Audit Risk and Relationship

This post is in relation to a question asked by a reader

Question:

Jez4christ has left a new comment on your post "Audit Risk Assessment – Risk Types & Relationships...":

Hi,

I am reading your blog to prepare for the CISA exam in addition to the CRM.

Have a question: you mentioned "Inherent Risk × Control Risk = Residual Risk
".

How does the "x"- "multiply by" be explained?

Am still stuck in the "Residual risk = Total Risk - Responses to Risks"

Thanks,
James Tan



Answer:

I. Your First Doubt

you mentioned "Inherent Risk × Control Risk = Residual Risk
".

How does the "x"- "multiply by" be explained?

A good observation!

Before Explaining relationship between Inherent Risk,Control Risk and Residual Risk let us once more see what these terms denote.

Inherent risk =1

is the default risk linked to the area of audit. In other words Inherent risk is the risk naturally related to the business area of audit subject.

Control Risk =2

is the risk originated because of errors or irregularities in the audit subject may not be detected, prevented or corrected by existing internal control.

Now the question is what should be the residual risk.

Is it 1 less 2 ?

No, but if you have to take X as minus sign then my explanation for residual risk will be :

The risk linked to the audit area (i) , less the amount of error detected by controls(ii) =
The amount of error likely to remain unnoticed(iii).

Here i is Inherent Risk & iii is Residual Risk

Now my question would be

if 2=(ii) ?

&

is ii= control risk?

II. Your second doubt

Am still stuck in the "Residual risk = Total Risk - Responses to Risks"

the quantity left over at the end of audit process i.e. the remainder is the residual risk.
Explanation for I will answer here as well.

Remember Exam like CISA may not ask the formula but understanding the concept is very much recommended.

Add Post To: | Digg| Technorati| del.icio.us| Stumbleupon| Reddit| BlinkList| Furl| Spurl| Yahoo| Simpy|