Risk assessment is the part of an audit most often written after the fact. The work gets done, the file needs a risk memo, and somebody types high, medium and low into a template on the last afternoon.
That document proves nothing, because every number in it was chosen to agree with what had already been decided.
Inherent risk is scored from the books, never typed
Audcrix scores inherent risk at assertion level, from the client's own books. What goes into the score:
- the size of the head against performance materiality;
- its movement against last year;
- what the SA 315 engine found on that cycle and assertion;
- the fraud flags that fell on the cycle;
- the journal-entry test;
- the related-party footprint.
A head that barely moves, sits well below materiality and attracted nothing from the other engines does not become high risk because the template had a gap to fill.
Judgement wins, but it has to say why
The CA's own register row overrides the score where one exists. Judgement is meant to win — that is what an auditor is for. But an override must say why, so the file records a reasoned departure rather than a silent one.
Control risk comes from what was actually tested
Control risk is read from the controls register, not asserted:
- a key control that covers the assertion and was tested effective lowers it;
- one found ineffective raises it;
- a control that was identified but never tested cannot be relied on — under SA 330.8 it stays high until tested.
That last rule is the one files most often break. A control listed in the understanding, never tested, and then relied on to reduce substantive work is a gap a reviewer will find.
The response follows the assessment
RoMM is inherent multiplied by control. Detection risk is what the auditor may accept — the inverse. A high RoMM leaves a low detection risk, which means more substantive work, larger samples, and the assertion's procedures marked required.
Crucially, the programme and the sampling read that result. They do not recompute it. One assessment, dated, feeds the plan, the sampling and the engagement file, so the three cannot quietly disagree about how risky the engagement was.
Questions CAs ask
How is inherent risk assessed?
It is scored from the books at assertion level: the size of the head against performance materiality, its movement against last year, what the SA 315 engine found on that cycle and assertion, the fraud flags on the cycle, the journal-entry test and the related-party footprint.
Can the auditor override the score?
Yes, and judgement wins. The CA's own register row overrides the computed score, but an override must state why, so the file records a reasoned departure rather than a silent one.
How is control risk decided?
From the controls register. A key control covering the assertion and tested effective lowers it, one found ineffective raises it, and a control identified but never tested stays high until tested, because under SA 330.8 it cannot be relied on.
What is the relationship between risk and the amount of work?
Risk of material misstatement is inherent risk multiplied by control risk, and detection risk is the inverse — what the auditor may accept. A high assessment leaves low detection risk, so more substantive work, larger samples and procedures marked required.
Do the programme and the sampling recompute the risk?
No. They read one dated assessment, so the plan, the sampling and the engagement file cannot disagree about how risky the engagement was.
Related modules
- Statutory Audit — Statutory audit software built around the Standards on Auditing — materiality, SA 530 sampling, SA 510 opening balances and confirmations, documented as the work is done.
- Fraud Detection — Forensic checks across every Tally voucher — duplicate payments, negative cash, Benford anomalies, back-dated postings — with convergence and honest gap flags.
- Accounting Checks — Completeness, cut-off, accrual and classification checks run over the whole Tally books — every verdict showing its basis, every finding exportable as a working paper.