> For the complete documentation index, see [llms.txt](https://engyon.gitbook.io/engyon/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://engyon.gitbook.io/engyon/en/how-to-guides/risks/creating-an-inherent-risk-factor.md).

# Creating an inherent risk factor

### **Related information**

If you have little experience with Engyon, we advise you to first read the information on the following pages:

* [Training module 4: Understanding the entity and its environment, identifying IRFs and review notes](/engyon/en/training/training-english/module-4-knowledge-of-the-entity-and-its-environment-identify-irfs-and-creating-review-notes.md)
* [Training module 6: Risk assessment (3-point model)](/engyon/en/training/training-english/module-6-risk-assessment-three-point-model.md) / [(Audit Risk Model)](/engyon/en/training/training-english/module-6-risk-assessment-audit-risk-model.md)

### **Creating inherent risk factors**

Inherent risk factors (IRFs) are events or conditions that naturally increase the risk of a misstatement in the financial statements, such as changes in the sector, complex regulations, weak authorization procedures for payments, or a deficient ethical corporate culture. A catalogue of common Inherent Risk Factors is included in Engyon.

{% hint style="info" %}
See NV COS 315.12f for the full definition and NV COS 315 Appendix 2 for further explanation of IRFs, the areas of cause, and examples of IRFs.
{% endhint %}

You create IRFs in Engyon by selecting relevant example IRFs in the various work steps under `Understanding the entity and its environment` and `internal control system` in the left menu under `context-specific data`, or by clicking `+ Inherent risk factor` in the `risk assessment` screen.

An inherent risk factor created in a procedure is linked to that procedure. You link the same factor to a second procedure by opening that procedure. Under <kbd>context-specific data</kbd> you will find <kbd>Detailed Description</kbd>. Hover over it and click on the pen icon (<i class="fa-pen">:pen:</i>). In <kbd>Detailed Description</kbd>, click on the factor and then on <kbd>Save</kbd>.

For each IRF, one or more characteristic(s) must be selected, consisting of:

* Complexity
* Subjectivity
* Changes
* Uncertainty
* Susceptibility to misstatement due to management bias or other fraud risk factors
* Other inherent risk factors

Additionally, areas of focus can optionally be chosen in the IRF, consisting of:

* Organisation, business and governance
* Regulation and external factors
* Financial performance measures
* Financial reporting

Finally, you indicate to which audit units the IRF applies.

{% hint style="info" %}
In newly created audits, two inherent risk factors are always already present:

* Fraudulent financial reporting due to the override of internal controls (management override, Standard 240.32).
* The presumed fraud risk factor(s) within revenue recognition (Standard 240.27). If the audit team believes that such an IRF is not applicable, set it to 'not relevant' and provide justification.
  {% endhint %}

### Elaborating inherent risk factors

After creating the IRF, you can find it in the `risk assessment` screen. To elaborate it further:

1. Click on the title of the inherent risk factor you have created.
2. First determine for the IRF whether it is relevant (that it leads to risks). If this is not the case, the risk factor can be marked as 'not relevant', after which an explanation must be given as to why this is the case. If the IRF is a fraud risk factor, the fraud triangle remains visible. You can fill it in and still mark the IRF as not relevant.

{% hint style="info" %}
By clicking on `Uncovered risk factors` in the `Closing` screen, you can see which (relevant) IRFs and associated assertions (optional) and audit units do not yet have a risk linked to them.
{% endhint %}

3. If the risk factor is relevant, it must be further mapped out:
4. Indicate whether it is a fraud risk factor (as defined in NV COS 240.25). If this is the case, click on `Fraud risk factor` within the `Risk analysis` section (on the right side of the screen) and select *"fraud risk factor"* or *"no fraud risk factor"* in the dropdown. When selecting *"fraud risk factor"*, the fraud triangle appears and must be filled in. Determine for yourself whether the inherent risk factor qualifies as a fraud risk factor.
5. Indicate whether the IRF leads to a going concern risk;
6. Link the IRF if desired to one or more `assertions` by clicking on the pen icons under **`Scope`** on the left of the screen. This is optional, but enables the application to more specifically check whether the risk factor is fully covered by risks.