SAS No. 145, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, replaced the risk assessment requirements in AU-C 315 and made related changes to other sections, including AU-C 330. It is effective for audits of financial statements for periods ending on or after December 15, 2023. For calendar-year clients, that means the December 31, 2023 audits were the first under the new requirements.
SAS 145 is written to be scalable, but small firms notice it mainly in IT, controls documentation and the more explicit inherent risk assessment. This guide covers the main changes and what a small or mid-size firm's file should show. It paraphrases the standard; the full text is in AU-C 315 and AU-C 330.
Why SAS 145 was issued
SAS 145 brought AU-C 315 closer to the international standard (ISA 315 (Revised 2019)), with a more explicit approach to inherent risk, internal control and IT.
The standard does not change the basic aim: identify and assess the risks of material misstatement to design further audit procedures. It changes how the auditor gets there and what has to be documented.
The main changes at a glance
| Area | Before SAS 145 | After SAS 145 |
|---|---|---|
| Inherent and control risk | Combined RMM assessment allowed | Separate assessment required |
| Inherent risk | Assessed without a defined framework | Assessed on a spectrum using likelihood, magnitude and inherent risk factors |
| Significant risk | Risk requiring special audit consideration | Risk with inherent risk close to the upper end of the spectrum, or as designated by other AU-C sections |
| Assertions | Three categories | Two categories, each covering the related disclosures |
| Controls | "Controls relevant to the audit" | Specified controls in the control activities component require design and implementation work |
| IT | General understanding | Understanding of IT environment, risks arising from IT, and general IT controls for relevant applications |
| Stand-back | Not required | Required for material items not identified as significant |
| Skepticism | General requirement | More emphasis on contradictory evidence and the robustness of the risk assessment |
Separate inherent and control risk
The auditor now assesses inherent risk and control risk separately for each relevant assertion. If the auditor does not plan to test the operating effectiveness of controls, the RMM is the same as the inherent risk assessment.
Where the auditor takes a substantive approach and does not plan to test controls, control risk is assessed at maximum and the file needs a clear, well-supported inherent risk assessment. See audit risk model for how the components fit together.
The spectrum of inherent risk and inherent risk factors
SAS 145 requires inherent risk to be assessed by considering the likelihood and magnitude of misstatement, which places the risk on a spectrum. The auditor considers how inherent risk factors affect susceptibility to misstatement:
- complexity
- subjectivity
- change
- uncertainty
- susceptibility to misstatement due to management bias or other fraud risk factors
What this means in practice
A firm's risk assessment form should prompt the team to:
- identify which inherent risk factors apply to each significant account and assertion
- rate likelihood and magnitude
- place the risk on the firm's scale
- write a short rationale tied to this client, not a stock phrase
Generic wording like "revenue is a high-risk area for all entities" does not show the evaluation SAS 145 asks for. Specific wording such as "subjectivity from percentage-of-completion estimates on three contracts in progress at year-end" does.
Relevant assertions and significant classes of transactions, account balances and disclosures
SAS 145 introduced defined terms:
- A relevant assertion is one with an identified risk of material misstatement. The determination is made before considering controls, based on whether there is a reasonable possibility of a material misstatement.
- A significant class of transactions, account balance or disclosure is one with at least one relevant assertion.
These terms focus work on where the risk is. See audit assertions for the full list of assertions in the two categories.
Significant risks
The definition of significant risk changed. A significant risk is now one for which the inherent risk assessment is close to the upper end of the spectrum, or one that must be treated as significant under other AU-C sections, such as fraud risks under AU-C 240.
This ties significant risk directly to inherent risk and removes ambiguity about whether controls should affect the designation. They should not: the designation is made on inherent risk.
The responses to significant risks did not change much. The auditor still evaluates the design of related controls and determines whether they have been implemented, and performs substantive procedures that specifically respond to the risk. If the approach to a significant risk consists only of substantive procedures, those procedures must include tests of details.
Understanding the system of internal control
The five components
The auditor still obtains an understanding of the five components of internal control: control environment, risk assessment process, process to monitor the system of internal control, information system and communication, and control activities. SAS 145 split the requirements more clearly between components where the auditor obtains an understanding and evaluates it (the first three, plus the information system) and the control activities component, where specific controls are identified.
Controls that require design and implementation evaluation
In the control activities component, the auditor identifies and evaluates the design and determines the implementation of these controls:
- controls that address a risk determined to be a significant risk
- controls over journal entries, including nonstandard journal entries used to record nonrecurring, unusual transactions or adjustments
- controls whose operating effectiveness the auditor plans to test, including controls over risks for which substantive procedures alone cannot provide sufficient appropriate evidence
- other controls that, in the auditor's professional judgment, are appropriate to evaluate
For each, the auditor also identifies the IT applications and other aspects of the IT environment that are subject to risks arising from the use of IT, and the general IT controls that address those risks.
Evaluating deficiencies
Based on the evaluation of each component, the auditor determines whether control deficiencies have been identified. Deficiencies are evaluated and communicated under AU-C 265.
IT and general IT controls
IT is a significant practical change for small firms.
What the auditor needs to understand
The auditor obtains an understanding of the entity's use of IT in its information system, including the IT applications that are relevant to financial reporting and the supporting IT infrastructure and processes. For controls identified in the control activities component, the auditor:
- identifies the IT applications subject to risks arising from IT
- identifies the related risks arising from IT
- identifies the general IT controls that address those risks
- evaluates the design and determines the implementation of those general IT controls
Scaling for small clients
For many small clients, the IT environment is simple: an off-the-shelf cloud accounting package, a payroll service provider, a bank portal and spreadsheets. In those cases:
- the relevant IT applications may be few
- the risks arising from IT may focus on access (who can post entries, who can change vendor or employee master data) and spreadsheet integrity
- the general IT controls may be limited to user access management and reliance on the vendor's controls, often supported by SOC 1 reports for the payroll provider or cloud platform
The point is not to perform an IT audit. It is to understand enough to know where IT creates risks that matter to the financial statements and to evaluate design and implementation where a relevant control depends on IT.
Typical general IT control areas
- Access: user provisioning and removal, privileged access, segregation within the application
- Program change: how changes to applications or configurations are authorized and tested
- IT operations: backups, job scheduling, incident handling
Where the client uses third-party providers, AU-C 402 on service organizations is relevant. A SOC 1 Type 2 report, with the client's complementary user entity controls, often supports the understanding.
The stand-back requirement
SAS 145 added a stand-back requirement in AU-C 315. For classes of transactions, account balances and disclosures that are quantitatively or qualitatively material but have not been determined to be significant (no relevant assertions identified), the auditor evaluates whether that determination remains appropriate.
The purpose is to catch material areas that slipped through the risk assessment. In a working file, the stand-back usually appears as a schedule (illustrative entries):
| Material account or disclosure | Determined significant? | Rationale if not significant |
|---|---|---|
| Prepaid expenses | No | Single annual insurance policy, simple amortization, no inherent risk factors; risk of material misstatement not reasonably possible |
| Accrued payroll | Yes |
Separately, AU-C 330 still requires substantive procedures for each material class of transactions, account balance and disclosure, regardless of the assessed RMM. The stand-back and the AU-C 330 requirement work together.
Professional skepticism
SAS 145 places more emphasis on professional skepticism in risk assessment. The auditor designs and performs risk assessment procedures in a way that is not biased toward obtaining evidence that corroborates or excludes contradictory evidence. Practically, this means considering information from outside management, such as industry data, news, the entity's website and lender communications, and documenting how contradictory evidence was evaluated.
Documentation checklist for small firms
Under AU-C 230 and AU-C 315, the file should show:
- The engagement team discussion: the application of the financial reporting framework and the susceptibility of the financial statements to material misstatement, including fraud.
- Understanding of the entity, its environment and the framework, with the sources of information.
- Understanding of each component of internal control, the controls identified in the control activities component and the evaluation of their design and implementation.
- IT understanding: relevant IT applications, risks arising from IT, general IT controls evaluated.
- Identified and assessed risks at the financial statement and assertion levels, with inherent risk factors, likelihood and magnitude, and the separate control risk assessment.
- Significant risks and the rationale.
- Significant judgments made in identifying and assessing the risks.
- The stand-back evaluation.
- Linkage from each assessed risk to the planned response.
Materiality from AU-C 320 supports several of these steps, since "material" in the stand-back and in relevant-assertion determinations depends on it. The materiality calculator can help document the amounts.
Common SAS 145 pitfalls in small-firm files
- Rolled-forward risk assessment with no update for changes in the business, systems or framework.
- Inherent risk factors listed but not used, so the rating does not follow from the factors.
- Control risk below maximum without tests of operating effectiveness.
- No identification of controls over journal entries.
- IT understanding limited to naming the accounting software, without identifying risks arising from IT or general IT controls.
- No stand-back documentation.
- Significant risks designated by account size alone, rather than by inherent risk.
FAQ
When is SAS 145 effective?
SAS 145 is effective for audits of financial statements for periods ending on or after December 15, 2023.
Does SAS 145 require testing IT general controls?
No. It requires the auditor to identify general IT controls that address risks arising from IT for certain applications and to evaluate their design and implementation. Testing operating effectiveness is required only if the auditor plans to rely on those controls.
What is the stand-back requirement?
For material classes of transactions, account balances and disclosures not determined to be significant, the auditor evaluates whether that determination remains appropriate. It is a check that the risk assessment did not miss a material area.
Which controls require design and implementation work under SAS 145?
Controls addressing significant risks, controls over journal entries, controls the auditor plans to test for operating effectiveness, and other controls the auditor considers appropriate, plus the related general IT controls.
Did SAS 145 change the definition of significant risk?
Yes. A significant risk is now one with inherent risk close to the upper end of the spectrum of inherent risk, or one required to be treated as significant by other AU-C sections.
Sources
- AICPA, SAS No. 145, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (AU-C Section 315 as revised; effective for audits of financial statements for periods ending on or after December 15, 2023)
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
- AICPA, AU-C Section 240; AU-C Section 265; AU-C Section 320; AU-C Section 230; AU-C Section 402
- IAASB, ISA 315 (Revised 2019), Identifying and Assessing the Risks of Material Misstatement (the international counterpart)
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Planning and risk assessment: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error