Control risk is the risk that controls do not prevent or detect material misstatements.

Control risk is the risk that controls do not prevent or detect material misstatements.

• A. The risk that controls do not prevent or detect material misstatements.
• B. The risk that management overrides controls.
• C. The risk that external auditors fail to identify misstatements.
• D. The risk that information systems fail to process data.

Answer: (A)

In the audit risk model, control risk represents the chance that internal controls will fail to prevent or detect material misstatements in the financial statements. It reflects weaknesses in how controls are designed or how they are actually operating, meaning misstatements could occur and go unnoticed despite the controls in place. This is separate from how the auditor tests the controls; it’s about whether the controls, if effective, would catch or stop errors or fraud. The governance factor that management overrides controls can raise control risk, but it’s not the definition itself. Detection risk is a separate concept, describing the risk that the auditor’s procedures don’t detect misstatements that exist. Information system failures can contribute to control failures and thus to control risk, but again, the core idea is about the controls’ ability to prevent or detect material misstatements, not a specific failure scenario. Therefore, the statement matches the standard definition of control risk.

In the audit risk model, control risk represents the chance that internal controls will fail to prevent or detect material misstatements in the financial statements. It reflects weaknesses in how controls are designed or how they are actually operating, meaning misstatements could occur and go unnoticed despite the controls in place. This is separate from how the auditor tests the controls; it’s about whether the controls, if effective, would catch or stop errors or fraud.

The governance factor that management overrides controls can raise control risk, but it’s not the definition itself. Detection risk is a separate concept, describing the risk that the auditor’s procedures don’t detect misstatements that exist. Information system failures can contribute to control failures and thus to control risk, but again, the core idea is about the controls’ ability to prevent or detect material misstatements, not a specific failure scenario. Therefore, the statement matches the standard definition of control risk.