Control risk CR

Control risk is a component of the audit risk model. In broad terms, control risk is the risk that a material misstatement in the unaudited information will not be detected and corrected by the management's internal control procedures on a timely basis. ((The Glossary to ISAs defines control risk in relation to an account balance assertion as "the risk that a misstatement that could occur in an assertion and that could be material, individually or when aggregated with other misstatements, will not be prevented or detected and corrected on a timely basis by the entity’s internal control.")

As with other risks, this risk may be evaluated at various levels of aggregation (e.g. financial statement level, account balance level) and at various stages during the course of the audit (e.g. client acceptance/retention stage, audit planning stage, etc.).

LEVEL OF
AGGREGATION		 AUDIT STAGES
Client acceptance/
retention		 Audit planning Control testing Substantive testing Opinion formulation
Financial
statement level		 CR1 na na na CR5
Account balance
assertion level		 na CR2 CR3 CR4 na

Control risk at the financial statement level

Control risk at the financial statement level may be defined as the risk that a material misstatement in an unaudited financial statement item will not be detected and corrected on a timely basis. This evaluation is a far broader evaluation of control risk than the evaluation of control risk at the account balance assertion level (see below).

Control risk at the financial statement level is evaluated in the first and last audit stages, namely in the client acceptance/retention stage, where it is referred to as CR1 and in the opinion formulation stage, where it is referred to as CR5.

See evaluation of control risk at the financial statement level.

Control risk at the account balance assertion level
Control risk at the account balance assertion level may be defined as the risk that a material misstatement of an account balance assertion (including a misstatement of an underlying class of transaction) will not be detected and corrected by the management's internal control procedures on a timely basis.

Auditors evaluate control risk at the account balance assertion level based on a detailed knowledge of the client's business. Auditors may evaluate this risk in the second, third and fourth audit stages, namely the audit planning, control testing and substantive testing stages and is referred to as CR2, CR3 and CR4 respectively.

See also evaluation of control risk at the account balance assertion level.

Back to glossary

Copyright, Australian Educational Research Pty Ltd. Any person accessing this site agrees to the Terms of Use.