Inherent risk is the susceptibility of an assertion to a misstatement, due to error or fraud, that could be material either individually or in combination with other misstatements, before consideration of any related controls (PCAOB, AS 1101, .07). The last clause is the definition’s whole point: it is the risk the balance carries on its own, with the entity’s controls deliberately switched off.
The same word is used outside auditing for the same idea, and the two uses are close enough to be confused and different enough to matter.
What It Sits Inside
Risk of material misstatement at the assertion level has two components. Inherent risk is one, and control risk is the other, meaning the risk that a misstatement that could occur in an assertion, and that could be material, will not be prevented or detected on a timely basis by the company’s internal control, which is a function of the effectiveness of the design and operation of that control (PCAOB, AS 1101, .07).
Above that pair sits the audit’s own risk. Audit risk is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated, and it is a function of the risk of material misstatement and detection risk (PCAOB, AS 1101, .04). Detection risk is the risk that the procedures the auditor performs will not detect a misstatement that exists and could be material (PCAOB, AS 1101, .09).
Two of those three belong to the client and one belongs to the auditor. Inherent risk and control risk relate to the company, its environment and its internal control, and the auditor assesses them from evidence obtained, using risk assessment procedures and the characteristics of the accounts and disclosures for inherent risk (PCAOB, AS 1101, .08). Detection risk is the only one the auditor sets, by choosing what work to do.
Before Consideration of Controls Is Not a Formality
The order is what makes the concept useful. Assessed without regard to controls, inherent risk says which balances would be hard to get right even in a well-run entity, so it drives where the audit looks before anyone asks whether the client’s controls work.
That sequencing is why the relevant assertions on an engagement are determined before any consideration of related controls, a chain worked through in assertions, and why whether controls are tested at all is a separate decision, set out in tests of controls.
Running the two together is the common error. An auditor who reasons that a balance is low risk because the client reconciles it monthly has assessed control risk and called it inherent risk, and has lost the information that the separate assessment was there to produce.
What Raises It
Generally accepted auditing standards name the drivers rather than leaving them to judgment alone. Inherent risk factors are characteristics of events or conditions that affect the susceptibility to misstatement, whether due to fraud or error, of an assertion about a class of transactions, account balance or disclosure, before consideration of controls, and such factors may be qualitative or quantitative and include complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or other fraud risk factors insofar as they affect inherent risk (AU-C 315, .12).
Read that list against a real trial balance and it separates the accounts quickly. A cash balance usually scores low on complexity, subjectivity and uncertainty. A warranty provision or an impairment scores on all of them at once.
It Is a Spectrum, Not a Switch
For identified risks of material misstatement at the assertion level, a separate assessment of inherent risk and of control risk is required. Inherent risk is higher for some assertions and related classes of transactions, account balances and disclosures than for others, and the degree to which the level of inherent risk varies is referred to as the spectrum of inherent risk (AU-C 315, .05).
The word spectrum is doing real work there. A risk assessment that records every assertion as high or low has flattened the thing the standard asks the auditor to place along a range, and a workpaper that says only high or low is harder to defend than one that says where on the range and why.
The Same Word Outside an Audit
Enterprise risk management uses inherent risk for the same idea in a wider setting: the risk to an entity in the absence of any direct or focused actions by management to alter its severity (NIST, Computer Security Resource Center Glossary, inherent risk, from NISTIR 8286 citing COSO Enterprise Risk Management).
The structure matches. Both measure exposure before the response, and both are paired with a second figure measured after it. What differs is the object. The audit version is anchored to an assertion in a set of financial statements, while the enterprise version is anchored to an entity and any risk it faces, so a risk register’s inherent rating is not an audit inherent risk assessment and cannot be reused as one.
Common Questions
The susceptibility of an assertion to a material misstatement from error or fraud, judged before any related controls are taken into account (PCAOB, AS 1101, .07).
An accounting estimate carrying significant estimation uncertainty, a complex non-routine transaction, a balance requiring subjective judgment, or an area where management has an incentive to bias the result. Each of those is one of the named inherent risk factors, complexity, subjectivity, change, uncertainty or management bias (AU-C 315, .12).
Residual risk is the enterprise risk management counterpart, what is left after management acts. The audit vocabulary does not use that word: it pairs inherent risk with control risk to reach the risk of material misstatement, and then with detection risk to reach audit risk (PCAOB, AS 1101, .04 and .07).
No. It belongs to the company, its environment and its internal control rather than to the audit, and the auditor assesses it from evidence obtained (PCAOB, AS 1101, .08). What the auditor controls is detection risk, by changing the nature, timing and extent of the work.
Accountably places trained offshore accountants and tax preparers inside US CPA and EA firms, and a firm can grade a real block of its own audit support work through a trial task before anything client facing depends on it.
