Compliance Management, Audit and Due Diligence · Audit Principles and Techniques

Risk Assessment and Internal Control in Auditing

Updated 11 October 2026 · Fact-checked

Audit risk is the risk of giving a wrong opinion on materially misstated financial statements. It equals the risks of material misstatement (inherent risk and control risk) combined with detection risk. You assess these risks, set materiality, test internal controls, and then fix the nature, timing and extent of substantive procedures.

Understand Risk Assessment and Internal Control

Every audit starts with one question: where could the financial statements go materially wrong? Audit risk is the risk that you express an inappropriate opinion when the statements are materially misstated. You cannot remove it. You can only reduce it to an acceptably low level.

SA 200 says audit risk is a function of the risks of material misstatement and detection risk. The risks of material misstatement at the assertion level have two parts: inherent risk and control risk. These are the entity's risks. They exist independently of your audit. Inherent risk is the susceptibility of an assertion to misstatement before considering controls, for example a complex estimate or a high-value, easily stolen inventory. Control risk is the risk that the entity's internal control will not prevent or detect a misstatement in time.

Detection risk is the only part you control. It is the risk that your procedures fail to detect a material misstatement. If the risks of material misstatement are high, you need low detection risk. That means more or better substantive work and, where a test of details is sampled, a larger sample. SA 200 notes that the assessment of risk is a matter of professional judgment, not precise measurement. It may be expressed in percentages or in words such as high, medium and low.

Materiality sets the size of misstatement that could influence users' economic decisions. You use it to plan the audit and to evaluate misstatements found. It is a judgment, often based on a benchmark such as profit or revenue, and it is revised if facts change.

Internal control is the whole system of policies and procedures management sets up to run the business, safeguard assets, prevent and detect fraud and error, and keep reliable records. Internal check is a narrower part of it. It arranges the work of staff so that one person's work is automatically checked by another, for example separate staff for recording, custody and authorisation. Under the risk-based approach you spend most effort on high-risk areas. SA 200 also states that even well-designed control can only reduce, not eliminate, risk, because of human error, collusion and management override. So some control risk always exists, and so does some detection risk.

Key rules to remember

Audit risk model: Audit risk = Risk of material misstatement × Detection risk; The multiplication is a conceptual model. SA 200 says audit risk is a function of these two, and risk assessment need not be exact.
Risk of material misstatement: Risk of material misstatement = Inherent risk × Control risk; SA 200 says the SAs usually refer to a combined assessment. You may assess the two separately or together.
Full model: Audit risk = Inherent risk × Control risk × Detection risk; Inherent and control risk are the entity's risks. Only detection risk is under your control.
Planned detection risk: Detection risk = Audit risk ÷ Risk of material misstatement; Rearrangement used in numerical questions. Higher assessed risk means lower acceptable detection risk and more substantive work.
Sample size factors (tests of details): Higher assessed risk, higher assurance needed, lower tolerable misstatement, higher expected misstatement → larger sample. More other substantive procedures on the same assertion, stratification → smaller sample.; From SA 530 Appendix 3. For large populations, population size has little effect on sample size.

How to solve Risk Assessment and Internal Control questions

Use this order for any written question on audit risk, materiality or internal control. It gives the examiner the provision, analysis and conclusion pattern.

1Identify what is asked: define a risk, explain the model, assess a given situation, or distinguish internal check from internal control.
2State the rule briefly: audit risk is a function of the risks of material misstatement and detection risk, as per SA 200.
3Classify each fact from the case as inherent risk, control risk or detection risk. Inherent risk comes from the nature of the item. Control risk comes from weak or overridden controls.
4Link the assessment to the response: higher risk of material misstatement means lower detection risk, more substantive procedures and larger samples.
5Bring in materiality where figures are given. Compare misstatements and balances with the materiality level you or the case set.
6For controls, say whether you would test their operating effectiveness and rely on them, or go mainly substantive. Mention the limits of control.
7Conclude clearly, with the resulting audit approach and a note on documentation and communication of significant weaknesses.

Quickest way: Risk to response in three lines

When to use it: When time is short and the question gives a scenario with facts about a client's business and controls.

Tag each fact: nature of business or item means inherent risk. Weak control or override means control risk. Our own sampling or testing limits mean detection risk.
Write one sentence: risks of material misstatement are high or low, so detection risk must be low or can be higher.
Write the audit response: extent of substantive tests and sample size, plus testing of controls if reliance is planned, and finish with a one-line conclusion.

Common mistakes in Risk Assessment and Internal Control

Saying that the auditor controls inherent and control risk.
Students treat all three risks as audit-side risks.
Fix: Write that inherent and control risk are the entity's risks and exist independently of the audit. Only detection risk is managed by the auditor.
Claiming good internal control removes control risk.
Students over-trust controls.
Fix: State that internal control can only reduce risk, because of human error, collusion and management override. Some control risk always remains.
Treating internal check and internal control as the same thing.
Both words appear together in many texts.
Fix: Internal control is the whole system. Internal check is one part, built on division of duties so one person's work checks another's.
Assuming a larger population always needs a larger sample.
It seems logical.
Fix: Per SA 530 Appendix 3, for large populations the size has little effect on sample size. Risk, tolerable misstatement and expected misstatement matter more.
Saying a later-discovered fraud proves the audit was defective.
Students link outcome with quality.
Fix: SA 200 says later discovery of a material misstatement does not by itself show failure to follow SAs. But inherent limits do not justify accepting less-than-persuasive evidence.
Treating materiality as a fixed percentage rule for all audits.
Students memorise benchmarks.
Fix: Present materiality as a matter of professional judgment, based on a suitable benchmark and users' needs, and revisable during the audit.

Worked examples

Example 1

Explain the components of audit risk and how an auditor should respond when the assessed risk of material misstatement for trade receivables of Sundaram Textiles Ltd is high.

Show the solution

Rule: As per SA 200, audit risk is a function of the risks of material misstatement and detection risk. The risks of material misstatement consist of inherent risk and control risk.
Inherent risk: Receivables of a textile trader with many old, disputed balances are susceptible to overstatement. Control risk: if credit approval and collection follow-up are weak, controls may not prevent or detect misstatement.
Detection risk: It is the risk that the auditor's procedures miss a material misstatement. It can be reduced but never eliminated.
Response: Because the risks of material misstatement are high, the auditor needs low detection risk. So the auditor relies more on substantive procedures, such as direct confirmations, subsequent receipts testing and ageing review.
Sample size: Per SA 530 Appendix 3, higher assessed risk increases the sample size for tests of details. If other substantive procedures on the same assertion increase, the sample can be smaller.

Answer: Audit risk comprises inherent, control and detection risk. High assessed risk of material misstatement requires low detection risk, hence more extensive substantive tests and larger samples on receivables, with documentation of the judgment.

Example 2

Distinguish between internal control and internal check. A company has one clerk who raises purchase orders, receives goods and passes supplier invoices for payment. Comment on the control risk.

Show the solution

Internal control is the entire system of policies and procedures adopted by management to ensure orderly and efficient conduct of business, safeguard assets, prevent and detect fraud and error and ensure reliable accounting records.
Internal check is part of that system. It divides work so that no single person handles a transaction from start to finish, and one person's work is checked by another.
In the facts, ordering, receiving and invoice approval are all with one clerk. There is no division of duties, so there is no internal check.
Effect: errors or fraud, such as fictitious purchases or payments for goods not received, may go undetected. Control risk is high.
Response: The auditor will not rely on controls over purchases. The auditor will increase substantive procedures such as vouching purchases to goods received notes and confirming balances with suppliers. The auditor will also report the weakness to management and those charged with governance.

Answer: Internal control is the overall system. Internal check is the division-of-duties element within it. The single-clerk arrangement means no internal check, so control risk is high and the audit should rely mainly on substantive procedures.

Exam tips

Open every answer with the SA 200 link: audit risk is a function of the risks of material misstatement and detection risk.
Always say which risks are the entity's and which is the auditor's. Examiners look for this line.
In case questions, tag each fact as inherent, control or detection risk before writing the response. It makes your analysis visible.
For internal check versus internal control, give a clear difference in scope and a short practical example such as separating custody from recording.
End with a conclusion on audit approach and reporting of weaknesses, since marks are given for the conclusion step.

Practice questions from Audit Principles and Techniques

Risk Assessment and Internal Control in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Assessment and Internal Control: frequently asked questions

What are the components of audit risk?

Audit risk has two parts: the risks of material misstatement and detection risk. The risks of material misstatement are inherent risk and control risk. Inherent and control risk are the entity's risks, while detection risk depends on the auditor's procedures.

Can an auditor reduce detection risk to zero?

No. SA 200 says detection risk can only be reduced, not eliminated, because of the inherent limitations of an audit. Some detection risk always exists.

What is the difference between internal check and internal control?

Internal control is the whole system of policies and procedures management uses to run the business and protect assets and records. Internal check is one part of it, based on dividing duties so that one person's work is checked by another.

What is the risk-based audit approach?

It means you assess the risks of material misstatement first and then direct more audit effort to high-risk areas. The assessed risk decides the nature, timing and extent of substantive procedures.