a. The risk of underreliance (risk of assessing control risk too high) occurs when the auditor’s sample indicates that the control is not functioning effectively when, in fact, it is doing so. When this risk occurs, the auditor’s upper limit rate of deviation exceeds the tolerable rate of deviation. However, unknown to the auditor, the true population deviation rate is less than the tolerable rate of deviation.The risk of underreliance results in an efficiency loss for the auditor because she or he performs more extensive substantive procedures than are necessary. The risk of overreliance exposes the auditor to an effectiveness loss because the auditor’s substantive procedures will not reduce audit risk to the acceptable level.

b. The risk of overreliance (risk of assessing control risk too low) occurs when the auditor’s sample indicates that the control is functioning effectively when, in fact, it is not. When this risk occurs, the auditor’s upper limit rate of deviation is less than the tolerable rate of deviation. However, unknown to the auditor, the true population deviation rate exceeds the tolerable rate of deviation