Business Risk approach vs Audit Risk Approach

If a company is large and is assumed that it has strong controls, a business risk approach is taken.

For smaller companies it is less likely that the auditor will rely on its controls, thus a detailed substantive approach may be more appropriate.

Does this imply that audit risk approach should be taken to focus on the detailed audit tests on areas where problems are most likely to arise?