Audit Risk Model (Testing & Risk Calculations)
The audit risk model links acceptable audit risk to inherent risk, control risk, and detection risk. Auditors use it to plan what evidence to obtain and how much testing may be needed. The calculation guides judgment; it does not set universal risk percentages or replace procedures required by the standards that govern the engagement.
If these terms feel abstract, start with the purpose: the model helps an auditor plan work that can support a sound opinion. It connects the chance of a significant misstatement with the chance that audit procedures will miss it. You do not need to treat its inputs as exact measurements.
The key is to connect each risk estimate to a financial statement assertion, such as whether recorded sales actually occurred. Then plan procedures that respond to that risk, and adjust the plan if the evidence points in a new direction.
What the audit risk model means
The audit risk model is a planning framework for thinking about the chance that an auditor gives an inappropriate opinion when financial statements contain a material misstatement. It links three risk factors: inherent risk, control risk, and detection risk. The relationship helps auditors plan, but does not guarantee a particular audit result.
The standard form is:
AR = IR × CR × DR
- Audit risk (AR) is the risk of an inappropriate audit opinion.
- Inherent risk (IR) is the chance that an assertion could be materially misstated before considering related controls.
- Control risk (CR) is the chance that the entity’s controls will not prevent, or find and correct, a material misstatement in time.
- Detection risk (DR) is the chance that audit procedures will not find a material misstatement that exists.
In practice, inherent risk and control risk inform the auditor’s assessment of risk of material misstatement (RMM). In this simplified model, RMM is represented by IR × CR. The model then links RMM to detection risk: as assessed RMM rises, planned detection risk generally needs to fall.
The terms are not independent dials with precise readings. They summarize judgments about a specific engagement, account, and assertion. For example, a complex estimate may have higher inherent risk because it relies on uncertain assumptions. Weak controls may raise control risk for the same estimate.
How to calculate planned detection risk
Planned detection risk is the level of risk that audit procedures will miss a material misstatement, given the auditor’s acceptable overall audit risk and assessed risks of material misstatement. The calculation can help set the strength of planned procedures. Its result is a planning guide, not a required testing percentage.
Rearrange the model to calculate planned detection risk:
Planned DR = Acceptable AR ÷ (IR × CR)
Use either percentages or decimals throughout the calculation. Do not mix them. For example, enter 5% as 0.05 if using decimals.
Suppose an auditor sets acceptable audit risk at 5%, assesses inherent risk at 80%, and assesses control risk at 50%:
Planned DR = 5% ÷ (80% × 50%) = 5% ÷ 40% = 12.5%
This means the plan calls for a relatively low level of detection risk. It does not mean that a particular test must find 87.5% of errors, nor that the audit has a measured 12.5% chance of failure. The inputs are judgments, not precise readings.
Here is how different illustrative inputs affect the calculation:
| Acceptable AR | Assessed IR | Assessed CR | Calculated planned DR | Planning implication |
|---|---|---|---|---|
| 5% | 80% | 50% | 12.5% | Plan more persuasive or extensive procedures |
| 5% | 90% | 80% | About 6.9% | A very low planned DR points to stronger evidence |
| 5% | 60% | 30% | About 27.8% | The calculation allows higher DR, but procedures still need a sound basis |
These are teaching examples, not standard-set limits. No universal acceptable AR, IR, or CR percentage applies to every engagement. The auditor must document why the inputs make sense for the facts and standards involved.
A lower planned DR usually calls for more persuasive evidence, a larger or differently selected sample where relevant, testing closer to the reporting date, or procedures that directly address the assertion. The exact response depends on the risk and the evidence available.
From risk assessment to audit tests
Risk assessment identifies where a material error could occur. The audit response turns that assessment into procedures, with a clear link to the account, assertion, timing, and extent of testing. A formula alone cannot make that link; the auditor must explain how each planned procedure responds to the risk.
A practical sequence is:
- Set the scope. Identify the account or disclosure, population, and assertion. Assertions describe what management is claiming, such as that inventory exists or recorded sales occurred.
- Assess inherent risk. Consider factors such as complexity, uncertainty, estimation, or the chance of management bias. Explain which factors matter for this assertion.
- Understand relevant controls. Learn how the entity addresses the risk. If relying on controls, test whether they operated effectively, as required by the applicable standards.
- Assess RMM and plan. Use the risk assessment to choose procedures, their timing, and their extent. Calculate planned DR where it helps clarify the level of evidence needed.
- Test, evaluate, and revise. Investigate exceptions and conflicting evidence. Reconsider the assessment and change procedures when needed.
For example, if the risk is that sales were recorded before delivery, the relevant assertion may be occurrence or cutoff. An auditor might inspect shipping records and invoices around year-end, then compare the dates and terms. A general review of total sales would not, by itself, address that specific risk as directly.
A procedure’s design matters as much as its quantity. More items tested may not fix a test that does not address the assertion. Conversely, a well-targeted procedure can provide stronger evidence for a particular risk than a broad but poorly matched check.
Worked case: revenue recorded before year-end
A worked case shows how the calculation can guide a response without dictating it. Imagine a company with complex shipping terms and pressure to meet a sales target. The auditor identifies a risk that some sales near year-end were recorded before control of the goods transferred to customers.
The risk assessment should explain why the issue matters, which transactions may be affected, and which assertion is at risk. For this example, assume the auditor assesses elevated inherent risk and cannot rely on relevant controls. Those facts support a more demanding substantive response.
The auditor could select transactions recorded shortly before and after year-end, inspect contracts and shipping evidence, and compare the transfer terms with the dates in the accounting records. The auditor may also trace selected shipping documents to the sales ledger or start from ledger entries and seek supporting records. The direction of testing should fit the assertion and the risk.
Suppose, for teaching purposes only, acceptable AR is set at 5%, IR at 80%, and CR at 50%. The 12.5% planned DR result signals that the auditor should plan persuasive procedures. It does not prescribe a sample size. Sample design depends on the population, expected and tolerable misstatement, sampling method, and other engagement factors.
If testing reveals a cluster of premature entries, the auditor should not simply record the exception and keep the original plan unchanged. The auditor should investigate the cause and possible extent, consider whether the risk assessment remains appropriate, and decide whether more or different procedures are needed. A failure to find exceptions also does not prove that no misstatement exists.
This is the model’s practical value: it helps connect risk judgments to test planning, while the evidence gathered during testing can change those judgments.
Standards, documentation, and limits
The model supports planning, but applicable auditing standards set requirements for identifying risks and designing responses. In U.S. GAAS, AU-C 315 addresses identifying and assessing risks, and AU-C 330 addresses responses to those risks. For PCAOB engagements, AS 2110 and AS 2301 address the corresponding areas. These standards are not interchangeable.
Under the applicable standard, procedures must respond to assessed risks. Higher assessed risk calls for more persuasive evidence. The model does not replace required procedures, professional judgment, or the need to evaluate evidence. It is a framework for organizing planning decisions.
Good documentation should make the reasoning clear to another auditor. Record:
- The account, disclosure, and assertion involved.
- The possible misstatement and why it could occur.
- The basis for the inherent-risk and control-risk assessments.
- Any acceptable audit-risk assumption and planned DR calculation, if used.
- The procedures selected, including their nature, timing, and extent.
- Results, exceptions, contradictory evidence, and any changes to the plan.
The central limitation is false precision. A calculation that uses unsupported inputs can look exact while resting on weak assumptions. Assess risks based on engagement evidence, explain the reasoning, and revisit the plan when new information emerges.
Frequently asked questions
What is the audit risk model formula?
The formula is AR = IR × CR × DR. Audit risk is the risk of an inappropriate opinion; inherent and control risks relate to possible material misstatement; detection risk concerns whether audit procedures miss it. Auditors use the relationship to support planning, not as a guarantee.
How do you calculate planned detection risk?
Divide acceptable audit risk by the product of assessed inherent risk and control risk: Planned DR = AR ÷ (IR × CR). Keep all inputs in the same format, either percentages or decimals, and explain why the inputs fit the engagement.
What does a 12.5% planned detection risk mean?
It is the result when acceptable AR is 5%, IR is 80%, and CR is 50%. It signals a need to plan for relatively low detection risk. It does not mean that a test must catch a fixed share of errors or that audit failure has a measured 12.5% probability.
Does a higher assessed risk mean more audit testing?
Often, it means the auditor needs more persuasive evidence. The response may involve changing the type, timing, or extent of procedures. More items alone may not be enough; the tests must address the specific account and assertion at risk.
Are inherent risk and control risk independent?
The model displays them as separate factors, but real assessments rely on engagement facts and professional judgment. Auditors assess inherent risk and control risk in relation to relevant assertions. They should not treat the numbers as precise or assume that one factor can be assessed without understanding the other.
Is acceptable audit risk set at 5% by standards?
No universal percentage applies to every audit. A 5% figure is often used in teaching examples, but it is not a required threshold in the standards listed here. Any planning assumption must fit the engagement and be supported by the auditor’s judgment.
What happens if audit testing finds exceptions?
Investigate the exceptions and consider their cause, likely extent, and effect on the risk assessment. The auditor may need to perform more or different procedures, revise the plan, and evaluate whether the evidence supports a conclusion. Do not assume an exception is isolated without a basis.
Does the audit risk model replace auditing standards?
No. It helps organize planning judgments. The standards that govern the engagement still guide risk assessment and required responses. The auditor must follow those standards, use professional judgment, and document how procedures address assessed risks.
(This article was written by one of our staff writers, Alan Westbrook. Visit our Meet the Team page.)
