ACCA Audit Risk Notes: The Audit Risk Model Explained [AA]

ACCA audit risk is the single most examined planning topic in the Audit and Assurance (AA) paper, because every scenario question rewards candidates who can spot a risk and then state a response. Audit risk is the risk that the auditor gives a wrong opinion on financial statements that contain a material error. This note builds the audit risk model step by step, works the numbers the way the exam expects, and then links each risk to a proper response under ISA 330. Work through it alongside the rest of the syllabus on our ACCA notes hub.

ACCA audit risk: the model and its three parts

Audit risk equals inherent risk multiplied by control risk multiplied by detection risk. Inherent risk and control risk belong to the client, and the auditor can only assess them. Detection risk belongs to the auditor, who sets it low enough to keep total audit risk at an acceptably low level.

ISA 200 defines audit risk as the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. The model splits that risk into three parts. First, inherent risk is the chance that a balance or transaction class contains a material error before any controls are considered. Complex estimates, cash handling and rapid growth all push inherent risk up. Second, control risk is the chance that the client system of internal control fails to prevent, or to detect and correct, that error. Third, detection risk is the chance that the audit procedures themselves miss the error.

Inherent risk and control risk combine into the risk of material misstatement, often shortened to RoMM. ISA 315 (Revised 2019) requires the auditor to identify and assess that risk at both the financial statement level and the assertion level. ISA 330 then requires responses that match the assessed risk. The direction of the model matters most: when RoMM rises, detection risk must fall, and the auditor earns that fall with more persuasive evidence, larger samples and more work at or after the year end.

Worked example: solving for detection risk

Suppose the audit firm sets a target audit risk of 5 percent. The team assesses inherent risk at 80 percent, because the client sells mainly for cash and prepares complex revenue estimates. The team assesses control risk at 50 percent, because basic controls exist but staff turnover has weakened them. Detection risk must then satisfy the model: 0.05 equals 0.80 multiplied by 0.50 multiplied by detection risk. So detection risk equals 0.05 divided by 0.40, which gives 0.125, or 12.5 percent. That figure carries a clear instruction. The team may accept only a 12.5 percent chance that its procedures miss a material error, so the plan needs extensive substantive testing rather than a light-touch approach.

Assessing ACCA audit risk under ISA 315

ISA 315 (Revised 2019) tells the auditor how to build the risk assessment. The auditor must understand the entity and its environment, the applicable financial reporting framework, and the entity system of internal control. That understanding comes from risk assessment procedures: enquiries of management, analytical procedures, and observation and inspection. The standard names five components of the system of internal control: the control environment, the entity risk assessment process, the information system and communication, control activities, and monitoring of controls.

Inherent risk factors guide the assessment at the assertion level. ISA 315 groups them under five headings: complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or fraud. A first-year audit client adds risk on several fronts at once: opening balances are unverified, the team lacks cumulative knowledge, and the client may have chosen the firm after a dispute with the previous auditor. Similarly, a tight bank covenant or a planned share listing creates pressure on reported profit, and pressure raises the risk of deliberate overstatement of revenue and understatement of costs.

Materiality works beside the risk model, not inside it. ISA 320 requires the auditor to set materiality for the financial statements as a whole, plus performance materiality at a lower figure to allow for undetected errors. Common benchmarks in AA scenarios are 5 to 10 percent of profit before tax, 1 to 2 percent of revenue, and 1 to 2 percent of total assets. So, for a client with profit before tax of $2,400,000, a 5 percent benchmark gives overall materiality of $120,000. Performance materiality at 60 percent of that figure gives $72,000. Higher assessed risk pushes performance materiality toward the lower end of its range, because the auditor wants a bigger safety buffer.

Responding to ACCA audit risk under ISA 330

A risk without a response earns no marks in AA. ISA 330 requires the auditor to design responses at two levels. Overall responses address financial statement level risk: the firm assigns more experienced staff, adds an element of unpredictability to procedures, and increases professional skepticism across the team. Specific responses address assertion level risk: the auditor changes the nature, timing or extent of further audit procedures so that the evidence targets the exact risk identified.

Strong answers in the exam always link the response to the risk in the same sentence. For example, a client that capitalizes development costs for the first time creates a risk that costs failing the IAS 38 criteria sit on the statement of financial position. The matching response is to inspect the project records, agree a sample of capitalized costs to timesheets and invoices, and check each cost against the IAS 38 recognition criteria. In contrast, a generic response such as “increase testing” earns little credit, because it fits every risk and therefore answers none.

Timing and extent follow the risk assessment as well. High RoMM pushes substantive procedures toward the year end date, when balances are final, rather than at an interim visit. High RoMM also means larger samples and a lower reliance on tests of controls, unless the auditor first tests those controls and finds them effective. If the auditor plans to rely on a control, ISA 330 requires tests of its operating effectiveness. Without those tests, the auditor must treat control risk as high and plan a fully substantive approach.

Exam traps in ACCA audit risk questions

• Describing a risk is not the same as explaining it. “Revenue may be overstated” earns nothing on its own. State why: for example, a bonus scheme tied to revenue targets gives management a motive to record fictitious sales.
• Business risk is not audit risk. A fall in demand hurts the client, but it becomes an audit risk only when it threatens a balance or disclosure, such as inventory valued above net realizable value or a going concern doubt.
• Detection risk moves in the opposite direction to RoMM. Candidates often write that high inherent risk means high detection risk. The model says the reverse: the auditor cuts detection risk with more work.
• The auditor cannot change inherent risk or control risk. The auditor assesses both and responds through detection risk alone. Answers that promise to “reduce the client control risk” misunderstand the model.
• Risks sit at two levels. Financial statement level risks, such as a weak control environment, affect the audit as a whole. Assertion level risks attach to one balance or assertion, such as the valuation of receivables. Name the level in your answer.

One-page revision box: ACCA audit risk

• Audit risk = inherent risk x control risk x detection risk. RoMM = inherent risk x control risk (ISA 200, ISA 315).
• ISA 315 (Revised 2019): understand the entity, its environment and its system of internal control; assess RoMM at financial statement and assertion levels.
• Five components of internal control: control environment, risk assessment process, information system and communication, control activities, monitoring.
• ISA 330: respond with overall responses plus specific further procedures; test controls before any reliance on them.
• ISA 320 benchmarks: 5 to 10 percent of profit before tax, 1 to 2 percent of revenue, 1 to 2 percent of total assets; performance materiality sits below overall materiality.
• Every risk needs a paired response in the same sentence. Generic responses earn almost no marks.

Audit risk questions reward a tight chain: fact in the scenario, risk to the financial statements, response that targets that risk. Practice that chain on past scenarios, then compare your approach with our ACCA FR consolidated statements notes, where group audits raise the same planning questions at a larger scale. You can find the full set of papers and levels on the ACCA notes hub.

Lauren Brooks

Lauren Brooks is a finance professional writing on professional exams, study strategies, and finance careers.