What is the difference between Audit Risk ,Control Risk and Financial Statement Risk?

Audit risk is the risk that the auditor fails to express an appropriate opinion on the financial statements. Audit risk comprises of inherent, control and detection risk.

Control risk means the risk of inefficiency of entity's controls to identify material misstatements in the financial statements

Inherent risk or sometimes known as financial statement risk is the risk of material misstatements in the financial statements due to errors or omissions.

Many people in risk management use this simple formula to explain the difference between Internal Audit and Internal Control: Internal Audit is a function, while Internal Control is a system. Internal audits are performed at specific times to assess: 1) if the company has a good understanding of the risks that it faces, and 2) if the controls put in place to mitigate risks are effective. There is one very important distinction to be made: it is not the job of internal auditors to identify risks, nor to specify the controls that are needed. Internal Audit evaluates whether the process leading to the identification of risks is working well, checks whether controls already in place are working according to the way they are intended to, and evaluates an organization’s governance system and process

Audit risk:

Is the risk that an auditor issues an incorrect opinion on the financial statements.

Examples of inappropriate audit opinions include the following:

Issuing an unqualified audit report where a qualification is reasonably justified;

Issuing a qualified audit opinion where no qualification is necessary;

Failing to emphasize a significant matter in the audit report;    

Providing an opinion on financial statements where no such opinion may be reasonably given due to a significant limitation of scope in the performance of the audit.

Control Risk:Control Risk is the risk of a material misstatement in the financial statements arising due to absence or failure in the operation of relevant controls of the entity.Organizations must have adequate internal controls in place to prevent and detect instances of fraud and error.Control risk is considered to be high where the audit entity does not have adequate internal controls to prevent and detect instances of fraud and error in the financial statements.Assessment of control risk may be higher for example in case of a small sized entity in which segregation of duties is not well defined and the financial statements are prepared by individuals who do not have the necessary technical knowledge of accounting and finance.

Financial statement risk:Risk that the auditors fail to detect a material misstatement in the financial statements.An auditor must apply audit procedures to detect material misstatements in the financial statements whether due to fraud or error.Misapplication or omission of critical audit procedures may result in a material misstatement remaining undetected by the auditor.Some detection risk is always present due to the inherent limitations of the audit such as the use of sampling for the selection of transactions.

Audit risk is the risk that an auditor issues an incorrect opinion on the financial statements.

Control risk is the risk of absence or failure of relevant controls of the entity.

Financial statement risk is the risk that the auditors fail to detect a material misstatement in the financial statements.