Inheren is an adjective meaning attached to or an inseparable part of something — in English it is called inherent. In audit, this term most often appears in the phrase “risiko inheren” (inherent risk), which will be discussed in full in this article.
Inherent risk reflects the level of vulnerability of a financial statement to error or fraud prior to the existence of internal controls.
In the world of auditing, risk is one aspect that must be carefully taken into account. One of the main types of risk in an audit is inherent risk.
This risk is inherent in an audit object before internal controls or other mitigation measures are in place. Understanding inherent risk is essential to help auditors assess the overall risk level of a process or company. auditor in assessing the overall level of risk of a process or enterprise.
In this article, we will discuss in depth about inherent risk, starting from its definition, examples, ways of measuring, to the difference with residual risk.
What is inherent risk?
Inherent risk is the possibility of error or fraud in a financial statement or system prior to the existence of internal controls or other mitigation measures. This risk can arise due to external or internal factors that affect the business or audit process.
Some factors that can increase this risk in audits include:
- Transaction complexity – The more complex the financial transactions of an enterprise, the greater its inherent risk.
- Regulatory changes - Changes in accounting or taxation rules may increase this risk.
- Technology and Information Systems – IT System that are less secure or outdated can lead to higher risks.
- Human factor - Human error or even malicious intent in financial reporting can increase this risk.
Examples of inherent risks in auditing
To understand more deeply, here are some examples of these risks in auditing:
- Companies with complex derivative transactions
Companies that frequently transact with complex financial instruments such as derivatives have a high inherent risk due to the possibility of listing errors or difficult valuations. - Industries with high regulatory change
For example, companies in the financial or insurance sectors often face regulatory changes that could increase these risks in their financial reporting. - Lack of employee experience in accounting
If the staff in charge of the bookkeeping lacks a solid understanding of accounting, the risk will be higher due to the possibility of errors in the recording of transactions.
How is inherent risk measured?
Measuring this risk is not an easy task, but there are several commonly used approaches:
1. Qualitative Analysis
- The Auditor assesses risk based on experience, industry insight, and understanding of the client's operations.
- Example: assess whether the company has a history of financial statement errors in the past.
2. Quantitative Analysis
- Using historical data to measure the probability of error or fraud.
- Example: calculate the error ratio in the financial statements of previous years.
3. Risk-Based Approach (Risk-Based Approach)
- Auditors allocate more resources to areas with higher levels of risk.
- Example: a company that experiences frequent audits with material findings will get more attention in the audit process.
See also: Audit Risk: definition, types, examples and how to determine
How Do You Calculate Detection Risk from Inherent Risk (Practice Problem)?
The following practice problems use the audit risk model as a conceptual aid, not as a requirement in auditing standards. The formula is: DR = AR ÷ (IR × CR). AR is acceptable audit risk, IR is inherent risk, CR is control risk, and DR is detection risk. A full explanation of the formula is in the article audit risk. All entities and figures below are fictional, for illustration only.
Problem 1: Inherent risk differs for each account
PT Contoh Sentosa sets AR at 5%. Control risk is set equal at 50% for all accounts. Inherent risk is assessed at 30% for cash, 70% for inventory, and 90% for revenue. Calculate the DR for each account.
Solution. Step one, multiply IR by CR. Step two, divide AR by that product.
| Account | IR | CR | IR × CR | DR = 5% ÷ (IR × CR) |
|---|---|---|---|---|
| What | 30% | 50% | 15% | 33,3% |
| Preparation | 70% | 50% | 35% | 14,3% |
| Revenue | 90% | 50% | 45% | 11,1% |
Check: 15% × 33.3% = 5%, 35% × 14.3% = 5%, and 45% × 11.1% = 5%. The higher the inherent risk, the smaller the acceptable detection risk. This means substantive procedures on revenue must be broader than on cash.
Problem 2: What is the maximum control risk?
For the allowance for doubtful receivables account at PT Contoh Makmur, the auditor has no basis to assess IR below 100% because the estimate is subjective. With AR of 5%, the team can only bear a DR of at most 20%. What is the maximum CR for the target to be achieved?
Solution.
- Find the maximum product of IR × CR: 5% ÷ 20% = 25%.
- Since IR = 100%, then CR = 25% ÷ 100% = 25%.
- Check: 100% × 25% × 20% = 5%.
In conclusion, controls over the estimate must be tested and proven effective so that CR is no more than 25%. If testing only supports a CR of 50%, DR must fall to 5% ÷ (100% × 50%) = 10%. Learn how it is assessed in the control risk article.
Examples of inherent risk per account
Under SA 315 (Revised 2021), inherent risk is assessed on a spectrum by considering the factors of complexity, subjectivity, change, uncertainty, and susceptibility to management bias or other fraud risk factors. The table below summarizes this for four common accounts. The risk level is only a tendency and still depends on the entity's conditions.
| Account | Assertions at risk | Inherent risk factors | IR tendency |
|---|---|---|---|
| What | Existence, completeness | Easily misappropriated, high transaction volume | Low to medium |
| Preparation | Existence, valuation | Many locations, obsolete or slow-moving goods, complex physical counts | Medium to high |
| Revenue | Occurrence, cutoff | Pressure to meet targets, complex revenue recognition, fraud risk presumed to exist (SA 240) | High |
| Accounting estimates, for example the allowance for doubtful receivables | Valuation and allocation | Subjectivity, estimation uncertainty, management bias | High |
Do auditing standards require the formula AR = IR × CR × DR?
No. This formula is a conceptual aid. SA 200 states that the assessment of the risk of material misstatement may be expressed in percentage terms or in non-quantitative terms. What is required is an adequate risk assessment and an appropriate audit response, not a specific number.
What Is the Difference Between Inherent Risk and Residual Risk?
Many people often confuse the term inherent risks and residual risk. Here are the differences:
| Aspect | Inherent Risks | Residual Risk |
|---|---|---|
| Definition | Risks that existed before the existence of internal control | Remaining risk after the implementation of internal controls |
| Causes | Natural factors in business, transaction complexity, regulation | Weakness or ineffectiveness of internal control |
| Impact | May cause errors or fraud before mitigation | Errors or fraud that are still possible after mitigation |
| Example of | Error recording of complex derivative transactions | Errors that occur even though the company has a rechecking system |
In auditing, the main purpose of internal control is to suppress inherent risk so that only minimal residual risk remains.
See also: Risk management: definition, objectives and stages
FAQ About Inherent Risk
What does inheren mean?
Inheren is an adjective meaning attached to or an inseparable part of something — its English equivalent is inherent. In audit, this term is most often used in the phrase “risiko inheren” to refer to a risk attached to an object before any internal control exists.
What is inherent risk?
Inherent risk is the possibility of error or fraud occurring in a set of financial statements or a system before internal control or other mitigating action is in place. The risk is attached to the audit object and can arise from internal or external factors.
What factors increase inherent risk?
Four factors: the complexity of financial transactions, changes in accounting or tax regulation, information technology systems that are insecure or out of date, and the human factor in the form of error or bad intent in financial reporting.
What are examples of inherent risk in auditing?
Companies that frequently transact in complex financial instruments such as derivatives, companies in sectors with frequent regulatory change such as finance and insurance, and organisations whose bookkeeping staff lack a strong grasp of accounting.
How is inherent risk measured?
Three approaches: qualitative analysis based on the auditor's experience and industry insight, quantitative analysis using historical data to measure the probability of error, and a risk-based approach that allocates more resources to high-risk areas.
What is the difference between inherent risk and residual risk?
Inherent risk is the risk that exists before internal control is applied, stemming from natural business factors such as transaction complexity and regulation. Residual risk is what remains once internal control is in place, usually as a result of weakness or ineffectiveness in that control.
What role does internal control play in relation to inherent risk?
The main purpose of internal control in an audit is to reduce inherent risk so that only a minimal level of residual risk remains.
Need a more accurate Audit solution?
Inherent risk is an important element in an audit that reflects the level of vulnerability of a financial statement to errors or fraud before the existence of internal controls.
The Auditor must understand the factors that affect inherent risk, how to measure it, and distinguish it from residual risk in order to provide more accurate recommendations in the audit process.
By understanding these risk concepts, companies can be more proactive in identifying and managing these risks early on, thus minimizing the possibility of errors or fraud occurring in their financial statements.
If you want to improve audit effectiveness and manage risk better, Audithink comes with a technology-based internal audit solution. Contact us via Audithink for more information!
