Audit risk

Audit risk is the risk that an auditor will not detect errors or fraud while examining the financial
statements of a client. Auditors can increase the number of audit procedures in order to reduce the
level of audit risk. Reducing audit risk to a modest level is a key part of the audit function, since the
users of financial statements are relying upon the assurances of auditors when they read the
financial statements of an organization.

The three types of audit risk are as follows:

Control risk. This is the risk that potential material misstatements would not be detected or
prevented by a client's control systems.

Detection risk. This is the risk that the audit procedures used are not capable of detecting a material
misstatement.

Inherent risk. This is the risk that a client's financial statements are susceptible to material
misstatements.

Control risk

Control risk is the probability that financial statements are materially misstated, due to failures in the
system of controls used by a business. When there are significant control failures, a business is more
likely to experience undocumented asset losses, which mean that its financial statements may reveal
a profit when there is actually a loss.

The managers of a business are responsible for designing, implementing, and maintaining a system of
controls that is adequate for preventing the loss of assets. It is not easy to maintain a solid system of
controls, since the system must be periodically altered to fit ongoing changes in business processes,
as well as to deal with entirely new business transactions. Also, management may knowingly avoid
implementing certain controls, on the grounds that they are too expensive to maintain or that they
interfere with the smooth flow of transactions that impact customers.
Detection risk

Detection risk is the possibility that an auditor will not locate a material misstatement in a client's
financial statements via audit procedures. This is particularly likely when there are several
misstatements that are individually immaterial, but which are material when aggregated. The
outcome is that an auditor would conclude that there is no material misstatement of the financial
statements when such an error actually exists, which would then lead to the issuance of an
erroneously favorable audit opinion.

The auditor is responsible for managing detection risk. The level of detection risk can be reduced by
conducting additional substantive tests, as well as by assigning the most experienced staff to an
audit. There will always be some amount of detection risk in an audit, since audit procedures do not
comprehensively examine every business transaction - instead, they only review a sampling of these
transactions.

Detection is one of the three risk elements that comprise audit risk - which is the risk that an
inappropriate audit opinion will be issued. The other two elements are inherent risk and control risk.

Inherent risk

Inherent risk is the probability of loss based on the nature of an organization's business, without any
changes to the existing environment. The concept can be applied to the financial statements of an
organization, where inherent risk is considered to be the risk of misstatement due to existing
transactional errors or fraud.

The misstatement may be present in the financial statements or in the accompanying disclosures.
This risk may be assessed by outside auditors as part of their audit of the financial statements of a
business. Inherent risk is considered to be more likely under the following circumstances:

Judgment. A high degree of judgment is involved in business transactions, which introduces the risk
that an inexperienced person is more likely to make an error.

Estimates. Significant estimates must be included in transactions, which makes it more likely that an
estimation error will be made.

Complexity. The transactions in which a business engages are highly complex, and so are more likely
to be completed or recorded incorrectly. Transactions are also more likely to be complex when there
are a large number of subsidiaries submitting information for inclusion in the financial statements.
Another example of complexity is when an organization routinely engages in derivative transactions.

The effects of an inherent risk can be mitigated by using one or more precisely targeted controls.
However, the effects of too many controls can be a less efficient organization, so management
should weigh the benefits of risk reduction against the greater burden of more controls on the
business.