Auditing Basics: Audit Risk, Control Risk, and Detection Risk
by Joseph Kirkpatrick / May 17th, 2019
What Types of Risk Impact SOC 1 and SOC 2 Audits?
SOC 1 and SOC 2 audits are largely impacted by various types of risk. During a SOC 1 and SOC 2 audit, an auditor will be focused on limiting the following types of risk: audit risk, control risk, and detection risk.
So, how are those risks different? How to they affect an auditor while performing SOC 1 or SOC 2 audits? Let’s discuss.
What is Audit Risk?
According to the AICPA, audit risk is “the risk that the auditor expresses an inappropriate audit opinion when financial statements are materially misstated. Audit risk is a function of the risks of material misstatement and detection risk.”
Essentially, audit risk includes the risk that an auditor did not perform their due diligence when assessing an organization’s compliance with the SOC 1 or SOC 2 frameworks, which might include failing to test something, missing a critical piece of evidence, or something else in the audit was incorrect. Audit risk ultimately refers to the risk that an CPA firm issues an inaccurate opinion of an organization’s internal controls.
What is Control Risk?
During SOC 1 and SOC 2 audits, control risks represent the chances that your controls are not operating effectively or that the failure of a control could lead to material misstatement in financial statements. Control risk takes into account the potential of error from both humans and automated processes. Why? Because humans are inherently inclined to make mistakes, and no automated process is completely error-free.
Although there is always some level of risk, throughout the assessment process, an auditor will work to mitigate control risks as much as possible by designing tests to obtain reasonable assurance that the controls are operating effectively and that their audit opinion is going to be accurate and based on good results.
What is Detection Risk?
In order for auditing to be effective, an auditor must be able to detect misstatements throughout the assessment. Considering this, detection risk is the risk that an auditor will fail to detect something that’s in existence. An auditor can reduce the level of detection risk by designing tests of policies and procedures and applying sampling to help give reasonable assurance that a control is in place and operating effectively.
The Importance of Proper Risk Management & SOC Audits
Each of these risk types must be accounted for in a risk management program that identifies possible threats, assesses existing controls, and documents potential risks so that an organization’s policies and procedures can address them.
High-level risk management best practices are similar for all risk types, but clients need to understand the risks auditors are considering, how they design tests to improve risk detection, and how they work to control and mitigate potential sources of risk.
[av_toggle_container initial=’1′ mode=’accordion’ sort=” styling=” colors=” font_color=” background_color=” border_color=” custom_class=”]
[av_toggle title=’Video Transcription’ tags=”]
One of the things that I really believe is important for our clients to understand is the type of risk that our auditor is thinking about as they’re working with you on your audit engagement. We think about audit risk, control risk, and detection risk. Audit risk is the chance that something in our audit is wrong, we missed something, or we didn’t test something. In other words, our opinion that we issued is incorrect because there was something that we should have found. Obviously, we want that risk to be as low as possible, and we’re always thinking about that as we do our work. Control risk is the chance that the control we’re testing is not operating the way it’s supposed to operate. For example, controls fail and if you have a person who is responsible for monitoring a system, people fail and make mistakes. There are inherent limitations to humans doing something, so there is always a chance of a control not operating effectively. What about technology? Technology has failures and anomalies. Sometimes it’s down or it’s not able to connect or do what it’s supposed to do, so that control can fail. That’s control risk: what is the chance that this particular control won’t operate in the way that it was intended to operate? In order for us to address those levels of risk, we as auditors design tests in order to sample a good amount of systems to obtain reasonable assurance that these controls are operating effectively and that our audit opinion is going to be accurate and based on good results. We will perform more tests the higher the level of risk that the control might fail and less tests depending on the lower level of risk that the control might fail. Ultimately, it’s all about performing the audit correctly according to professional standards, because it is an opinion and validation of your controls that your clients rely upon. They rely upon your auditor to do a quality job, and you should expect and demand that as well to make sure your environment is tested as stringently as can be, so that nothing is missed, and nothing is left undone before we issue an opinion.
[/av_toggle]
[/av_toggle_container]
