What is the difference between inherent risk control risk and detection risk?

Before evaluating audit risk or its components, auditors first determine what they consider to be a material misstatement. Obviously, the likelihood of a material misstatement appearing in the audited financial statements of an entity depends on the value of a material misstatement: the lower the value, the greater the likelihood. It is only after determining the value of reporting materiality that an auditor is able to evaluate whether audit risk is, for example, LOW, MODERATE or HIGH. This is referred to in more detail below.

There are two distinct concepts of audit risk - the acceptable level of audit risk and the achievable level of audit risk. The acceptable level of audit risk [AR*] is the risk of a material financial statement misstatement that is acceptable to the auditor. The achievable level of audit risk [AR] is the risk the audited financial statements will contain a material misstatement. (AR is an ex ante concept and thus it is referred to as the achievable level of risk rather than an ex post concept of an achieved level of risk).

The acceptable level of audit risk [AR*] is estimated by reference to the expected reliance on the audited financial statements. The greater the expected reliance, the lower is the acceptable level of audit risk. The achievable level of audit risk [AR] is estimated by reference to the ex ante value of the components of the audit risk model. That is, the estimated values of inherent, control and (the achievable level of) detection risks. The aim of an auditor is to achieve an acceptable level of audit risk; to achieve a level of audit risk that is acceptable to the auditor.

There are similarly two concepts of detection risk - the allowable level of detection risk and the achievable level of detection risk. The allowable level of detection risk [DR*] is the maximum level of detection risk an auditor can allow to occur. On the other hand, the achievable level of detection risk [DR] is, broadly, the risk that a material misstatement in the unaudited information will not be detected by the auditor, (Again, DR is an ex ante concept and thus it is referred to as the achievable level of risk rather than an ex post concept of an achieved level of risk).

The allowable level of detection risk [DR*] is estimated by reference to specified levels of audit risk, inherent risk and control risk. The greater the acceptable level of audit risk, and the lower the inherent and control risk, then the greater is the allowable level of detection risk. The achievable level of detection risk [DR] is based on such factors as the auditor's independence and ability. The lesser the independence and ability of the auditor, the greater is the level of detection risk that can be achieved (i.e. the greater is the risk that the auditor will not detect a material misstatement).

RISK ASSESSMENT AND INTERNAL CONTROL (AAS-6 issued by ICAI)

Accounting system refers to the series of tasks and records of an entity by which transactions are processed as a means of maintaining final records. The auditor should obtain an understanding of the accounting system sufficient to identify and understand major classes of transactions, manner of initiation of transactions, significant accounting records, supporting documents and specific accounts in the financial statements and the accounting and financial reporting process. Internal Control System refers to all the policies and procedures adopted by the management of the entity to assist in achieving management's objective ensuring the orderly and efficient conducting the business, the accuracy and completeness of accounting records, the timely preparation of financial information, safeguarding of assets of enterprise and defection of fraud and error in a timely manner.

The objectives of internal control can only be reasonably, and not absolutely, achieved due to the following limitations inherent in the system:

(i)            Management's concern about the operating system;

(ii)          Transactions of unusual nature may be missed by most controls;

(iii)         Potential of human error;

(iv)        Circumvention of controls through collusion;

(v)         Abuse of control by the person who is himself responsible for exercising it;

(vi)        Inadequacy of procedures due to changes in conditions; and

(vii)      Manipulations by management.

Inherent Risk - Inherent risk is the susceptibility of an account balance or class of transaction to a material misstatement either individually or when aggregated with misstatements of other balances or classes, assuming that there were no internal controls. The auditor should study and evaluate the degree of inherent risk in order to determine the audit plan. He should also consider other factors, which might compensate for an otherwise high degree of inherent risk. Some of these factors are: -

At the level of financial statements                                          

·               The integrity of management;

·               Experience of the management;

·               Changes in the management team;

·               Unusual pressures on management team; and management, for example, circumstances that might predispose management to misstate the financial statements

At the level of account balance and class of transactions

·               Quality of accounting system;

·               Complexity of the transaction and events;

·               Degree of judgment involved in determining account balances;

·               Susceptibility of assets to losses or misappropriations; and

·               Transactions not subject to ordinary processing.

Control Risk - Control risk is the risk that misstatements could occur in an account balance or class of transaction and that could be material, either individually or when aggregated with other misstatements, will not be prevented or detected and corrected on a timely basis by the accounting and internal control system.

Steps in the Assessment of Risks Control

Preliminary Assessment of Control Risk

In order to make a preliminary assessment of the control risk, the auditor should obtain an understanding of the accounting system and related internal controls. This may be done by supplementing his knowledge gained through previous experience with the entity with

·               Enquiries about the composition of the management;

·               Inspection of the documents and records produced by the accounting and internal control system; and

·               Observations of the entity's activities and procedures.

Test of Controls

Tests of controls are performed by an auditor to obtain audit evidence about the effectiveness of the following:

·               Whether the accounting and internal control systems are suitably designed to prevent or detect and control material misstatements; and

·               Operation of internal controls throughout the period.

Test of control may include the following procedures:

·               Inspection of the documents and records;

·               Inquiries about and observation of internal controls that leave no audit trail;

·               Redoing on a test basis, activities performed automatically by the system; and

·               Testing of internal controls operating on computerised applications.

Final assessment of control risk

On the basis of the results of the test of control the auditor should evaluate whether the preliminary assessment of control risk was correct or do they need to be revised. He should accordingly determine any modification in the nature; timing and extent of audit procedures.

Detection Risk - Detection risk is the risk that an auditor's substantive procedures will not detect a misstatement that exists in an account balance or class of transactions that could be material, either individually or when aggregated with misstatements in other balances or classes. The auditor should consider the assessed levels of inherent and control risks in determining the, nature, timing and extent of substantive procedures required to reduce audit risk to an acceptably low level. There is an inverse relationship between detection risks and the combined level of inherent and control risks. For example, when inherent and control risks are high, acceptable levels of detection risk need to be low to reduce audit risk to an acceptably low level. On the other hand, when inherent and control risks are low, an auditor can accept a higher detection risk and still reduce audit risk to an acceptably low level.

How are inherent risk and control risk different from detection?

The inherent risk stems from the nature of the business transaction or operation without the implementation of internal controls to mitigate the risk. Control risk arises because an organization doesn't have adequate internal controls in place to prevent and detect fraud and error.

What are inherent control and detection risks?

Inherent risk and control risk live within the entity to be audited. Detection risk lies with the auditor. A material misstatement may develop within the company because the transaction is risky or complex. Then, controls may not be sufficient to detect and correct the misstatement.

What are the 3 types of risk in audit?

There are three primary types of audit risks, namely inherent risks, detection risks, and control risks.

What are 3 types of risk controls?

What are the main types of control? Controls are usually categorised as either Preventive, Detective or Reactive. This is based primarily on where in a risk's life do they apply and as a result, do they modify the likelihood and or the impact of the risk.