Audit Risk Model Explained: Inherent, Control and Detection Risk
By SimplyCPA · 11 October 2026
On this page (8)
- Audit risk (AR): The risk that the auditor gives an inappropriate opinion when the financial statements are materially misstated.
- Formula: AR = Inherent risk (IR) × Control risk (CR) × Detection risk (DR). IR × CR is the risk of material misstatement (RMM).
- Who controls what: IR and CR exist independently of the audit and are assessed; DR is the only component the auditor controls.
- Inverse relationship: The higher the assessed RMM, the lower the acceptable detection risk — so more, better-timed or more reliable substantive testing.
- Exam rearrangement: DR = AR ÷ (IR × CR).
The three components
| Component | Meaning | Auditor's role |
|---|---|---|
| Inherent risk (IR) | How susceptible an assertion is to material misstatement before considering controls — higher for complex estimates, cash, related-party transactions | Assess |
| Control risk (CR) | The risk that the entity's internal control won't prevent, or detect and correct, a material misstatement | Assess |
| Detection risk (DR) | The risk that the auditor's own procedures won't detect a material misstatement that exists | Control, through the nature, timing and extent of substantive procedures |
Working the formula
Example: The auditor wants overall audit risk of 5%. Inherent risk for inventory valuation is assessed at 100% and control risk at 50%. Acceptable detection risk = 0.05 ÷ (1.00 × 0.50) = 10%. If control risk were 100% instead, detection risk would have to fall to 5% — meaning more extensive substantive testing.
How the auditor lowers detection risk
- Nature: switch to more reliable evidence — external confirmations rather than internal documents, tests of details rather than analytics.
- Timing: test at or near the year-end rather than at an interim date.
- Extent: increase sample sizes.
- Assign more experienced staff and increase supervision.
What changed with SAS No. 145
For audits of periods ending on or after December 15, 2023, the AICPA's risk assessment standard (AU-C 315, as amended by SAS No. 145) requires a separate assessment of inherent risk and control risk. Inherent risk is assessed on a spectrum, and a significant risk is one at the upper end of that spectrum. If the auditor doesn't plan to test controls, control risk is assessed at maximum, so RMM equals inherent risk.
Factors that raise inherent risk
- Complexity — derivatives, revenue contracts with multiple obligations, consolidations.
- Subjectivity — estimates such as fair value, impairment, warranty and litigation reserves.
- Change — new systems, new regulations, rapid growth or acquisitions.
- Uncertainty — going concern pressures, volatile markets.
- Susceptibility to bias or fraud — cash, revenue near targets, management incentives.
These are the "inherent risk factors" named in AU-C 315 after SAS No. 145.
Practice questions
1. The auditor assesses control risk as high for inventory. What is the most likely response?
(A) Increase acceptable detection risk (B) Perform more tests of controls (C) Perform more extensive substantive tests at year-end (D) Reduce materiality for the whole audit
Answer: C. Higher control risk raises RMM, so detection risk must be lower — more, better-timed substantive work.
2. Which component of audit risk can the auditor change?
(A) Inherent risk (B) Control risk (C) Detection risk (D) All three
Answer: C.
3. Audit risk is set at 4%, inherent risk 80% and control risk 50%. Acceptable detection risk is:
(A) 10% (B) 5% (C) 2% (D) 20%
Answer: A. 0.04 ÷ (0.80 × 0.50) = 0.10.
Exam tips
- Detection risk is the only component that changes because of what the auditor does. If an answer choice says the auditor "reduces inherent risk", it's wrong.
- Detection risk can never be zero — even 100% testing leaves non-sampling risk (such as misjudging evidence).
- Substantive procedures are required for every relevant assertion of every material account, however low the assessed RMM.
Go deeper in our notes on planning and materiality and assessing the risk of material misstatement.