See Chapter 9 – audit risk has 3 components – inherent risk (IR), control risk (CR) (together make up RoMM) and detection risk (DR).
If IR is assessed as high – RoMM is not necessarily high – because it depends on “how good” (or bad) the system of internal controls.
If the auditor identifies deficiencies in internal control, RoMM will however be the same as IR.
Only if controls are expected to be effective will the auditor perform tests of controls – see the overview at the beginning of Chapter 8 and the explanation of approach on the opposite page.