Answer
Control risk is the risk that a material misstatement in an assertion won't be prevented, or detected and corrected, on a timely basis by the entity's internal controls. It depends on the design and operating effectiveness of controls. Weak controls mean high control risk, requiring more substantive audit work.
Real-world example A company with no segregation of duties in cash handling has high control risk over misappropriation.