## Components of ROMM: Inherent Risk & Control Risk

ROMM = Inherent Risk (IR) × Control Risk (CR)

Both are entity-level risks — they exist independent of the audit and can only be influenced by the client, not by the auditor.

---

### Inherent Risk (IR)

Definition: The susceptibility of an assertion (related to an account balance, class of transactions, or disclosure) to a misstatement that could be material — before considering any related internal controls.

Inherent Risk arises due to:

Nature of the Business (e.g., complex industry)
Nature of the Assertion (e.g., estimates involve judgment)

> Inherent Risk may be higher for some assertions than others.

#### Factors that Increase Inherent Risk:

Factor	Reason
Complex accounting standards	More scope for error or manipulation
Industry in decline/failure	Business pressures increase fraud risk
Startup companies	Lack of established processes, revenue recognition risk
Complex calculations	Higher probability of computational error
Accounting estimates	Subjective judgment — e.g., provisions, depreciation

#### Examples:

Revenue area in a startup (high judgment, pressure to show growth)
Complex financial instruments (derivatives valuation)
Goodwill impairment testing

---

### Control Risk (CR)

Definition: The risk that a material misstatement that could occur in an assertion will not be prevented, detected, or corrected on a timely basis by the entity's Internal Control system.

#### Key Relationships:

Internal Control Efficiency	Control Risk
Strong/Efficient IC	Low CR
Weak/Absent IC	High CR

> Inverse relationship: Better internal controls → Lower Control Risk

#### Examples of High Control Risk:

Unauthorised access to cash (no segregation of duties)
Petty cash limits (e.g., ₹10,000) not adhered to
No authorization required for journal entries
Absence of bank reconciliation

---

### Important Note: Both IR & CR are Entity Risks

They exist independent of the audit
They can only be influenced by the client through improvements to operations and controls
The auditor cannot change IR or CR — only Detection Risk
IR and CR together constitute ROMM

$$\text{ROMM} = \text{IR} \times \text{CR}$$

Worked example

### Example 1

Inherent Risk Example:

A pharmaceutical company has significant R&D costs that must be assessed for capitalization vs. expense under Ind AS 38. The accounting standard requires complex judgment. This assertion (valuation/classification of R&D) has HIGH Inherent Risk because the standard is complex and requires significant estimates — entirely independent of whether the company has good controls.

### Example 2

Control Risk Example:

Retail company ABC has no daily cash register reconciliation. The cashier also maintains the cash book. With no segregation of duties and no reconciliation, cash misappropriation could occur and go undetected for months. This represents HIGH Control Risk. If the company implements daily third-party reconciliation and segregates the cashier and bookkeeper roles, Control Risk decreases.

### Example 3

Combined Example:

An entity with high revenue pressure (high IR on revenue assertion) also has no proper segregation between the sales team and accounts team (high CR). Together, ROMM on revenue is very high. The auditor must compensate with a very low Detection Risk — e.g., 100% vouching of large sales transactions, circularization of debtors, and cut-off testing.

⚠️ Common exam mistakes

Thinking the auditor can reduce Inherent Risk by doing more audit work — IR is set by the nature of the business and assertions, not by audit effort.
Confusing Control Risk with the auditor's assessment of controls — CR is the actual risk that controls fail; the auditor assesses it but cannot change it.
Thinking low IR means low audit effort needed — even if IR is low, if CR is high, ROMM can still be significant.
Forgetting that both IR and CR are entity risks existing independent of the audit.

Reference: SA 315 — SA 315 (Revised) – Identifying and Assessing the Risks of Material Misstatement

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →

Components of ROMM – Inherent Risk & Control Risk

Worked example

⚠️ Common exam mistakes