SAS 145 is the AICPA standard that rewrote AU-C 315, the section on identifying and assessing the risks of material misstatement. It applies to audits of non-SEC entities in the United States. Indian auditors who know SA 315 (Revised) will recognise most of it, because both follow the same international model.
Last reviewed: 17 October 2026. Facts checked. A web search returned summaries from CPE providers and an accounting publisher stating that SAS 145 applies to audits of financial statements for periods ending on or after 15 December 2023, with early adoption permitted, and that it replaced the earlier AU-C 315. We did not open the AICPA's text of SAS 145, AU-C 315 or the PCAOB's AS 2110. The comparisons below are at a general level and no paragraph numbers are cited. Confirm against the primary texts before relying on a detail.
Where it sits
- AICPA, non-issuers: AU-C 315, as amended by SAS 145.
- PCAOB, issuers: AS 2110, "Identifying and Assessing Risks of Material Misstatement". A different standard with the same purpose.
- India: SA 315 (Revised), issued by ICAI on the international base.
If the client is an SEC registrant, AS 2110 applies, not SAS 145. Our primer on PCAOB vs AICPA standards explains how to tell.
What SAS 145 changed, in practical terms
The summaries we read point to the same main changes. Treat them as a checklist of ideas to confirm in the standard.
- Inherent risk and control risk assessed separately. The auditor assesses each, rather than treating the combined risk as a single judgement. This is the familiar audit risk model made explicit.
- A spectrum of inherent risk. The auditor considers how likely and how large a misstatement could be, and places each risk on a scale. Factors such as complexity, subjectivity, uncertainty, change and susceptibility to bias help position it.
- A revised definition of "significant risk". Significant risks sit at the upper end of that spectrum and need specific responses.
- "Relevant assertion" tied to an identified risk. An assertion is relevant when there is an identified risk of material misstatement for it. This ties scoping to risk, not to a standard list.
- Stronger understanding of the entity's system and IT. The auditor understands the information system and the controls in it, including the use of IT, and evaluates the design and implementation of controls relevant to the audit.
- Scalability. The standard states more clearly that the extent of risk assessment depends on the complexity of the entity.
- Professional scepticism. The standard stresses scepticism and stand-back evaluation of whether the assessment is complete.
How this compares with SA 315 (Revised)
For an Indian practitioner the shape is familiar: understand the entity and its environment, identify risks, assess them, and design responses. Both standards are built on the same ISA structure, which is why the inherent risk factors and the "stand-back" step appear in both. Differences are mostly in wording, application material and cross-references to other US sections, such as those on accounting estimates and group audits.
Our guide to audit assertions under SA 315 and SA 500 maps well onto how the US standard thinks about relevant assertions.
What the working papers should show
A reviewer, whether in the US or in India, wants to see a clear line from risk to response. A useful structure:
| Step | What to record |
|---|---|
| Understand the entity | Business model, industry, financial reporting framework, accounting policies and changes |
| Understand the system | Significant classes of transactions, how they flow through IT and manual steps |
| Identify risks | Where a misstatement could arise, by assertion |
| Assess inherent risk | Position on the spectrum, with the factors considered |
| Assess control risk | Based on the design and implementation of controls, and planned testing |
| Conclude on significant risks | Why each is significant, and the specific response |
| Stand back | Whether any class of transaction, balance or disclosure was missed |
A risk assessment form that lists risks but does not link each to an audit response is the most common weakness reviewers find. The link is the product.
Common mistakes in practice
- Template risks. Copying last year's risk list without checking what changed in the business.
- Controls listed but not understood. Describing a control from the client's manual without walking one transaction through.
- No separate control risk view. Defaulting to "high" without evaluating controls, with no record of why.
- IT left out. Spreadsheets and reports relied on without considering how they are produced and changed.
What to confirm before using this on an engagement
- Whether the client is an issuer (PCAOB) or not (AICPA).
- The firm's methodology: most US firms use a licensed audit methodology that already reflects SAS 145. An offshore team should follow it, not replace it.
- Which firm is responsible for the risk assessment. In a component or offshore arrangement, the responsible firm sets the instructions.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error