Ready to test your knowledge? Start free CPA exam prep with hundreds of practice questions covering the audit risk model and every other AUD topic.