Risk Assessment and Internal Control
The risk model
Audit risk = inherent risk × control risk × detection risk. Detection risk is the auditor-controlled component: lower assessed risk of material misstatement (IR × CR) means higher acceptable detection risk (less substantive work). Understand the entity and its environment (ISA 315 Revised), including IT systems, and identify significant risks - those close to the upper end of the spectrum, often involving judgement, complex transactions, or related parties.
Internal control components
Five components under the COSO framework (which underpins ISA 315): control environment, risk assessment, control activities, information and communication, and monitoring. The auditor must obtain an understanding of each and evaluate the design and implementation of controls. Tests of controls are performed only when the auditor intends to rely on them; otherwise substantive procedures alone must be sufficient (not possible for certain significant risks).
Traps
Control risk cannot be reduced to zero; inherent risk is assessed before considering controls. Segregation of duties, authorisation, and physical controls are preventive; reconciliations and reviews are detective. A control that is not operating effectively means the auditor cannot rely on it, and the planned substantive work must be extended.
Worked example
If the auditor assesses IR as high and CR as high, detection risk must be low - meaning more substantive testing, larger samples, and greater use of external evidence. If the client has strong automated controls with effective IT general controls, the auditor may test them and reduce substantive sample sizes, but never below the level needed to address significant risks.