The audit risk model helps auditors understand and manage the risk of giving an incorrect audit opinion. The formula is: Audit Risk (AR) = Inherent Risk (IR) × Control Risk (CR) × Detection Risk (DR). This model allows auditors to plan how much testing is required and where to focus efforts. Audit sampling directly affects Detection Risk (DR)—the risk that errors or fraud will not be detected by audit procedures.

Consider an internal audit of the accounts payable process. Suppose the auditor estimates Inherent Risk (IR) at 0.8 (80%) due to complex vendor relationships, and Control Risk (CR) at 0.6 (60%) because of weak approval controls. To keep overall Audit Risk (AR) at an acceptable level—say 5% (0.05)—the auditor must calculate the maximum acceptable Detection Risk (DR) using the formula:

This means the Detection Risk must be 10.4% or lower. To achieve this, the auditor uses a larger, more carefully selected audit sample to reduce the chance of missing errors. For example, instead of reviewing 20 invoices, the auditor may increase the sample size to 50 and apply stricter testing criteria.

This numeric approach shows how audit sampling supports risk management within the audit risk model. By adjusting the extent and nature of sampling, auditors maintain low overall audit risk while working efficiently.