A significant risk is an identified risk of material misstatement for which the assessment of inherent risk is close to the upper end of the spectrum of inherent risk, or one that other AU-C sections say must be treated as significant. That is the definition in AU-C 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, as revised by SAS 145 (effective for periods ending on or after December 15, 2023). The designation is made on inherent risk, before considering controls. It then triggers a set of required responses.
For the wider SAS 145 changes see SAS 145 for small firms.
How do you decide whether a risk is significant?
Paragraph .36 requires the auditor to determine whether any assessed risks of material misstatement are significant risks. The test is on the inherent risk spectrum, which combines the likelihood of a misstatement and its potential magnitude, shaped by inherent risk factors. A249 says the auditor may first identify the risks assessed higher on the spectrum and then consider which are close to the upper end. It adds that being close to the upper end differs from entity to entity and will not necessarily be the same for an entity period on period.
A250 says this is professional judgment unless another AU-C section specifies the risk as significant. It gives two contrasting examples:
- Cash at a supermarket retailer has a high likelihood of misappropriation but a very low magnitude, given low physical cash levels in stores, so existence of cash would be unlikely to be a significant risk.
- An entity negotiating to sell a business segment may have a higher likelihood and magnitude of misstatement in goodwill impairment, because of subjectivity, uncertainty and susceptibility to management bias. Goodwill impairment may be determined to be a significant risk.
A251 lists matters that may lead to higher inherent risk:
- transactions with multiple acceptable accounting treatments;
- accounting estimates with high estimation uncertainty or complex models;
- unusual or complex transactions, such as revenue with multiple performance obligations that are hard to value;
- emerging areas, such as digital assets;
- complex data collection and processing;
- complex calculations;
- accounting principles open to differing interpretation; and
- changes in the business that change accounting, such as mergers and acquisitions.
Which risks are significant by rule?
Some risks are designated by other sections:
- Fraud risks. AU-C 240 paragraph .27 requires the auditor to treat assessed risks of material misstatement due to fraud as significant risks. Paragraph .26 requires the auditor, based on the presumption that fraud risks exist in revenue recognition, to evaluate which types of revenue, revenue transactions or assertions give rise to such risks. Management override of controls is also a significant risk because it is a fraud risk present in all entities (AU-C 240, paragraph .31).
- Related party transactions that are also significant unusual transactions. AU-C 550 paragraph .20 requires treating them as giving rise to significant risks.
See fraud risk assessment under AU-C 240 and revenue recognition audit procedures for the revenue side.
What are the required responses?
A247 collects them. Once a risk is significant:
- Identify the controls that address it. AU-C 315 paragraph .27a requires identifying controls that address a risk determined to be significant. Paragraph .30 then requires evaluating whether each is designed effectively and determining whether it has been implemented by performing procedures in addition to inquiry of entity personnel. A180 notes that even when the auditor does not plan to test operating effectiveness, understanding management's approach may support designing substantive procedures. For judgmental or nonroutine matters, management's responses may include review of assumptions by senior management or specialists, documented estimation processes, or governance approval.
- Test those controls in the current year if you rely on them. AU-C 330 paragraph .15: if the auditor intends to rely on controls over a significant risk, the controls are tested in the current period. The prior-audit reuse relief in paragraph .14 does not apply to them (A42).
- Perform substantive procedures specifically responsive to the risk. AU-C 330 paragraph .22. A60 adds that substantive procedures that take into account the types of misstatements that could result from significant unusual transactions may be necessary.
- Include tests of details if the approach is substantive only. Also paragraph .22. Substantive analytics alone do not satisfy the requirement. See substantive analytical procedures under AS 2305 and AU-C 520.
- Obtain more persuasive evidence as risk increases. AU-C 330 paragraph .07b, with A20 describing more quantity or more relevant and reliable evidence.
- Communicate with those charged with governance. AU-C 260 paragraph .11 requires communicating the significant risks identified. A20 of AU-C 260 says this helps governance understand why the risks were determined to be significant, and A21 lists how the auditor plans to address them as a scope-and-timing matter.
- Feed the KAM process. AU-C 701 paragraph .08 requires taking significant risks into account when determining matters that required significant auditor attention. See key audit matters under AU-C 701.
- Timely partner review. A248 says timely review of documentation by the engagement partner at appropriate stages allows significant risks to be resolved before the report date. In a group audit, AU-C 600A requires more involvement of the group engagement partner when the significant risk relates to a component (A247).
Is a substantive-only response ever enough?
Not when it excludes tests of details. Paragraph .22 of AU-C 330 allows a substantive-only approach to a significant risk but requires those procedures to include tests of details.
A separate question is whether substantive procedures alone can ever suffice. AU-C 315 paragraph .37 requires the auditor to determine whether substantive procedures alone cannot provide sufficient appropriate audit evidence for any risk. A254 gives the example of highly automated routine processing, such as telecommunications revenue, where evidence of call or data activity does not exist in observable form. In those cases tests of controls are required (AU-C 330 paragraph .08b). A risk can be both.
What does the file need?
AU-C 315 paragraph .42d requires documentation of the identified and assessed risks of material misstatement at the financial statement and assertion levels, including significant risks and risks for which substantive procedures alone are not sufficient, and the rationale for the significant judgments made. AU-C 330 paragraph .30 requires the linkage of procedures to the assessed risks.
A rationale for each designation, and for each risk considered and not designated, shows that the judgment in A250 was exercised.
Worked example: a software reseller
| Risk | Inherent risk drivers | Significant? | Basis |
|---|---|---|---|
| Revenue recognized on multi-element contracts | Complexity, multiple performance obligations, pressure to hit targets | Yes | A251 complexity; AU-C 240 .26 presumption |
| Management override of journal entries | Present in all entities | Yes | AU-C 240 |
| Allowance for credit losses | Estimation uncertainty, model use | Yes | A251 estimates with high uncertainty |
| Cash existence | Low magnitude, high volume of small transactions | No | A250 supermarket-type reasoning |
| Prepaid expenses | Straightforward, stable | No | Lower end of the spectrum |
For the first row the response set is: identify and test the contract review control if relied on; tests of details on a sample of contracts and cutoff; confirmation of contract terms (A61 of AU-C 330 shows confirmations tailored to revenue pressure); communication to governance; consideration as a KAM if engaged to report them.
Frequently asked questions
Can good controls take a risk off the significant list?
No. The determination is made on inherent risk, before considering controls. Controls affect the control risk assessment and the response, not the designation.
Is every fraud risk significant?
Yes. AU-C 240 paragraph .27 requires treating assessed fraud risks as significant risks.
Do all clients have a significant risk?
Management override is a significant risk in every entity, so effectively yes.
Sources
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (definition of significant risk, paragraphs .27, .30, .36, .37, .42, A15, A180, A247 to A254): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (paragraphs .07, .15, .22, A42, A60): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (paragraphs .26, .27 and .31): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- AICPA, AU-C Section 260 (paragraph .11, A20, A21) and AU-C Section 550 (paragraph .20): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- PCAOB, AS 2110, Identifying and Assessing Risks of Material Misstatement (issuer counterpart): https://pcaobus.org/oversight/standards/auditing-standards/details/AS2110
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error