Advanced Auditing, Assurance and Professional Ethics · General Auditing Principles and Auditors Responsibilities

Sufficient Appropriate Audit Evidence and Audit Risk (SA 200)

Updated 5 October 2026 · Fact-checked

Audit risk is the risk that the auditor gives an inappropriate opinion when the financial statements are materially misstated. It has two parts: the risks of material misstatement (inherent plus control risk) and detection risk. You reduce it to an acceptably low level by obtaining sufficient appropriate audit evidence. Assess RMM first, then set detection risk and the extent of procedures.

Understand Sufficient Appropriate Audit Evidence and Audit Risk

An auditor cannot be certain that financial statements are free from misstatement. So SA 200 asks for reasonable assurance, which is a high but not absolute level of assurance. You reach it by collecting enough good evidence to bring audit risk down to an acceptably low level.

Audit risk is the risk that you express an inappropriate audit opinion when the financial statements are materially misstated. It is a function of two things: the risks of material misstatement and detection risk.

Inherent risk is the susceptibility of an assertion to a misstatement that could be material, before considering any related controls. Complex estimates, volatile industries and one-off transactions raise it. Control risk is the risk that the entity's internal control will not prevent, or detect and correct, a material misstatement on a timely basis. Both exist in the entity, independent of your audit. Together they form the risks of material misstatement (RMM), which you assess at the financial statement level and at the assertion level.

Detection risk is the risk that the procedures you perform will not detect a misstatement that could be material. This is the one you control. It depends on the nature, timing and extent of your procedures. The higher your RMM assessment, the lower the detection risk you can accept, so you do more or better work.

Audit evidence is the information you use to reach your conclusions. Sufficiency is the quantity of evidence. Appropriateness is its quality: relevance and reliability. More evidence cannot make up for poor quality evidence. Sufficiency is affected by your assessed risk and by the quality of the evidence. Higher assessed risk needs more evidence.

SA 200 also notes inherent limitations of an audit: use of selective testing, limitations of internal control, the persuasive rather than conclusive nature of most evidence, and the need for judgment. Audit risk is never zero, and it is not the same as the auditor's business risk of litigation or reputation loss.

Key rules to remember

Audit risk model (conceptual): AR = RMM × DR; A conceptual relationship, not a calculation the standard requires. SA 200 does not state a multiplicative formula. Use it to explain direction of effect.
Components of RMM: RMM = combined assessment of inherent risk and control risk (not an arithmetic sum). For illustration only, RMM = IR × CR.; SA 200 allows separate or combined assessment. Under SA 315 (Revised 2019), assess inherent and control risk separately for assertions. Do not describe it as a literal arithmetic sum.
Numerical illustration: DR = AR ÷ RMM, where RMM = IR × CR for illustration only; Only an illustration of the multiplicative model. Example: RMM = 0.5 × 0.5 = 0.25, so DR = 5% ÷ 0.25 = 20%.
Audit evidence: Sufficiency (quantity) + Appropriateness (relevance + reliability); Both are needed. Quantity cannot compensate for poor quality.
Inverse relationship: Higher RMM ⇒ lower acceptable detection risk ⇒ more extensive, or more effective, procedures; Detection risk is managed through nature, timing and extent of procedures.

How to solve Sufficient Appropriate Audit Evidence and Audit Risk questions

Use this order for any question on evidence or audit risk, whether it is a case MCQ or a descriptive answer.

1Identify what the question asks: define a component, classify a fact, state the effect on procedures, or judge whether evidence is adequate.
2Quote the SA 200 definition of the relevant term in one line.
3Classify each fact from the case. Entity-level facts (complex estimates, weak supervision) point to inherent or control risk. Facts about your own testing (small sample, wrong timing) point to detection risk.
4Link to the assertion or the statement level where the case allows, and say whether RMM is higher or lower.
5State the response: change in nature, timing and extent of procedures, since detection risk is the only lever you control.
6Test the evidence for sufficiency (quantity) and appropriateness (relevance, reliability) separately.
7Conclude with the effect on audit risk and on the opinion, and say that reasonable assurance, not absolute assurance, is the aim.

Quickest way: Who owns the risk: entity or auditor?

When to use it: For case MCQs where you must classify a fact as inherent, control or detection risk in under a minute.

Ask: does this exist without the auditor? If yes, it is RMM.
If it exists before controls are considered (nature of business, complexity, estimates), it is inherent risk.
If it is about controls failing to prevent or catch errors, it is control risk.
If it is about the auditor's procedures missing the error (sampling, wrong procedure, wrong timing), it is detection risk.
For evidence questions, check quality first (reliability, source), then quantity.

Common mistakes in Sufficient Appropriate Audit Evidence and Audit Risk

Saying the auditor can reduce inherent and control risk by doing more work.
Students treat audit risk as one block that the auditor manages.
Fix: Inherent and control risks belong to the entity. You only assess them. You influence audit risk through detection risk.
Defining detection risk as a failure of the entity's controls.
Control risk and detection risk both involve 'not detecting' a misstatement.
Fix: Control risk is the entity's controls missing it. Detection risk is your procedures missing it.
Believing more evidence always solves a weak-evidence problem.
Sufficiency is mistaken for the whole concept.
Fix: State that sufficiency is quantity and appropriateness is quality. Poor quality evidence is not cured by volume.
Treating audit risk as the same as the auditor's business risk or as zero when controls are strong.
Mixing professional liability with the technical term.
Fix: Audit risk is about an inappropriate opinion on materially misstated statements. It is reduced to an acceptably low level, never to zero.
Writing the formula as a sum, or using the numerical illustration as a required calculation.
Memorising 'IR + CR + DR' without the multiplicative logic.
Fix: Present the model as a relationship (AR = RMM × DR) and explain direction of effect. Use numbers only as an illustration.

Worked examples

Example 1

Case: You audit a jewellery manufacturer that has large high-value inventory and prices that move daily. Management has no regular stock-count process, and records are updated by one person without review. In the inventory area you plan a small sample for physical verification at year end. Classify the risk factors and state your response.

Show the solution

Large, high-value, price-volatile inventory is a feature of the business that exists before any controls. This raises inherent risk.
No regular stock count and a single person updating records without review mean controls will not prevent or detect misstatement. This raises control risk.
Inherent and control risk together give a high RMM for the inventory assertions, such as existence and valuation.
With a high RMM, you must accept a low detection risk. Your small year-end sample would raise detection risk, so it is not adequate.
Respond by changing the nature, timing and extent of procedures: attend physical verification, perform test counts, and use valuation checks. Increase the sample size and reduce reliance on controls.
Evidence from your own observation and external valuation reports is more reliable than management-prepared records.

Answer: Volatile high-value inventory is inherent risk. Weak stock-count and review controls are control risk. RMM is high, so detection risk must be low, which requires more extensive substantive procedures, including attending counts, not a small sample.

Example 2

Case: In an audit, you assess inherent risk at 50% and control risk at 40%. You want audit risk of 5%. Calculate the acceptable detection risk using the model, and explain what happens if control risk is reassessed at 100%.

Show the solution

Use the model AR = RMM × DR, with RMM = IR × CR for illustration only.
RMM = 0.50 × 0.40 = 0.20.
DR = AR ÷ RMM = 0.05 ÷ 0.20 = 0.25, which is 25%.
If control risk is 100% (controls cannot be relied on), RMM = 0.50 × 1.00 = 0.50.
DR = 0.05 ÷ 0.50 = 0.10, which is 10%.
Detection risk fell from 25% to 10%, so you must do more extensive or more effective substantive procedures.

Answer: Acceptable detection risk is 25%. With control risk at 100%, it falls to 10%, so you must obtain more audit evidence. The numbers only illustrate the model. SA 200 does not require such calculations.

Exam tips

Define each risk in one line using SA 200 wording, then apply it to the case facts. Marks go for the application.
In classification MCQs, check whose risk it is. Entity-owned means inherent or control. Auditor-owned means detection.
Always say that detection risk is the only component you control through nature, timing and extent of procedures.
For evidence questions, discuss sufficiency and appropriateness separately, and mention that reliability depends on source and form.
Mention reasonable assurance and the inherent limitations of an audit when the question asks why audit risk cannot be eliminated.

Practice questions from General Auditing Principles and Auditors Responsibilities

Sufficient Appropriate Audit Evidence and Audit Risk in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Sufficient Appropriate Audit Evidence and Audit Risk: frequently asked questions

What is the difference between inherent risk and control risk?

Inherent risk is the susceptibility of an assertion to a material misstatement before considering controls. Control risk is the risk that the entity's internal control will not prevent, or detect and correct, that misstatement on time. Both belong to the entity and you only assess them.

Can the auditor reduce audit risk to zero?

No. Because of the inherent limitations of an audit, you can only obtain reasonable assurance. You reduce audit risk to an acceptably low level by obtaining sufficient appropriate audit evidence.

What does sufficient appropriate audit evidence mean?

Sufficiency is the quantity of evidence and appropriateness is its quality, covering relevance and reliability. Higher assessed risk calls for more evidence, and better quality evidence needs less. Volume cannot make up for poor quality.

Do I need to memorise the audit risk formula for exams?

Know it as a relationship: audit risk depends on RMM and detection risk. Numerical use is only illustrative, but you should understand that higher RMM means lower acceptable detection risk.