Case 2.1 Jack Greenberg, Inc. 121
of the effectiveness of the design and operation of internal control.
•Detection risk: the risk that the procedures performed by the auditor will not detect a misstatement
that exists and that could be material, individually or in combination with other misstatements.
Detection risk is affected by (1) the effectiveness of the substantive procedures and (2) their
application by the auditor, i.e., whether the procedures were performed with due professional care.
•Inherent risk: the susceptibility of an assertion about a class of transaction, account balance, or
disclosure to a misstatement that could be material, either individually or when aggregated with
other misstatements, before consideration of any related controls.
•Control risk: the risk that a misstatement that could occur in an assertion about a class of
transaction, account balance, or disclosure and that could be material, either individually or when
(Note: Both PCAOB AS No. 8 and the AICPA Professional Standards point out that the product of
inherent risk and control risk is commonly referred to as the “risk of material misstatement.)
Listed next are some examples of audit risk factors that are not unique to family-owned
businesses but likely common to them.
Inherent risk:
•I would suggest that family-owned businesses may be more inclined to petty infighting and
other interpersonal “issues” than businesses overseen by professional management teams. Such
Control risk:
•The potential for “petty infighting” and other interpersonal problems within family-owned
businesses may result in their internal control policies and procedures being intentionally
subverted by malcontents.