AUD Risk Model: Why Does Higher Risk Mean Lower Detection Risk?
Detection risk is not the risk that a misstatement exists. It is the risk the auditor's procedures fail to detect a material misstatement that exists.
The basic model
Audit Risk = Inherent Risk × Control Risk × Detection Risk
You can also think of inherent risk × control risk as risk of material misstatement, or RMM.
Inherent risk
Inherent risk comes from the nature of the account, transaction, estimate, industry, or circumstances before considering controls. Complex estimates and fraud-prone assets can have higher inherent risk.
Control risk
Control risk is the risk that the client's controls fail to prevent or detect and correct a material misstatement. Stronger effective controls can support a lower assessed control risk when appropriately tested.
Detection risk
Detection risk is managed through the nature, timing, and extent of audit procedures. Lower acceptable detection risk generally requires stronger or more extensive audit work.
Why the relationship is inverse
If RMM increases and the auditor still wants overall audit risk to remain acceptably low, the auditor must accept less risk of missing the problem. Therefore RMM goes up, acceptable detection risk goes down, and audit work generally increases.
The takeaway
More client risk means the auditor must accept less risk of failing to detect the problem.
Related Summit guides
FAQ
Which risk can the auditor most directly adjust?
Planned detection risk through the nature, timing, and extent of procedures.
If control risk increases, what happens to substantive testing?
All else equal, more substantive evidence may be needed.
If RMM goes up, does detection risk go up?
No. Acceptable detection risk generally goes down to maintain the desired audit risk.