Compliance Management, Audit and Due Diligence · Audit Process and Documentation

Internal Control and Risk Assessment in the Audit Process

Updated 11 October 2026 · Fact-checked

Risk assessment is the auditor's process of identifying where financial statements could be materially wrong, using an understanding of the entity and its internal control. You assess risk at the assertion level, then design further procedures. Higher assessed risk needs more persuasive evidence (SA 315 and SA 330).

Understand Internal Control and Risk Assessment

An audit cannot check every transaction. So the auditor first asks: where could the financial statements go materially wrong? That question is risk assessment. SA 315 requires the auditor to identify and assess the risks of material misstatement by understanding the entity, its environment and its internal control.

The auditor looks at five components of internal control: the control environment; the entity's risk assessment process; the information system and communication; control activities; and monitoring of controls. SA 315 notes that this split is a useful framework only. An entity may use different terms, provided all components are addressed. The control environment does not by itself prevent or detect a misstatement. It does influence how far you trust the other controls.

Audit risk has components. Inherent risk is the chance a balance or class of transactions is misstated before considering any controls, because of its nature (for example, complex estimates). Control risk is the chance that the entity's controls fail to prevent, or detect and correct, a misstatement. Together these form the risk of material misstatement, which exists independently of the audit. Detection risk is the chance that the auditor's own procedures fail to find a material misstatement. You control detection risk through the nature, timing and extent of your procedures.

Materiality sets the size of error that would influence users' decisions. It is set under SA 320 and guides how much work you do. Lower materiality means more testing.

The link is simple. If assessed risk is high, you must obtain more persuasive evidence (SA 330, para 7(b)). If you plan to rely on controls, you perform tests of control to check they operate effectively. Otherwise you rely on substantive procedures. Risk assessment is continuous: if you find a misstatement, you must reconsider whether your assessment still holds, because fraud or error cannot be assumed to be isolated (SA 330, A61).

Key rules to remember

Audit risk model: Audit risk = Risk of material misstatement × Detection risk; A conceptual model, not an exact calculation. Risk of material misstatement = inherent risk × control risk (when assessed separately).
Risk of material misstatement: RMM = Inherent risk × Control risk; Assessed by the auditor at financial statement and assertion levels. The auditor does not control it; the entity's nature and controls drive it.
Detection risk relationship: Higher assessed RMM → lower acceptable detection risk → more extensive, persuasive substantive evidence; Detection risk is the only component the auditor can change, through nature, timing and extent of procedures.
Five components of internal control (SA 315): Control environment; Entity's risk assessment process; Information system and communication; Control activities; Monitoring of controls; Learn the order. Examiners often ask you to list and explain them.
Steps in identifying and assessing risks (SA 315, para 26): Identify → Assess (pervasive or not) → Relate to assertion level → Consider likelihood and magnitude; Use as the skeleton for any 'how to assess risk' answer.

How to solve Internal Control and Risk Assessment questions

Use this sequence for any question on internal control, audit risk or materiality. It mirrors SA 315 and SA 330 and gives you a provision-analysis-conclusion structure.

1Identify what is asked: component of internal control, type of risk, materiality, or the audit response.
2State the rule in one or two lines, citing SA 315 or SA 330 (for example, para 26 of SA 315 or para 7 of SA 330).
3Pick out the facts from the case: nature of business, weak or strong controls, management attitude, complex estimates, size, past errors.
4Classify each fact: inherent risk factor, control risk factor, or a control environment, monitoring or risk assessment matter.
5Decide whether the risk is pervasive (affects financial statements as a whole) or specific to an assertion.
6Conclude on the assessed risk (higher or lower) and decide whether to test controls or rely mainly on substantive procedures.
7State the response: nature, timing and extent of procedures, with more persuasive evidence for higher risk.
8Add documentation and reassessment points: record the assessment and revisit it if misstatements are found.

Quickest way: Fact-to-risk-to-response drill

When to use it: Use when time is short and the question gives a short case with a few control facts.

Underline each fact in the case and tag it I (inherent), C (control) or E (environment).
Write one line on the rule: higher risk needs more persuasive evidence.
Write the risk level in one line for each tag.
Write the response: test controls if reliable, otherwise extend substantive tests.
Close with a one-line conclusion on whether the risk assessment needs revision.

Common mistakes in Internal Control and Risk Assessment

Mixing up inherent risk and control risk.
Both relate to the entity, so they look alike.
Fix: Ask whether the cause is the nature of the item (inherent) or a failure of the entity's controls (control). Inherent risk is considered before controls.
Saying the auditor controls inherent and control risk.
Students treat all three risks as audit choices.
Fix: The auditor only assesses inherent and control risk. Only detection risk is managed through the audit procedures.
Treating the control environment as a control that prevents misstatements.
The name sounds like an active control.
Fix: Write that it does not itself prevent, or detect and correct, a misstatement. It influences the auditor's evaluation of other controls (SA 315, A82).
Listing the five components in a wrong or incomplete way, or confusing risk assessment process with the auditor's risk assessment.
Both use the phrase 'risk assessment'.
Fix: The entity's risk assessment process is management's process (a component of control). The auditor's risk assessment is the SA 315 exercise. Name whose process you mean.
Doing tests of control when there is no intention to rely on controls, or ignoring them when relying.
Students memorise procedures without the link to the risk assessment.
Fix: Tests of control are needed when you intend to rely on operating effectiveness, or when substantive procedures alone cannot give sufficient evidence.
Treating a found misstatement as a one-off.
Students focus on correcting the item only.
Fix: State that fraud or error cannot be assumed isolated and the risk assessment must be reconsidered (SA 330, A61).

Worked examples

Example 1

Sunrise Textiles Ltd has a weak control environment: the managing director overrides approvals and the board does not review accounting estimates. Inventory valuation is complex due to many product lines. As auditor, how would you assess risk and respond?

Show the solution

Rule: under SA 315 (para 26) you identify and assess risks of material misstatement, including whether they are pervasive. Under SA 330 (para 7(b)) higher risk needs more persuasive evidence.
Facts: management override and no board review point to a weak control environment. This is a matter that can affect many assertions, so the risk is pervasive.
Inventory valuation complexity is an inherent risk factor at the assertion level (valuation).
Because the control environment is weak, it undermines your evaluation of other controls. Reliance on controls is unlikely to be appropriate.
Response: assess control risk as high; plan mainly substantive procedures with more extensive and persuasive evidence, such as year-end stock counts attended by you and independent testing of costing and net realisable value.
Reassess if any misstatement is found, since it may not be isolated.

Answer: Risk of material misstatement is assessed as high, partly pervasive. Do not rely on controls; perform extensive substantive procedures, with more persuasive evidence on inventory valuation, and revisit the assessment if misstatements arise.

Example 2

Differentiate inherent risk, control risk and detection risk, and explain how the auditor manages each.

Show the solution

Inherent risk: susceptibility of an assertion to material misstatement before considering controls, due to its nature (for example, estimates or cash). The auditor assesses it but cannot change it.
Control risk: risk that controls fail to prevent, or detect and correct, a misstatement. The auditor assesses it by understanding and, where relying, testing controls.
Inherent risk and control risk together make the risk of material misstatement, which exists independently of the audit.
Detection risk: risk that the auditor's procedures fail to detect a material misstatement. It is the only risk the auditor manages, by changing nature, timing and extent of procedures.
Relationship: the higher the assessed risk of material misstatement, the lower the detection risk the auditor can accept, so evidence must be more persuasive (SA 330, para 7(b)).

Answer: Inherent and control risk are assessed; detection risk is managed through the design of audit procedures. Higher assessed risk of material misstatement requires lower detection risk and more persuasive evidence.

Exam tips

Always tie your answer to a standard: cite SA 315 for identifying and assessing risk and SA 330 for the response. Paragraph numbers add credibility only when you are sure of them.
In case questions, classify each fact as inherent, control or environment before drawing a conclusion. This shows analysis, which earns marks.
Use the three-part layout: provision, analysis of facts, conclusion. A one-line conclusion on reliance on controls is often what is missing.
For 'differentiate' questions, give a comparison on nature, who controls it and how it is addressed, and mention the relationship with detection risk.
Do not give numeric percentages for risk unless the question supplies them. The model is conceptual.

Practice questions from Audit Process and Documentation

Internal Control and Risk Assessment in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Control and Risk Assessment: frequently asked questions

What is the difference between inherent risk, control risk and detection risk?

Inherent risk is the susceptibility of an item to misstatement before considering controls. Control risk is the chance the entity's controls fail to stop or correct a misstatement. Detection risk is the chance your audit procedures miss a material misstatement, and it is the one you manage.

How do I assess the risk of material misstatement?

Understand the entity, its environment and internal control. Identify risks, assess whether they are pervasive, relate them to what can go wrong at assertion level, and consider the likelihood and magnitude of misstatement (SA 315, para 26).

What are the five components of internal control?

The control environment, the entity's risk assessment process, the information system and communication, control activities, and monitoring of controls. SA 315 treats this as a useful framework; entities may use different terms if all components are covered.

When do I perform tests of control?

When you intend to rely on the operating effectiveness of controls in setting your substantive procedures, or when substantive procedures alone cannot provide sufficient appropriate evidence. Otherwise you rely mainly on substantive procedures.