AUDIT RISK
　　NOVEMBER 2011
　　individually or when aggregated with other misstatements, before
　　consideration of any related controls.’
　　Control risk is ‘the risk that a misstatement that could occur in an assertion
　　about a class of transaction, account balance or disclosure and that could be
　　material, either individually or when aggregated with other misstatements, will
　　not be prevented, or detected and corrected, on a timely basis by the entity’s
　　internal control.’
　　Detection risk is defined as ‘the risk that the procedures performed by the
　　auditor to reduce audit risk to an acceptably low level will not detect a
　　misstatement that exists and that could be material, either individually or when
　　aggregated with other misstatements.’
　　Audit risk questions require candidates to identify risks of material
　　misstatements, which include inherent and control risks as well as detection
　　risks.
　　Audit risk model
　　In all three sessions a number of candidates have wasted valuable time by
　　describing the audit risk model along with definitions of audit risk, inherent
　　risk, control and detection risk. Unless the question requirement specifically
　　asks for the ‘components of audit risk’ or ‘a description of the audit risk
　　model’， candidates should not provide definitions of audit risk, inherent risk,
　　control risk or detection risk as no marks are available.
　　Audit risk versus business risk
　　The main area where candidates continue to lose marks is that they do not
　　actually understand what audit risk relates to. Hence, they frequently provide
　　answers that consider the risks the business would face or ‘business risks’，
　　which are outside the scope of the syllabus. There are no marks available for
　　business risks.
　　Business risks are defined as ‘a risk resulting from significant conditions,
　　events, circumstances, actions or inactions that could adversely affect an
　　entity’s ability to achieve its objectives and execute its strategies, or from the
　　setting of inappropriate objectives and strategies’。
　　Risks must be related to the risk arising in the audit of the financial statements
　　and should include the financial statement assertion impacted. Therefore,
　　audit risks should be related back to relevant assertions.