Control Risk
Double-click to edit...
Kyle Ashcraft, CPA · 2019 CPA Exam Scores · 95 FAR · 98 BEC · 91 REG · 90 AUD
Control risk is one of three components of the audit risk model, and a well-tested concept on the AUD section of the CPA exam.
What is control risk?
Control risk is the risk that a material misstatement won't be prevented or detected on a timely basis by a company's own internal control system. Auditors evaluate control risk to gauge how much they can rely on those controls during the audit — the weaker the controls, the less an auditor can lean on them.
What contributes to control risk?
- Inadequate design — poorly designed controls can fail to catch errors or fraud
- Implementation flaws — even a well-designed control can fail if it isn't carried out properly
- Human error or override — control risk rises when employees can easily bypass or override controls
Example: You're auditing a small but fast-growing tech startup. It has some basic controls in place, but rapid growth has created inconsistencies and gaps — including one person who both approves expenditures and has authority to make payments, a segregation-of-duties issue. Your assessment would likely conclude control risk is high, which calls for more extensive substantive procedures.
Control risk assessment drives how much substantive testing an auditor needs to do. The weaker a company's internal controls, the higher the control risk, and the more direct evidence the auditor has to gather to compensate.
Want the full AUD framework?
My free CPA 101 course covers the study approach I used to score 90+ on every CPA exam section.
More on audit risk
Kyle Ashcraft, CPA scored 90 or above on every section of the CPA exam in 2019, including a 90 on AUD. He is the founder and sole instructor of Maxwell CPA Review, a complete CPA review course covering all six sections, where he creates every lecture, textbook and study outline himself.
