Audit Risk Model
Acceptable Audit Risk Levels
Setting acceptable audit risk per area by reliance and sensitivity.
Setting how much audit risk the engagement will accept, area by area
Acceptable audit risk is the level of uncertainty an engagement is prepared to live with after all procedures, and setting it deliberately per area is fundamental to the audit risk model under ISSAI and ISA. Areas with high user reliance or sensitivity warrant a lower acceptable risk and therefore more work. AuditPro Core records the acceptable audit risk per area against reliance and sensitivity, so the extent of testing follows a defensible logic rather than habit.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Areas calibrated
8
Low acceptable AR
5
high sensitivity
Standard acceptable AR
3
Target assurance
95%
Acceptable audit risk by area (%)
Calibration rationale
| Area | Acceptable AR % | User reliance | Assurance % |
|---|---|---|---|
| Conditional grants | 3 | High | 97 |
| Revenue | 5 | High | 95 |
| Procurement | 3 | High | 97 |
| Payroll | 8 | Moderate | 92 |
| Assets | 5 | Moderate | 95 |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
The audit risk model
Audit risk combines inherent risk, control risk and detection risk, and the auditor manages detection risk through the nature and extent of procedures. Setting an acceptable overall level per area drives how much testing is enough.
User reliance
The more users depend on a balance or disclosure, the less audit risk is tolerable there. High-reliance areas justify deeper procedures and lower acceptable risk.
Sensitivity
Some areas carry reputational or political sensitivity beyond their monetary size. Acceptable audit risk should be tightened where an error would be especially damaging regardless of amount.
Linking risk to effort
Once acceptable risk is set, the required extent of testing follows logically. This keeps effort proportionate and defensible rather than uniform across unequal areas.
How AuditPro Core Bridges the Gap
- Per-area calibration: acceptable audit risk is set for each area against documented reliance and sensitivity inputs.
- Effort linkage: the acceptable level drives the indicated extent of testing, making scoping traceable.
- Exception flagging: areas where planned procedures fall short of the acceptable level are surfaced for review.
- Audit-ready export: the rationale exports as evidence of risk-based scoping for quality review.
Key Takeaways
- Set acceptable audit risk deliberately per area, not uniformly.
- Higher user reliance demands lower acceptable audit risk.
- Sensitivity can tighten acceptable risk independent of amount.
- Acceptable risk should drive testing extent, making scoping defensible.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.