Audit risk is the risk that the auditor may unknowingly fail to appropriately modify the opinion on financial statements that are materially misstated.
A material misstatement is defined as an omission or misstatement of accounting information that, in light of surrounding circumstances, makes it probable that the judgment of a reasonable person relying on the information would have been changed or influenced by the omission or misstatement.
Factual Misstatements: Factual misstatements are misstatements about which there is no doubt.
Judgmental Misstatements: Judgmental misstatements are differences arising from the judgments of management, including those concerning recognition, measurement, presentation, and disclosure in the financial statements (including the selection or application of accounting policies that the auditor considers unreasonable or inappropriate).
Projected Misstatements: Projected misstatements are the auditor's best estimate of misstatements in populations, involving the projection of misstatements identified in audit samples to the entire population from which the samples were drawn.
Audit risk comprises the risk that the financial statements are materially misstated (risk of material misstatement, or RMM) and the risk that the auditor will not detect such misstatements (detection risk, or DR).
The assessment of the risks of material misstatement includes the assessment of the entity's inherent risk (IR) and control risk (CR).
Detection risk is the risk that the auditor will not detect a material misstatement that exists in a relevant assertion. Detection risk is a function of the effectiveness of audit procedures and of the manner in which they are applied.
When the auditor determines that the risk of material misstatement is high, detection risk should be set at a low level. Conversely, when the risk of material misstatement is low, the auditor can justify a higher detection risk.
Audit risk and materiality should be considered together in designing the nature, extent, and timing of audit procedures and in evaluating the results of those procedures.
There is an inverse relationship between audit risk and materiality. The risk of a very large misstatement may be low, whereas the risk of a small misstatement may be high. Also, the more material a misstatement is, the less likely it is that the auditor will not detect it.
Inherent risk and control risk differ from detection risk in that they:
On the basis of audit evidence gathered and evaluated, an auditor decides to increase the assessed risk of material misstatement from that originally planned. To achieve an overall audit risk level that is substantially the same as the planned audit risk level, the auditor would: