Audit risk
In one sentenceThe chance that the auditor gives an inappropriate opinion, such as a clean opinion on statements with a material misstatement. It is made up of inherent risk, control risk and detection risk.
Simply put
Inherent risk is the nature of the item itself (inventory is riskier than capital), control risk is that the business's controls do not prevent the error, and detection risk is that the auditor's procedures do not detect it.
The auditor controls only detection risk: the higher the first two risks, the more the auditor extends testing to lower detection risk.
Worked example
An auditor wants audit risk to be no more than 5%, and estimated inherent risk at 50% and control risk at 50% (assumed estimates for illustration).
Acceptable audit risk5%
Inherent risk × control risk50% × 50% = 25%
Allowed detection risk: 5% ÷ 25%20%
Allowed detection risk20%
Formula: Audit risk = inherent risk × control risk × detection risk