PCAOB AS 2301: Responding to the Risks of Material Misstatement in an Issuer Audit

PCAOB AS 2301, The Auditor's Responses to the Risks of Material Misstatement, is the issuer-audit standard that turns the risk assessment into audit work. Paragraph .03 requires the auditor to design and implement responses that address the risks of material misstatement identified and assessed under AS 2110. Paragraph .04 splits responses into two kinds: overall responses that affect how the audit is conducted (paragraphs .05 to .07), and responses involving the nature, timing and extent of procedures (paragraphs .08 to .46).

The AICPA counterpart is AU-C 330, covered in this walkthrough. Differences are flagged for firms that work under both sets.

How AS 2301 connects to AS 2110 and AS 2201

• AS 2110 comes first. It governs identifying and assessing risks, including significant accounts, relevant assertions, fraud risks and significant risks. AS 2301 paragraph .03 starts from those assessments, and its paragraph .11 note points back to AS 2110 for significant risk identification.
• AS 2201 governs the audit of internal control over financial reporting. In an integrated audit, paragraph .09c requires tests of controls designed to serve both audits at once: evidence for the control risk assessment and for the opinion on internal control as of year end. Paragraph .35 says AS 2201 sets the requirements for selecting controls and the nature, timing and extent of testing in the internal control audit.
• AS 2315 sets the sampling rules for both kinds of tests. See audit sampling under AS 2315 and AU-C 530.

What are the overall responses?

Paragraph .05 lists four.

1. Assignments. Engagement team members with significant responsibilities have knowledge, skill and ability commensurate with the assessed risks.
2. Supervision. The extent of supervision fits the circumstances, particularly the assessed risks.
3. Unpredictability. The auditor incorporates an element of unpredictability in the selection of procedures from year to year. Examples include testing accounts that would not otherwise be tested based on amount or risk, varying timing, selecting lower-amount items, unannounced procedures, and varying locations.
4. Accounting principles. The auditor evaluates whether the company's selection and application of significant accounting principles, particularly for subjective measurements and complex transactions, indicate bias that could lead to material misstatement.

Paragraph .06 adds that the auditor determines whether pervasive changes to nature, timing or extent are needed. Examples: more year-end valuation testing after deteriorating markets, or more persuasive substantive evidence because of pervasive control environment weaknesses. Paragraph .07 requires professional skepticism in the response to assessed risks, especially fraud risks, for example by corroborating management's explanations through confirmation, a specialist or independent documents.

How are procedures designed?

Paragraph .08: address the assessed risks for each relevant assertion of each significant account and disclosure. Paragraph .09: obtain more persuasive evidence the higher the assessed risk, considering likelihood and magnitude.

What must the auditor do for significant risks and fraud risks?

• Significant risks. Paragraph .11: perform substantive procedures, including tests of details, that are specifically responsive. The note says AS 2110 states that fraud risks are significant risks. AS 2110 paragraph .70 makes the significant risk determination turn on inherent risk, without regard to the effect of controls, and paragraph .71 lists factors, including whether the risk is a fraud risk, relates to recent developments, involves complex transactions, significant related party transactions, high judgment or measurement uncertainty, or significant unusual transactions.
• Significant unusual transactions. Paragraph .11A: take into account the types of misstatements that could result, including procedures under AS 2401.66 to .67A.
• Fraud risks. Paragraph .13: substantive procedures, including tests of details, specifically responsive to the fraud risks, and tests of the controls if the auditor selects them. Paragraph .14 gives ways to modify nature (more reliable evidence), timing (closer to period end or when fraud is more likely) and extent (larger samples or computer-assisted techniques on all items).
• Management override. Paragraph .15 lists journal entry examination, estimate bias review, and evaluating the business purpose of significant unusual transactions, under AS 2401.

AS 2305 paragraph .09 says that for significant risks it is unlikely that substantive analytics alone will be sufficient. See substantive analytics under AS 2305 and AU-C 520 and significant risks.

When must controls be tested?

Paragraph .16: if the auditor plans to assess control risk below the maximum by relying on controls, and sets substantive procedures on that lower assessment, the auditor must obtain evidence that the selected controls are designed effectively and operated effectively during the entire period of reliance. The auditor need not assess control risk below the maximum for any assertion.

Paragraph .17 requires tests of controls for each relevant assertion where substantive procedures alone cannot provide sufficient evidence, and when needed to support reliance on the accuracy and completeness of information used in other procedures. The notes give electronically processed information and complex-model estimates as examples where substantive tests alone may be impossible.

How to test:

• Design. Paragraph .19 and .20: determine whether the controls, operated as prescribed by people with authority and competence, satisfy control objectives. Walkthroughs with inquiry, observation and inspection ordinarily suffice.
• Operation. Paragraphs .21 and .22: inquiry, observation, inspection and reperformance. Paragraph .24 ranks them from least to most evidence: inquiry, observation, inspection, reperformance.
• Extent. Paragraph .27 lists factors, including frequency, length of reliance, expected deviation rate, and manual or automated nature.
• Timing. Paragraphs .28 to .30: interim evidence must be rolled forward based on changes, inherent risk, results and the length of the remaining period.
• Past audits. Paragraph .31 requires evidence during the current year about the design and operating effectiveness of controls the auditor relies on.

That differs from AU-C 330 paragraph .14, which allows unchanged controls not addressing significant risks to be tested once in every third audit. AS 2301 contains no such cycle: current-year evidence is needed for each control relied on.

If controls on which the auditor intends to rely are ineffective, paragraph .34 requires testing other controls for the same assertion, or revising the control risk assessment and modifying substantive procedures. Paragraph .33 sets control risk at the maximum where necessary controls are missing, ineffective or unsupported by sufficient evidence.

What substantive procedures are always required?

Paragraph .36 requires substantive procedures for each relevant assertion of each significant account and disclosure, regardless of assessed control risk. Other points:

• Evidence rises with assessed risk (paragraph .37), and more evidence is ordinarily needed for assertions susceptible to management override or human failure (paragraph .38).
• Inquiry alone is not sufficient evidence (paragraph .39).
• Period-end reporting procedures (paragraph .41) must include reconciling the financial statements with the underlying records and examining material adjustments.
• Extent depends on materiality, assessed risk and the assurance needed, and more extent cannot address a risk unless the evidence is reliable and relevant (paragraph .42).

What if procedures run at an interim date?

Paragraph .43 warns that interim-only substantive work raises the risk of undetected year-end misstatement, more so as the gap grows. Paragraph .45 requires substantive procedures, or substantive procedures with tests of controls, for the remaining period, including comparing interim and period-end information to find unusual amounts and investigating them. Paragraph .46 requires revising risk assessments and procedures if unexpected misstatements surface.

What is a dual-purpose test?

Paragraph .47: a substantive test of a transaction performed concurrently with a test of a control on the same transaction. The auditor designs it to meet both objectives and evaluates the results separately for the assertion and for the control.

Worked example: an issuer with a manufacturing segment

Sources

• PCAOB, AS 2301, The Auditor's Responses to the Risks of Material Misstatement (paragraphs .01 to .47): https://pcaobus.org/oversight/standards/auditing-standards/details/AS2301
• PCAOB, AS 2110, Identifying and Assessing Risks of Material Misstatement (paragraphs .70 and .71): https://pcaobus.org/oversight/standards/auditing-standards/details/AS2110
• PCAOB, AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201
• PCAOB, AS 2305, Substantive Analytical Procedures (paragraph .09), and AS 2401 (paragraphs .58 to .67A): https://pcaobus.org/oversight/standards/auditing-standards/details/AS2305
• AICPA, AU-C Section 330 (paragraph .14 comparison): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error