Understand risk scores
Risk scoring helps you prioritize which transactions or balances need the most attention during an audit. This topic explains how scores are calculated, how items are segmented, and how to align your approach with PPC methodology.
How risk scores are calculated
Risk Identification Techniques (RITs) are what calculate the risk score.
Binary RITs, which are all except Isolation Forest, calculate as follows:
- Each RIT evaluates to 0 or 1.
- If the transaction meets the criteria, it scores a 1.
- If the transaction doesn't meet the criteria, it scores a 0.
- When a transaction triggers multiple RITs, those scores are added together to produce a cumulative risk score.
Isolation Forest (AI/ML RIT) calculates as follows:
- It generates a continuous score between 0.00 and 1.00.
- Any transaction that scores 0.60 or more triggers this RIT.
- It adds decimal precision to risk scores, like 2.64 or 3.71.
Balance and Transaction-Level scoring
The
Transaction Level
is when each transaction receives its own risk score and is evaluated independently.The
Balance Level
is when the risk scores from all transactions associated with the balance are added together. The cumulative score is assigned to the balance. We recommend this for AR/AP testing.The 4 base segments
Once risk scoring runs, every item in your population falls into 1 of 4 base segments. Here is what each segment means and how it's handled:
Segment | Definition | Testing Approach |
|---|---|---|
Significant Items | Items that exceed the significant amount threshold you have defined. | Test 100% of items. No sampling. Risk scoring doesn't apply. |
Unusual Items | Items that meet RIT criteria with the unusual item switch enabled and exceed the specified threshold. | Test 100% of items. No sampling. No risk score is assigned. |
Risk Score greater than 0 | Items that triggered greater than or equal to 1 RIT. Contains all items with non-zero risk scores. This is the primary segment for sub-segmentation. | Subject to risk-based testing and further sub-segmentation. |
Risk Score equal to 0 | Items that triggered no RITs. These are presumed to be the lowest risk in the population. | It can still be tested based on auditor judgment. |
Risk score weighting
You can adjust the impact of individual RITs by applying a weighting modifier. The 3 modifier levels work as follows:
- Normal-risk score = 1 and no change is made.
- High-risk score = 1.5, which adds a 0.5 modifier.
- Low-risk score = 0.5, which reduces it by 0.5.
Sub-segmentation strategy and recommendations
Sub-segmentation lets you break the risk score greater than 0 segment into smaller, more focused groups so you can concentrate testing effort where risk is greatest. Recommendations to keep in mind:
- Divide into thirds (Low/Moderate/High).
- Use risk score distribution to identify natural clusters.
- Smaller, higher-risk segments support more focused testing.
PPC risk assessment alignment
The PPC methodology uses percentage-based thresholds to classify risk levels:
Risk Level | Percentage Range |
|---|---|
High | Greater than 50% |
Moderate | 34% – 50% |
Low | 0% – 33% |
note
This is guidance only. Auditors should apply professional judgment and adjust thresholds as the engagement requires. This approach is consistent with
SAS 142 (AU-C 500.A68)
.