Audit risk (also referred to as residual risk) as per ISA 200 refers to the risk that the auditor expresses an inappropriate opinion when the financial statements are materiality misstated. This risk is composed of:

• Inherent risk (IR), the risk involved in the nature of business or transaction. Example, transactions involving exchange of cash may have higher IR than transactions involving settlement by cheques. The term inherent risk may have other definitions in other contexts.;^[1]
• Control risk (CR), the risk that a misstatement may not be prevented or detected and corrected due to weakness in the entity's internal control mechanism. Example, control risk assessment may be higher in an entity where separation of duties is not well defined; and
• Detection risk (DR), the probability that the auditing procedures may fail to detect existence of a material error or fraud. Detection risk may be due to sampling error or non-sampling error.^[2]

Audit risk can be calculated as:

AR = IR × CR × DR^{[clarification needed]}