Auditors' assessments of inherent and control risk in field settings

Abstract

SYNOPSIS AND INTRODUCTION: Current policy on how auditors should limit uncertainty about misstatements in auditee assertions is based on the audit risk model (AICPA 1992) that decomposes the components of audit risk as inherent risk (IR), control risk (CR), and detection risk (DR). The literature on the audit risk model has focused on a priori analyses of the model's assumptions and implications (see, e.g., Cushing and Loebbecke 1983; Kinney 1983, 1989, 1992; Leslie 1984), and auditors' risk assessments in experimental settings (see, e.g., Colbert 1988; Daniel 1988; Jiambalvo and Waller 1984; Libby et al. 1985). Absent are empirical studies that examine applications of the model in field settings. This article reports empirical evidence on auditors' IR and CR assessments in field settings by analyzing archival data drawn from the audit workpapers of KPMG Peat Marwick. As a part of audit planning, the firm requires its auditors to make and document IR and CR assessments for each assertion of each significant account.1 The assessments are made with respect to tolerable error, an algorithm-based measure of planning materiality at the assertion level.2 The data include approximately 5,000 risk