What Is the Risk of Incorrect Acceptance in Auditing?

The risk of incorrect acceptance in auditing is the chance that a sample supports the conclusion that a recorded account balance is not materially misstated when it actually is. PCAOB AS 2315 defines it in exactly those terms.¹ In statistical language it is a Type II error, and it is the sampling risk auditors treat as most dangerous because it goes directly to whether the audit worked at all.

Auditors rarely test every transaction in a population. They pull a sample, evaluate it, and extrapolate. When the sample happens to look clean even though the broader population contains errors large enough to make the financial statements misleading, the auditor is likely to issue an unqualified opinion telling investors and regulators the statements are reliable when they are not. Nothing in the sample flagged a problem, so nothing prompts a second look. The errors persist, the opinion stands, and stakeholders make decisions on numbers that are materially wrong.

How It Differs From the Risk of Incorrect Rejection

Sampling risk runs in two directions, and the pair is worth keeping straight.

Risk of incorrect acceptance (Type II): the sample suggests the balance is fine when it is not. This threatens audit effectiveness.
Risk of incorrect rejection (Type I): the sample suggests the balance is materially misstated when it is actually correct. This threatens audit efficiency.

Both come from the same root cause: a sample that does not perfectly mirror the population it was drawn from. But the consequences diverge. Incorrect rejection leads to extra work and wasted hours; the auditor eventually discovers through expanded testing that the balance was accurate all along. Incorrect acceptance lets flawed financial statements reach the public without correction. That asymmetry is why professional standards treat incorrect acceptance as the more serious outcome and why most sampling planning is aimed at keeping it low.¹

What Drives the Level of Risk

Several interrelated variables determine how likely an auditor is to incorrectly accept a flawed balance. Most of them are set during planning, and adjusting one ripples through the rest.

Sample Size

The most direct lever is the number of items tested. Sampling risk varies inversely with sample size, so a larger sample reduces the chance that the selected items happen to be unrepresentative of the whole.¹ Lowering the acceptable risk of incorrect acceptance pushes the required sample size up.

Tolerable Misstatement

Tolerable misstatement is the maximum dollar amount of error an auditor can accept in a particular account without concluding the financial statements are materially misstated. PCAOB AS 2105 requires it to be set below the overall materiality level for the financial statements.² The standard prescribes no fixed formula; the auditor uses professional judgment, informed in part by the nature and amount of misstatements found in prior audits.

A smaller tolerable misstatement leaves less room for error, so a larger sample is needed to reach the same level of confidence.¹ An auditor willing to tolerate up to $200,000 in misstatement can work with a smaller sample than one who sets the threshold at $50,000.

Expected Misstatement

If prior audits or preliminary analytical procedures suggest a higher frequency of errors, the auditor adjusts upward. An account with a history of $50,000 in annual discrepancies demands tighter testing parameters than one where prior errors totaled $5,000. Higher expected misstatement narrows the gap between what the auditor anticipates finding and what would trigger a material conclusion, so the sample must be large enough to distinguish real problems from noise.

Desired Level of Assurance

Some auditors think about incorrect acceptance in quantitative terms. A footnote in AS 2315 notes that an auditor might target a 5 percent risk of incorrect acceptance for a substantive test of details, corresponding to a 95 percent confidence level that the balance is not materially misstated.¹ The standard cautions, however, that risk levels used in other statistical fields are not automatically appropriate for auditing, because an audit draws on many interrelated tests and sources of evidence.

Sampling Risk Is Not the Same as Non-Sampling Risk

Not every audit error comes from drawing a bad sample, and treating the two as one leads to the wrong corrective action.

Sampling risk is the chance that a properly executed test produces a misleading result simply because the selected items do not mirror the full population. It can be measured, and it shrinks predictably as sample size grows. Non-sampling risk covers everything else that can go wrong: choosing the wrong procedure for the situation, making a computational error when building a confidence interval, or accidentally skipping a sample item during fieldwork. These do not shrink with a bigger sample. They require better training, supervision, and quality control. An auditor who sends negative confirmations to a high-risk subset of receivables has a methodology problem, not a sample-size problem.

Where It Fits in the Audit Risk Model

The risk of incorrect acceptance does not sit on its own. It is one piece of a broader model that determines whether an audit will catch a material misstatement.

PCAOB AS 1101 defines audit risk as a function of the risk of material misstatement and detection risk.³ The risk of material misstatement itself reflects inherent risk (how susceptible an account is to error given the nature of the transactions) and control risk (how likely the company’s internal controls are to fail to prevent or catch such errors). Detection risk is the piece the auditor controls through the nature, timing, and extent of procedures. The risk of incorrect acceptance is the sampling component of detection risk.

The logic works like a seesaw. When the risk of material misstatement is high, say a company with complex revenue arrangements and weak internal oversight, the auditor must push detection risk down to keep overall audit risk acceptably low. That means allowing a lower risk of incorrect acceptance, which in practice means testing more items. When inherent and control risks are both assessed at maximum and no other substantive procedures target the same assertion, the auditor needs a large sample and tight parameters.¹ The opposite also holds. A company with strong, well-tested internal controls and straightforward transactions gives the auditor room to accept a higher risk of incorrect acceptance because other layers of assurance are already reducing overall audit risk.

What Happens When Incorrect Acceptance Produces a Wrong Opinion

An auditor who incorrectly accepts a materially misstated balance will typically issue an unqualified opinion, telling the public the financial statements are fairly presented. If the underlying errors later surface through restatements, regulatory review, or whistleblowers, the consequences for the audit firm can be severe.

Regulatory Enforcement

The PCAOB has authority under the Sarbanes-Oxley Act to impose sanctions on registered firms and individual auditors for deficient work. The SEC can also pursue enforcement actions under Rule 102(e) of its Rules of Practice, which allows the commission to restrict or bar accountants from appearing and practicing before it.⁴ Penalties in recent cases have included millions of dollars in combined civil penalties and disgorgement, plus restrictions on accepting new audit clients.⁵ Private litigation from shareholders adds another layer of financial exposure when investors can show the auditor failed to follow professional standards.

Peer Review and Licensing

Sampling failures can also surface during the peer review process that most states require for firms performing attest work. A firm that receives a “pass with deficiencies” or “fail” rating may face escalating consequences from its state board of accountancy, ranging from monitoring and warning letters to referral to the board’s enforcement arm. Two consecutive “fail” ratings can trigger requirements like pre-issuance review of all attest work, accelerated peer reviews, mandatory additional continuing education, and in the most serious cases, termination from the peer review program, which effectively strips the firm of its authority to perform audits.⁶

1
Public Company Accounting Oversight Board. AS 2315 – Audit Sampling
2
Public Company Accounting Oversight Board. AS 2105 – Consideration of Materiality in Planning and Performing an Audit
3
Public Company Accounting Oversight Board. AS 1101 – Audit Risk
4
U.S. Securities and Exchange Commission. SEC Charges Audit Firm Marcum LLP for Widespread Quality Control Failures
5
U.S. Securities and Exchange Commission. Audit Firm Prager Metis Settles SEC Charges for Negligence in FTX Audits and for Violating Auditor Independence Requirements
6
National Association of State Boards of Accountancy. Best Practices for Deficient Peer Review Reports and Monitoring of Firm Compliance