Skip to main content
Analyze

Understand risk scores

Risk scoring helps you prioritize which transactions or balances need the most attention during an audit. This topic explains how scores are calculated, how items are segmented, and how to align your approach with PPC methodology.

How risk scores are calculated

Risk Identification Techniques (RITs) are what calculate the risk score.
Binary RITs, which are all except Isolation Forest, calculate as follows:
  • Each RIT evaluates to 0 or 1.
  • If the transaction meets the criteria, it scores a 1.
  • If the transaction doesn't meet the criteria, it scores a 0.
  • When a transaction triggers multiple RITs, those scores are added together to produce a cumulative risk score.
Isolation Forest (AI/ML RIT) calculates as follows:
  • It generates a continuous score between 0.00 and 1.00.
  • Any transaction that scores 0.60 or more triggers this RIT.
  • It adds decimal precision to risk scores, like 2.64 or 3.71.

Balance and Transaction-Level scoring

The
Transaction Level
 is when each transaction receives its own risk score and is evaluated independently.
The
Balance Level
 is when the risk scores from all transactions associated with the balance are added together. The cumulative score is assigned to the balance. We recommend this for AR/AP testing.

The 4 base segments

Once risk scoring runs, every item in your population falls into 1 of 4 base segments. Here is what each segment means and how it's handled:
Segment
Definition
Testing Approach
Significant Items
Items that exceed the significant amount threshold you have defined.
Test 100% of items. No sampling. Risk scoring doesn't apply.
Unusual Items
Items that meet RIT criteria with the unusual item switch enabled and exceed the specified threshold.
Test 100% of items. No sampling. No risk score is assigned.
Risk Score greater than 0
Items that triggered greater than or equal to 1 RIT. Contains all items with non-zero risk scores. This is the primary segment for sub-segmentation.
Subject to risk-based testing and further sub-segmentation.
Risk Score equal to 0
Items that triggered no RITs. These are presumed to be the lowest risk in the population.
It can still be tested based on auditor judgment.

Risk score weighting

You can adjust the impact of individual RITs by applying a weighting modifier. The 3 modifier levels work as follows:
  1. Normal-risk score = 1 and no change is made.
  2. High-risk score = 1.5, which adds a 0.5 modifier.
  3. Low-risk score = 0.5, which reduces it by 0.5.

Sub-segmentation strategy and recommendations

Sub-segmentation lets you break the risk score greater than 0 segment into smaller, more focused groups so you can concentrate testing effort where risk is greatest. Recommendations to keep in mind:
  • Divide into thirds (Low/Moderate/High).
  • Use risk score distribution to identify natural clusters.
  • Smaller, higher-risk segments support more focused testing.

PPC risk assessment alignment

The PPC methodology uses percentage-based thresholds to classify risk levels:
Risk Level
Percentage Range
High
Greater than 50%
Moderate
34% – 50%
Low
0% – 33%
note
This is guidance only. Auditors should apply professional judgment and adjust thresholds as the engagement requires. This approach is consistent with
SAS 142 (AU-C 500.A68)
.

This article applies to:

  • Product: audit-intelligence
  • Sub-Product: ai-analyze