What is Control risk?

The risk that a material misstatement that could occur in an assertion will not be prevented, or detected and corrected, on a timely basis by the company's internal control. Under ISA 200, control risk together with inherent risk makes up the "risk of material misstatement", and it depends on the company's own internal control: the auditor does not change it, only assesses it. The weaker the controls, the higher the control risk and the more the auditor has to extend his own substantive procedures. If the auditor intends to rely on controls, he confirms that they operate by means of tests of controls.

Source: 200-son XAS (ISA 200), 13-band