Inherent risk and control risk are two of the three parts of the audit risk model, which auditors use to determine the overall risk of an audit.
Audit risk is the danger that arises from incorrect company’s financial statements, despite auditors saying that they don’t contain any misstatements. Some examples of inappropriate auditors’ opinions include:
- Presenting an unqualified audit report despite the qualification being reasonably justified
- Providing a qualified audit opinion where the qualification isn’t necessary
- Not giving attention to major issues in the audit report
Therefore, audit risk is the product of the different threats auditors may discover when they conduct audits. The purpose of audits is to cut down audit risks to an acceptable level.
Additionally, auditors have to evaluate the hazard level of each of the components of the audit risk for accuracy in the monetary statements. Audit risk may carry legal liability since investors and creditors depend on the financial statements when making decisions.
What is the Audit Risk Model?
The Audit Risk Model is a critical tool that editors use to determine an audit’s overall risk.
This approach of risk assessment takes into account three types of risks, namely:
- Control risk
- Inherent risk
- Detection risk
Here are in-depth insights into each of these components.
Inherent Risk
Inherent risk refers to the hazard of material misstatement in the financial statements of a company. This happens when internal controls don’t get the consideration they should receive from auditors. It stems from the nature of trade or operations without implementing the rules that mitigate risk.
A company can’t successfully cope with a quickly changing business environment if it can’t manage inherent risk adequately.
Besides, a company’s inherent risk can increase if the firm records complex relations and activities. For example, a company that collects data from several subsidiaries to combine it engages in intricate work. The process could comprise a high level of inherent risk.
Another factor that gives rise to inherent risk is dealing with audits previously performed by other auditors. The reports from the audits could have been weak or prejudiced, which arises if auditors intentionally ignore material misstatements.
Lastly, inherent risk could arise from transactions from related entities. This is because the transactions bring the danger of an overstatement or understatement of the value of the assets involved in the financial deal.
Control Risk
Control risk happens because of material misstatement in financial statements. It’s a result of a lack of relevant internal controls to mitigate risk. It also occurs when the internal controls in place have malfunctioned. When a company lacks adequate internal controls to detect and prevent fraud and error, it sets itself up for control risk.
Factors that increase a company’s control risk include:
- Lack of segregation of duties
- Transactions not being verified
- Approval of financial documents without a review by the management
- A supplier selection process that isn’t transparent
The consequences of a significant control risk failure also lead to undocumented asset losses. The statements might indicate a profit while in the real sense, the company has incurred a loss.
An organization’s leadership is responsible for creating, implementing, and maintaining a reliable system of internal controls. However, it’s not always easy to have a reliable method to mitigate risk and prevent asset loss.
A stable long-term internal control system requires the management to alter the platform periodically to cater to ongoing business changes. Failure to review the procedures periodically will see them lose their effectiveness over time. The best practice is to check and upgrade the internal controls annually.
Examples of adequate internal controls include:
- Periodic reviews of the payables details by the chief financial officer to determine the completeness of the list
- Reviews of all invoices by the payables manager to see that they’re entered into the payable system
- Reviews of the budget-to-actual reports by department heads
- Analysis of the unprocessed invoices from all payables clerks by the payables manager
While inherent risks are independent of internal controls, control risk depends on the ability of the operation or design of a control system to eliminate the risk of a misstatement.
Detection Risk
This type of risk arises from an auditor’s failure to detect a material misstatement in financial statements. Using the audit risk model, an auditor can understand the relationship between detection risk and the other two types of audit risk. This creates an environment where the auditors can determine the acceptable level of detection risk.
However, it’s essential to note that it’s not possible to eliminate detection risk in totality. An auditor can only manipulate the risk by modifying these factors:
- The competence and skill of the auditors that makeup the engagement team
- The types of the audit procedures, for example, the degree of substantive procedures in relation to the internal control tests
- The rigor of the audit procedures, including the sample sizes and length of the audit engagement
- Quality control like the CPA’s firm system of reviews and quality control by qualified personnel
Final Thoughts
The auditing process has risks that arise from business processes and transactions. These risks include inherent, control, and detection risks, which form the Audit Risk Model concept. Auditors can reduce the likelihood of asset losses if they understand how each of these risks arises and how to mitigate them.