What is the audit risk model?+
Audit Risk = Inherent Risk × Control Risk × Detection Risk. The auditor sets a target overall audit risk (typically very low — e.g., 5%), assesses inherent and control risk, and adjusts detection risk by varying the nature, timing, and extent of substantive procedures. SA 200 and SA 315 govern this model.
What is a "significant risk" under SA 315?+
A risk that, in the auditor's judgement, requires special audit consideration. Indicators (para 28): risk of fraud, recent significant developments in economic / regulatory environment, complexity, significant related-party transactions, subjective measurement (especially involving estimation uncertainty), non-routine / significant transactions outside the normal course. Revenue recognition is a presumed fraud risk under SA 240.
How is risk assessment documented?+
SA 315 requires documentation of: the discussion among the engagement team about susceptibility of FS to misstatement; key elements of the understanding obtained; sources of information; risk assessment procedures performed; risks identified and assessed (including significant risks and assertion-level risks); evaluation of the design of relevant controls and their implementation.
Can controls reliance reduce substantive procedures?+
Yes — if the auditor expects to rely on the operating effectiveness of controls, SA 330 requires testing of those controls. Effective controls reduce control risk → allows higher acceptable detection risk → fewer substantive procedures. But for significant risks, SA 330 para 21 requires the auditor to perform substantive procedures specifically responsive to that risk.
What is the difference between risk assessment and risk response?+
Risk assessment (SA 315) identifies and evaluates risks. Risk response (SA 330) is the auditor's actions in response — designing further procedures responsive to the assessed risks. The two are interconnected: a thorough risk assessment leads to a focused response and a thinner, more effective audit.
How do I identify risks in a new client?+
For first-year audits (SA 510), the risk assessment is broader: understanding industry conditions, legal and regulatory framework, ownership and governance, business operations, accounting policies, related parties, IT environment, ICOFR design, prior-year audit opinions. The investment is higher in Year 1 but pays back in Year 2-3 with focused, lower-cost audits.
What is ITGC risk?+
IT General Controls (ITGCs) are controls over the IT environment that support the effective operation of application controls. SA 315 (Revised 2020) requires the auditor to understand ITGCs over: access security, change management, data backup, and IT operations. Weak ITGCs typically mean application controls cannot be relied upon — increasing substantive procedures.
Does CARO 2020 require risk-related reporting?+
CARO 2020 has multiple clauses linked to risk assessment outcomes: clause (i) PPE / ROU records adequacy; (ii) inventory existence; (iv) Sec 185 / 186 compliance; (vii) statutory dues; (viii) undisclosed income; (xi) fraud; (xvii) cash losses; (xviii) auditor resignation; (xix) going concern; (xx) CSR. Risk assessment guides the depth of testing on each.
