Risk assessment, inherent risk, control risk and audit approach

Welcome to the World of Audit Planning!

Hi there, future CPA! Welcome to one of the most important chapters in your auditing journey. Think of Risk Assessment as the "GPS" of an audit. Before an auditor starts checking every single receipt, they need to figure out where the biggest chances of mistakes are. This helps them spend their time and energy on the areas that truly matter.

Don't worry if this seems a bit abstract at first. We’re going to break it down into simple pieces using everyday stories and easy-to-remember tips. Let's get started!

1. Understanding the Audit Risk Model

In auditing, Audit Risk (AR) is the danger that the auditor gives a "clean" opinion (saying the accounts are fine) when the financial statements are actually materially misstated (they have big mistakes).

To manage this, we use a simple formula:

\( AR = Inherent Risk (IR) \times Control Risk (CR) \times Detection Risk (DR) \)

Breakdown of the Components:

1. Risk of Material Misstatement (RMM): This is the combination of Inherent Risk and Control Risk. It is the risk that exists before the auditor even shows up. The auditor cannot change this; they can only assess it.

2. Detection Risk (DR): This is the risk that the auditor’s own procedures will fail to catch a mistake. This is the only part of the equation the auditor can actually control!

Quick Review: Remember, the auditor's goal is to keep Audit Risk at an acceptably low level. If the client’s internal risks (IR and CR) are high, the auditor must work harder to make Detection Risk very low.

Summary/Key Takeaway: Audit risk is the risk of being wrong. To keep it low, if the client looks risky, the auditor must do more work!

2. Inherent Risk (IR) – "The Natural Risk"

Inherent Risk is the susceptibility of an account balance or transaction to a mistake, assuming there are no related internal controls. It is the risk that is "built-in" to the nature of the business or the account itself.

Analogy: The Rain

Imagine you are walking outside. Inherent Risk is like the likelihood of it raining. Some places are naturally rainier (riskier) than others. You can't stop the rain; you just have to know it's coming.

What makes Inherent Risk high?

1. Complex Calculations: Accounts involving complicated math (like pension liabilities).
2. High Judgment: Estimates like "how much will we sell this old machinery for?" are riskier than "how much cash is in the bank?"
3. Industry Changes: If a tech company's products become obsolete overnight, their inventory value is at high risk.
4. Susceptibility to Theft: A diamond jewelry store has higher inherent risk for inventory than a coal mining company.

Did you know? Cash is almost always considered to have high inherent risk because it is very easy to steal and hide!

Summary/Key Takeaway: Inherent risk is about the nature of the item. If it's complex, subjective, or easy to steal, the risk is high.

3. Control Risk (CR) – "The Safety Net"

Control Risk is the risk that a material misstatement will not be prevented, or detected and corrected, on a timely basis by the company’s internal controls.

Analogy: The Umbrella

If Inherent Risk is the rain, Internal Control is your umbrella. Control Risk is the risk that your umbrella has a hole in it! If the company has a "hole" in its procedures (like no one checking the bank statements), mistakes will get through.

Signs of High Control Risk:

1. Lack of Segregation of Duties: The same person who writes the checks also records them in the computer (they could easily steal money!).
2. No Management Oversight: The boss never reviews what the staff is doing.
3. Poor IT Security: Anyone can log in and change the financial data.

Common Mistake to Avoid: Students often confuse IR and CR. Just remember: IR is about the transaction/account itself. CR is about the company’s systems and rules.

Summary/Key Takeaway: Control risk is the failure of the company’s internal "checks and balances."

4. Detection Risk (DR) – "The Auditor’s Job"

Detection Risk is the risk that the auditor’s procedures will not detect a misstatement that exists. This is the only part of the risk model the auditor can "dial up or down."

The Inverse Relationship:

There is an inverse (opposite) relationship between the Risk of Material Misstatement (IR x CR) and Detection Risk.

1. If RMM is High (the client is messy and risky), the auditor must set Detection Risk as Low. To get a low detection risk, the auditor must do more testing and use more experienced staff.
2. If RMM is Low (the client is very organized), the auditor can accept a Higher Detection Risk and do less intensive work.

Memory Aid: "High-Low/Low-High"
- Client Risk High -> Auditor Work High (DR must be Low)
- Client Risk Low -> Auditor Work Low (DR can be Higher)

Summary/Key Takeaway: Detection risk is the "safety margin" for the auditor. If the client is risky, the auditor leaves no stone unturned.

5. Choosing the Audit Approach

Once the auditor has assessed the risks, they must decide on their Audit Approach. There are two main paths:

Approach A: The Substantive Approach

The auditor focuses almost entirely on Substantive Procedures (testing the actual numbers).
When to use:
- When controls are non-existent or very weak (High Control Risk).
- When it would be more efficient to just test the numbers than to test the controls.

Approach B: The Combined Approach

The auditor uses a mix of Tests of Controls and Substantive Procedures.
When to use:
- When the auditor believes the company's controls are strong (Low Control Risk).
- Step 1: Test the controls. If they work...
- Step 2: Reduce the amount of substantive testing (checking the numbers).

Step-by-Step Selection:

1. Understand the business and its environment.
2. Assess Inherent Risk (IR).
3. Assess Control Risk (CR) by looking at the systems.
4. Decide: If controls look good, test them (Combined Approach). If controls look bad, skip them and test the numbers (Substantive Approach).

Summary/Key Takeaway: Strong controls mean less "number-crunching" for the auditor (Combined Approach). Weak controls mean the auditor must check everything manually (Substantive Approach).

Quick Review Box

- Inherent Risk: Risk because of the nature of the business.
- Control Risk: Risk because the company's rules failed.
- Detection Risk: Risk that the auditor missed something.
- The Rule: The more risk the client has, the more work the auditor does!

You've got this! Auditing is just like being a detective—identify the risks, find the clues, and reach a conclusion. Keep up the great work!