Audit Risk

Audit risk is the risk that the financial statements are materially incorrect, even though the audit opinion states that the financial reports are free of any material misstatements. Because creditors, investors, and other stakeholders rely on the financial statements, audit risk may carry legal liability for a CPA firm performing audit work.

An auditor provides a written opinion as to whether the financial statements are free of material misstatement. An audit requires a CPA firm to make inquiries and perform test work on the financial statements. Auditing firms carry malpractice insurance to manage audit risk and the potential legal liability.

Large public companies typically engage one of the Big Four accounting firms – PricewaterhouseCoopers, KPMG, Ernst & Young, or Deloitte Touche Tohmatsu – to perform an audit. Many companies hire staff to perform internal audits, and external audit firms may rely on some of the internal work performed. The Big Four was previously the Big Five, but Arthur Andersen lost the ability to perform audit work after being indicted on counts of obstruction of justice for its role in the Enron scandal. According to a 2008 Government Accountability Office (GAO) report, the Big Four firms audit 98% of U.S. companies with annual revenues over $1 billion. Smaller companies are more likely to engage a mid-range firm, such as Grant Thornton.

The two components of audit risk are the risk of material misstatement and detection risk. Assume, for example, that a large sporting goods store needs an audit performed, and that a CPA firm is assessing the risk of auditing the store's inventory. The risk of material misstatement is the risk that the financial reports are materially incorrect before the audit is performed. In this case, the word "material" refers to a dollar amount that is large enough to change the opinion of a financial statement reader, and the percentage or dollar amount is subjective. If the sporting goods store's inventory balance of $1 million is incorrect by $100,000, a stakeholder reading the financial statements may consider that a material amount.

Detection risk is the risk that the auditor’s procedures do not detect a material misstatement. For example, an auditor needs to perform a physical count of inventory and compare the results to the accounting records, and this work is performed to prove the existence of inventory. If the auditor's inventory count procedures are weak, the detection risk is higher.