AU-C 330 Walkthrough: Overall Responses and Further Audit Procedures, Requirement by Requirement

AU-C 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained, is the section that turns the risk assessment into work. Paragraph .03 states the objective: to obtain sufficient appropriate audit evidence about the assessed risks of material misstatement through appropriate responses. See the AU-C 330 standards page and substantive testing versus tests of controls.

What are the overall responses?

Paragraph .05 requires overall responses to risks of material misstatement at the financial statement level. A1 lists examples:

• emphasizing professional skepticism to the team;
• assigning more experienced staff, staff with specialized skills, or specialists;
• changing the direction, supervision and review of the team;
• adding unpredictability to the selection of further procedures; and
• changing the overall strategy, including performance materiality, the plan to test controls, and the nature, timing and extent of substantive procedures.

A2 links the response to the control environment: an effective one may allow some procedures at an interim date, while deficiencies point to period-end work, more extensive substantive procedures, and more locations in scope.

How are nature, timing and extent set?

Paragraph .06 requires further procedures whose nature, timing and extent are based on, and responsive to, the assessed risks at the relevant assertion level, "in a manner that is not biased towards obtaining audit evidence that may be corroborative or towards excluding audit evidence that may be contradictory." The definitions in A5 to A7:

• Nature: the purpose (test of controls or substantive procedure) and the type (inspection, observation, inquiry, confirmation, recalculation, reperformance, analytical procedure). A5 says nature is most important in responding to risk.
• Timing: when it is performed or the period or date the evidence covers.
• Extent: the quantity, such as sample size or number of observations.

Paragraph .07 adds that the auditor considers the reasons for the assessed risk for each significant class of transactions, account balance and disclosure, including inherent risk and whether the assessment takes account of controls, and obtains more persuasive evidence the higher the assessed risk. A20 says more persuasive means more evidence, or more relevant or reliable evidence.

When must you test controls?

Paragraph .08 requires tests of controls in two cases:

1. the risk assessment expects controls to operate effectively, and the auditor plans to test them in determining the nature, timing and extent of substantive procedures; or
2. substantive procedures alone cannot provide sufficient appropriate evidence at the relevant assertion level (A25 gives the case of an IT-based business that produces no documentation outside the system).

Conversely, A4(b) says performing only substantive procedures is appropriate for particular assertions where no risk requires controls testing.

Execution rules for controls testing:

• Inquiry alone is not enough (A28). Paragraph .10a requires other procedures with inquiry to cover how the control was applied, how consistently, and by whom.
• Test for the period of intended reliance (paragraph .11), and for interim testing, update for significant changes and decide what is needed for the remaining period (paragraph .12).
• Indirect controls, such as general IT controls, are tested if needed (paragraph .10b).
• If the auditor relies on a control that addresses a significant risk, it is tested in the current period (paragraph .15).
• The absence of misstatements found by substantive procedures is not evidence that controls work (paragraph .16).
• On deviations, the auditor makes specific inquiries and decides whether the tests support reliance, whether more tests are needed, or whether substantive procedures must cover the risk (paragraph .17).

Can controls evidence be reused?

Paragraph .13 lists factors for using evidence from earlier audits, including other components of internal control, whether the control is manual or automated, general IT controls, past deviations and personnel changes, and the extent of reliance. Paragraph .14 requires inquiry combined with observation or inspection to confirm the control is unchanged. If it changed, test it. If not, test it at least once in every third audit and test some controls each year so that none of the controls relied on are all untested for two periods.

Controls that mitigate a significant risk are excluded from the reuse relief (A42). A rotation plan for six unchanged, non-significant-risk controls could test two each year so each is tested every third audit, with all six checked for change every year.

What substantive procedures are always required?

Paragraph .18 requires substantive procedures for each relevant assertion of each significant class of transactions, account balance and disclosure, regardless of the assessed level of control risk. A47 explains why: risk assessment is judgmental, and internal control has inherent limits, including management override.

Other fixed requirements:

• Consider external confirmation (paragraph .19). Use it for accounts receivable unless the balance is immaterial, confirmation would be ineffective, or assessed risk is low and other planned procedures address it (paragraph .20).
• Closing process (paragraph .21): agree or reconcile the financial statements and disclosures to the underlying records, and examine material journal entries and adjustments.
• Significant risks (paragraph .22): substantive procedures specifically responsive to the risk, and tests of details if the approach is substantive only. See significant risks under AU-C 315.

On type, A48 says analytics alone can be sufficient, for example when the risk assessment is supported by tests of controls, while other circumstances may call for only tests of details or a combination. A50 notes existence tests start from recorded items while completeness tests start from items expected to be included, such as subsequent disbursements compared with recorded payables.

What if you test at an interim date?

Paragraph .23 requires covering the remaining period with substantive procedures combined with tests of controls, or substantive procedures only if sufficient. Paragraph .24 requires re-evaluating the risk assessment and planned procedures for the remaining period if misstatements not expected from the risk assessment are detected at the interim date. A12 says that when risks of intentional misstatement or manipulation are identified, the auditor may conclude that extending conclusions from the interim date to period-end would not be effective.

How do you select items?

Paragraph .25 requires the means of selecting items to be effective for the purpose: all items, specific items, or sampling. See selecting items for testing.

How do you evaluate the evidence?

Before concluding, paragraph .27 requires the auditor to evaluate whether the risk assessments at the relevant assertion level remain appropriate. Paragraph .28 requires a conclusion on whether sufficient appropriate evidence has been obtained, considering all evidence, whether it appears to corroborate or contradict the assertions. A79 adds factors that influence the judgment, including the significance of the potential misstatement, the effectiveness of management's responses and controls, experience from previous audits, and whether procedures identified specific instances of fraud or error.

A77 says accounting records alone, even if internally consistent and agreeing to the statements, do not provide sufficient appropriate evidence, and A78 says the auditor cannot assume that fraud or error is an isolated occurrence. If the auditor cannot obtain sufficient appropriate evidence for a relevant assertion about a significant class, balance or disclosure, paragraph .29 requires attempting to get more, and otherwise a qualified opinion or a disclaimer.

What must be documented?

Paragraph .30: the overall responses; the nature, timing and extent of further procedures; the linkage of those procedures to assessed risks at the assertion level; and the results, with conclusions where not otherwise clear. Further items:

• conclusions about relying on controls tested in a previous audit (paragraph .31);
• the basis for not confirming material receivables (paragraph .32); and
• that the statements agree or reconcile to the underlying records, including disclosures (paragraph .33).

Worked example: a distributor

Each row traces to a paragraph, as .30(b) requires.

Frequently asked questions

Can an audit use no tests of controls?

Yes, when no risk requires them (A4(b)). The substantive procedures in paragraph .18 are always required.

Does a clean controls test reduce substantive work to zero?

No (A9).

Sources

• AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (paragraphs .03 to .33, A1 to A80): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
• PCAOB, AS 2301, The Auditor's Responses to the Risks of Material Misstatement (issuer counterpart): https://pcaobus.org/oversight/standards/auditing-standards/details/AS2301

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error