Audit Risk Model Explained: Formula, Components and Examples
Robin Joseph
Senior Security Consultant
Last reviewed: September 2026.
The audit risk model is a planning framework auditors use to keep the chance of giving the wrong audit opinion acceptably low. It says audit risk = inherent risk × control risk × detection risk (AR = IR × CR × DR). Auditors assess inherent and control risk, then set detection risk by deciding how much testing to do.
The model was built for financial statement audits, but the same logic drives SOC 2 and ISO 27001 audits: the weaker your controls look, the harder the auditor tests.
What Is the Audit Risk Model?
Audit risk is the risk that an auditor gives a clean opinion when the financial statements, or the controls being tested, actually contain a material problem. The US audit regulator's standard, PCAOB AS 1101, describes audit risk as a function of the risk of material misstatement and detection risk.
In plain terms, the model answers one planning question: given how risky this area is, and how good the controls are, how much evidence do we need? High-risk areas get more testing. Low-risk areas get less. That is why the model matters most at the planning stage, before fieldwork starts.
The Audit Risk Model Formula
The standard formula is:
Audit Risk (AR) = Inherent Risk (IR) × Control Risk (CR) × Detection Risk (DR)
Inherent risk and control risk together make up the risk of material misstatement (RMM), which gives the shorter version:
RMM = IR × CR, so AR = RMM × DR
How to Solve for Detection Risk
Auditors do not calculate audit risk after the fact. They choose an acceptable audit risk first (often 5% or lower), assess IR and CR, and then work out the highest detection risk they can accept:
Detection Risk = Acceptable Audit Risk ÷ (Inherent Risk × Control Risk)
The lower the answer, the more testing the auditor must do.
Is the Audit Risk Model a Real Mathematical Formula?
Not in practice. The multiplication shows how the parts relate, but auditing standards treat it as a conceptual model. PCAOB AS 1101 describes the relationships in words and never sets out an equation to calculate. Most firms judge each risk as high, medium or low rather than as exact percentages. The numbers in the examples below are teaching tools, not something auditors put in the audit file.
The Components of Audit Risk
| Component | The question it answers | Who controls it | SaaS example |
|---|---|---|---|
| Inherent risk (IR) | How likely is an error or failure before any controls? | Nobody directly; it comes from the business | Many engineers with production access to customer data |
| Control risk (CR) | How likely is it that controls fail to prevent or catch it? | The company | Access reviews are manual and sometimes skipped |
| Detection risk (DR) | How likely is it that the auditor's tests miss it? | The auditor | The auditor samples 5 users instead of 25 |
| Acceptable audit risk (AR) | How much overall risk is the auditor willing to accept? | The auditor, set at planning | Usually 5% or less |
| Risk of material misstatement (RMM) | IR and CR combined: the company's side of the risk | The company | High, because access is broad and reviews are weak |
Inherent Risk
Inherent risk is the natural chance of an error or failure before any control is applied. It is higher when work is complex, involves judgment, changes often, or tempts people to cut corners. In financial audits, that means complex revenue recognition or big estimates. In security audits, it means sensitive data, broad access and fast-changing cloud systems.
Control Risk
Control risk is the chance that your controls fail to prevent or catch a problem. Common causes are poor separation of duties, weak monitoring, badly designed controls and manual steps that get skipped. Weak company-wide controls, such as a poor tone from leadership, raise control risk everywhere.
Detection Risk
Detection risk is the chance that the auditor's own procedures miss a material problem. It is the only part the auditor controls directly. To lower it, auditors test more items, use stronger procedures and test closer to the year end.
Audit Risk Model Examples
Example 1: Financial Statement Audit
An auditor sets acceptable audit risk at 5%. The client has complex transactions (inherent risk 90%) and fairly good controls (control risk 40%).
Detection risk = 0.05 ÷ (0.90 × 0.40) = 0.05 ÷ 0.36 = 13.9%
The auditor must design procedures so there is no more than about a 14% chance of missing a material misstatement.
Example 2: SOC 2 Access Controls
A SaaS company holds customer data (inherent risk 70%). Its access reviews are manual and patchy (control risk 60%). The auditor wants audit risk at 5%.
Detection risk = 0.05 ÷ (0.70 × 0.60) = 0.05 ÷ 0.42 = 11.9%
Now the company automates access reviews and removes leavers automatically, and control risk falls to 30%:
Detection risk = 0.05 ÷ (0.70 × 0.30) = 0.05 ÷ 0.21 = 23.8%
| Scenario | IR | CR | Allowed DR | What it means for the audit |
|---|---|---|---|---|
| Manual, patchy access reviews | 70% | 60% | 11.9% | Low detection risk allowed, so more samples and deeper testing |
| Automated reviews and offboarding | 70% | 30% | 23.8% | Twice the detection risk allowed, so the auditor can rely more on controls |
The lesson for compliance teams: better controls, with evidence to prove them, give the auditor less reason to dig. When they do dig, they find fewer audit findings.
Audit Risk Matrix: How Inherent and Control Risk Set Detection Risk
Because most auditors work in high, medium and low rather than percentages, the model is often shown as a matrix:
| Inherent risk (rows) / Control risk (columns) | High | Medium | Low |
|---|---|---|---|
| High | Very low DR (most testing) | Low DR | Medium DR |
| Medium | Low DR | Medium DR | High DR |
| Low | Medium DR | High DR | Very high DR (least testing) |
Read it like this: when both inherent and control risk are high, the auditor can accept very little detection risk and must test heavily.
How Auditors Adjust Detection Risk
Auditors lower detection risk by changing three things:
- Nature: stronger procedures, such as re-performing a control instead of just asking about it.
- Timing: testing at or near the period end instead of months earlier.
- Extent: bigger samples and more locations or systems.
Lower detection risk always means more evidence.
Applying the Audit Risk Model to SOC 2 and ISO 27001 Audits
SOC 2 and ISO 27001 auditors do not publish an audit risk percentage, but the same three risks shape their work:
| Component | In a SOC 2 audit | In an ISO 27001 audit |
|---|---|---|
| Inherent risk | Which Trust Services Criteria are in scope, and how sensitive the data is | The ISMS scope, and the risks in your risk assessment |
| Control risk | Whether controls are designed well and operated all period (Type 2) | Whether Annex A controls in your Statement of Applicability are working |
| Detection risk | Sample sizes and test methods for each control | Audit days and sampling, set by the certification body's rules |
What your team can influence: keep scope sensible (inherent risk), and run controls consistently with clear, system-generated evidence (control risk). Our guides to risk assessments and ISO 27001 requirements go deeper.
The Audit Risk Model and the Three Lines of Defense
The Three Lines Model (formerly the three lines of defense) sets out who owns risk. It supports the audit risk model by lowering control risk:
- First line: managers and staff who run controls day to day.
- Second line: risk and compliance teams who set policy and monitor.
- Third line: internal audit, which gives independent assurance to the board.
When ownership is clear, controls run more reliably, so control risk falls. Independent third-line reviews also catch problems before the external auditor does.
Acceptable Audit Risk and Audit Assurance
Acceptable audit risk is how much risk the auditor is willing to accept of giving a clean opinion on something that is materially wrong. Audit assurance is its opposite:
Audit assurance = 100% − acceptable audit risk
If acceptable audit risk is 5%, the audit gives 95% assurance. The more people rely on the report (public companies, large lenders, regulated industries), the lower the acceptable audit risk and the more testing is needed.
Audit Risk and Materiality
Materiality is the size of error that would change a reader's decision. A lower materiality threshold means auditors must find smaller errors, which calls for more precise testing. High-risk areas with low materiality get the most attention.
Limitations of the Audit Risk Model
- The numbers are judgments. Inherent and control risk are estimates, so the result can look more precise than it is.
- The parts are not truly independent. Weak controls often go with high inherent risk, so simple multiplication can understate the risk.
- It can miss non-sampling risk, such as an auditor misreading evidence or applying the wrong procedure.
- It is a planning tool. Once fieldwork starts, auditors must revise it if what they find differs from what they expected.
Frequently Asked Questions
The audit risk model is a framework auditors use to plan how much testing to do. It links three risks: inherent risk, control risk and detection risk. By assessing the first two, auditors decide how low detection risk must be to keep overall audit risk, the chance of a wrong opinion, acceptably small.
The formula is audit risk = inherent risk × control risk × detection risk (AR = IR × CR × DR). Because inherent and control risk make up the risk of material misstatement, it is also written AR = RMM × DR. To plan an audit, rearrange it: DR = AR ÷ (IR × CR).
The four terms usually listed are inherent risk, control risk, detection risk and overall audit risk (or acceptable audit risk). Inherent and control risk belong to the company being audited. Detection risk belongs to the auditor. Overall audit risk is the combined result the auditor aims to keep low.
A common five-part list is inherent risk, control risk, detection risk, risk of material misstatement (inherent and control risk combined) and acceptable audit risk. Some textbooks instead split detection risk into sampling risk and non-sampling risk. Either way, the core model rests on inherent, control and detection risk.
Not in practice. The multiplication shows how the risks relate, but auditing standards such as PCAOB AS 1101 describe it in words, as a conceptual relationship. Most auditors rate each risk as high, medium or low rather than calculating exact percentages. The formula is best used to understand the logic.
Acceptable audit risk is the level of risk an auditor will accept of issuing a clean opinion on statements or controls that are materially wrong. It is often set at 5% or lower. Audit assurance is its complement, so 5% acceptable audit risk means 95% assurance.
Detection risk is the part of audit risk the auditor controls. When inherent and control risk are high, the auditor must lower detection risk to keep audit risk acceptable. Lower detection risk means more testing, larger samples and stronger evidence. Detection risk and the amount of testing move in opposite directions.
Say acceptable audit risk is 5%, inherent risk is 70% and control risk is 60%. Detection risk = 0.05 ÷ (0.70 × 0.60) = about 12%. If the company improves its controls so control risk falls to 30%, allowed detection risk rises to about 24%, so the auditor needs less testing.
Lower Your Audit Risk Before the Auditor Arrives
The audit risk model is really a model of trust. Auditors cannot change your inherent risk, and they only control their own testing. The piece in your hands is control risk: controls that work every time, with evidence that proves it. Improve that, and every audit gets faster, lighter and less stressful.
UprootSecurity helps startups and scaleups bring control risk down for SOC 2, ISO 27001, HIPAA and more. The platform tests your controls continuously, pulls system-generated evidence straight from your cloud, identity and HR tools, and flags a failing control before it becomes an audit finding. Our compliance experts help you set a sensible scope and fix gaps early, so auditors see a clean, well-evidenced system from day one.
Risk & Vendor Management
