The Audit Risk Model and Internal Control: How AUD Questions Chain Them

The audit risk model is written as an equation, AR = IR × CR × DR, and then taught as if the auditor solves it from left to right. No auditor has ever done that. Audit risk is not an output. It is fixed in advance, at the low level the firm is prepared to accept, and it is the one term that never moves.

What moves is detection risk. Inherent risk and control risk belong to the client: the auditor assesses them and cannot change them. Detection risk belongs to the auditor, and it is whatever the equation leaves over once the other three terms are known. That leftover decides how much work is done, of what kind, and when.

Read that way, most AUD procedure questions are one question asked from different sides. The SOCPA Audit subject examines the identical model under ISA 315 and ISA 330 as endorsed in the Kingdom.

The equation, solved backwards

Audit risk is the risk that the auditor gives an unmodified opinion on financial statements that are materially misstated. Inherent risk is the susceptibility of an assertion to material misstatement before any controls are considered. ISA 315 (Revised 2019) names the factors that drive it, complexity, subjectivity, change, uncertainty and susceptibility to management bias or fraud, and calls the result a spectrum rather than a high or low switch. Control risk is the risk that a misstatement which could occur will not be prevented, or detected and corrected in time, by the entity's internal control.

Together the two are the risk of material misstatement: RMM = IR × CR. That product is the entity's contribution, and it exists whether or not anyone audits the statements. Detection risk is the risk that the auditor's own procedures fail to find a misstatement that is there. It is the only term the auditor controls, through three dials: the nature, timing and extent of further procedures.

The arithmetic runs one way. Set audit risk at acceptably low, assess inherent and control risk, and planned detection risk is what remains: the higher the assessed RMM, the lower the detection risk the auditor can afford, and the more persuasive the evidence has to be.

If this goes up	This goes down	Which means
Inherent risk	Acceptable detection risk	More reliable procedures, closer to year end, larger samples
Control risk	Acceptable detection risk	The same, because RMM has risen
Reliance on controls that tested effective	Assessed control risk, then RMM	Detection risk may rise; substantive work is reduced, never removed
Deviations found when testing controls	Reliance, so control risk goes back up	Substantive work must expand to compensate

Two levels: financial statement and assertion

A financial statement level risk is pervasive: a weak control environment, doubt about going concern, management able to override controls. The response is overall, with more experienced staff, more unpredictability and heightened scepticism. An assertion level risk attaches to a specific balance and a specific assertion, and the response is a further audit procedure designed for it. The link candidates miss is that financial statement level risks feed the assessment of inherent risk at the assertion level, so a pervasive risk raises the bar on every balance rather than being answered with one test.

Where control risk comes from: the five components

Both frameworks describe internal control in five components. AU-C 315 uses the vocabulary of COSO's 2013 Internal Control Integrated Framework directly; ISA 315 (Revised 2019) has the same five under slightly longer names. COSO organises seventeen principles under them, and the exam asks not for the principles but for which component a fact belongs to and what it does to control risk.

Component	What it covers	How it moves control risk
Control environment	Tone at the top, integrity, board oversight, competence	Pervasive. A weak one raises control risk on every assertion; good control activities elsewhere cannot repair it
Risk assessment	How management identifies reporting risks and responds to them	A risk management has not identified is a risk no control addresses
Control activities	Authorisations, reconciliations, segregation of duties, IT general controls	The component that gets tested. Design and implementation in every audit; operating effectiveness only when the auditor intends to rely
Information and communication	The system that records, processes and reports transactions	Decides whether the data the controls run on is complete. A reconciliation over an incomplete ledger controls nothing
Monitoring	Internal audit, ongoing evaluations, follow-up on deficiencies	Whether a control that operated in March still operated in December; underpins any use of prior-audit evidence

Two things are true at once. The auditor must understand all five components in every audit, whatever the planned reliance. But an assessment of control risk below maximum can only be supported by evidence that the controls operated effectively, and that comes only from tests of controls.

Test of controls or substantive procedure

The distinction that decides more AUD questions than any other is one sentence. A test of controls tells you whether the control operated. A substantive procedure tells you whether the balance is right. Inspecting an invoice for the credit manager's approval initials tests whether a control worked. Confirming the receivable it created tests whether the number is right.

Around that sentence sit four rules from ISA 330 and its AU-C twin. First, tests of controls are required in two situations: when the auditor intends to rely on controls to reduce substantive work, and when substantive procedures alone cannot provide sufficient appropriate evidence. Otherwise they are optional.

Second, substantive procedures are never optional. Irrespective of the assessed risk, the auditor performs substantive procedures for each material class of transactions, account balance and disclosure. "Controls tested effective, so no substantive testing was performed" is wrong in every framework. Reliance reduces substantive work; it never eliminates it.

Third, reliance has a shelf life: prior-audit evidence about operating effectiveness can be used only if the control has not changed and is retested at least once in every third audit, and controls over a significant risk are tested every period.

Fourth, the chain runs backwards too. Deviations in a test of controls raise the control risk assessment and expand the substantive response; misstatements found substantively are evidence that a control did not operate, and the absence of misstatements is not evidence that it did.

When the substantive response cannot be performed at all, the problem becomes a scope limitation, with the consequences set out in Audit Opinions: Unmodified, Qualified, Adverse and Disclaimer.

Assessing control risk at maximum

The shortcut both frameworks allow: if the auditor does not plan to test operating effectiveness, control risk is assessed such that RMM equals inherent risk. ISA 315 phrases it that way; AU-C 315, as rewritten by SAS 145, says the auditor assesses control risk at the maximum. The effect is identical: all the assurance then comes from substantive work.

It is rational more often than candidates expect. A small distributor whose controls run through one owner-manager offers nothing to rely on; a balance that is cheap to test substantively, such as cash, gives no saving worth the cost of testing controls; a first-year audit may have no basis for expecting controls to operate.

Two limits. Maximum is not available where substantive procedures alone cannot provide sufficient evidence; there, controls must be tested. And maximum is a decision about reliance, not about understanding: the auditor still understands all five components and evaluates the design and implementation of controls over significant risks. "The auditor need not understand internal control when control risk is assessed at maximum" is a classic false option.

A worked example: revenue at a distributor

Take a Riyadh distributor of consumer electronics: tens of thousands of invoices a year, sales staff paid on quarterly targets, IFRS 15 as endorsed by SOCPA, and invoices issued through a ZATCA-integrated e-invoicing system.

Inherent risk. Occurrence and cutoff sit high on the spectrum: volume, target-driven incentives, year-end pressure, and the presumption in both frameworks that revenue recognition carries a fraud risk. Accuracy is moderate, because prices come from a master file rather than being keyed per invoice.

Control design and testing. The system blocks an invoice unless a sales order, an approved credit limit and a signed delivery note match; access to the price master file is restricted and logged; the finance manager signs off a cutoff schedule each month. A sample of invoices across the year is inspected for a matched delivery note, and a price-file change is traced to its authorisation in the log. No deviations, so control risk for occurrence and accuracy is assessed below maximum. For cutoff, the November sign-off is dated after the year end and December's has no evidence of performance: a deviation, so control risk for cutoff stays at maximum.

Assertion	Inherent risk	Control tested	Control risk	Substantive response
Occurrence	High	Three-way match, effective	Below maximum	Reduced extent: analytical procedure on monthly revenue and margin by product line, plus a smaller sample of invoices vouched to delivery notes
Accuracy	Moderate	Price file access, effective	Below maximum	Reduced extent: a sample of invoices agreed to the authorised price list
Cutoff	High	Monthly cutoff review, deviations	Maximum	Full extent at year end: last delivery notes before and first after the year end traced to the period recorded, plus subsequent credit notes reviewed

One account, three assertions, two control risk outcomes, three substantive responses: exactly the shape of an AUD simulation.

The standards, and where the vocabulary differs

For the CPA the references are AU-C 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, as rewritten by SAS No. 145 for periods ending on or after December 15, 2023, and AU-C 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained. For SOCPA they are ISA 315 (Revised 2019), Identifying and Assessing the Risks of Material Misstatement, effective for periods beginning on or after December 15, 2021, and ISA 330, The Auditor's Responses to Assessed Risks. SOCPA has applied ISAs as issued by the IAASB since 1 January 2017 and approved the revised ISA 315 as issued, so there is no Saudi variant of the model. See SOCPA Audit: Syllabus, Topics and a Study Plan for the rest of that subject.

SAS 145 was written to converge AU-C 315 with ISA 315 (Revised 2019), and the substance is now the same. What differs is wording. AU-C says "assess control risk at the maximum" where ISA says "such that RMM equals inherent risk". AU-C sets the substantive floor for each relevant assertion of each significant class of transactions, balance or disclosure; ISA 330 says each material one.

The four question patterns

Direction. "If the auditor assesses control risk lower, the auditor would most likely..." The answer moves a detection risk dial in the permitted direction: less persuasive substantive evidence, interim timing, smaller samples.

Classification. "Which of the following is a test of controls?" or "which component does this belong to?" The verbs give it away. Observe, inspect for evidence of performance, reperform the client's control: test of controls. Confirm, recalculate, vouch, trace, compare to expectation: substantive.

Sequence. "Which should the auditor do first?" Understand, then assess, then respond. Before relying on a control, test that it operated; before testing that, evaluate that it is designed to work and has been implemented.

Revision. "Tests of controls reveal deviations at a rate higher than planned; the auditor should..." Raise the assessed control risk, reduce reliance, expand the substantive response. Options that keep the original plan because the substantive tests found nothing are always wrong.

All four live in Areas II and III of the AUD Blueprint, which together carry 55 to 75% of the marks; the CPA AUD study guide shows how the rest of the section is weighted around them.

Where to practise this

Prepito's AUD course covers the risk-to-response chain across the full Blueprint with practice questions, timed simulations, full explanations and mistake review, in English. The SOCPA Audit course provides practice questions and written explanations in Arabic and English for the Fellowship subject under the endorsed ISAs.

CPA questions and written explanations are in English. Prepito’s interface is available in English and Arabic, and the AI tutor can respond in either language.

If you are planning the whole qualification, start with the CPA programme or the SOCPA Fellowship programme; this topic is one of the few that counts fully toward both.

---

Sources: ISA 315 (Revised 2019) and ISA 330 as published by the IAASB, AICPA SAS No. 145, COSO Internal Control Integrated Framework, and SOCPA's approval of the revised ISA 315. Auditing standards are revised periodically and the AUD Blueprint is republished; confirm the editions in force for your testing window.