Both standards ask the auditor to use a substantive analytical procedure the same way: build an expectation from plausible relationships, check the data behind it, decide how large a difference can be accepted, compare, and investigate what falls outside. The two texts differ on emphasis, on what must be done about data reliability, and on when the work has to be documented.
For the three-stage walkthrough of planning, substantive and final-review analytics under AICPA standards, see analytical procedures under AU-C 520. To build the expectation step by step, see building expectations and thresholds. This guide puts the two standards next to each other.
Where does each standard stop?
AU-C 520 covers two things: substantive analytical procedures and the overall review near the end of the audit (paragraphs .01, .05 and .06). Risk assessment analytics are in AU-C 315.
AS 2305 covers only substantive analytics. Its notes in paragraph .01 send risk assessment analytics to AS 2110 and the overall review to AS 2810. If you work under PCAOB standards, three standards govern what AU-C 520 handles in one.
What makes a substantive analytic suitable?
AU-C 520 paragraph .05a requires the auditor to decide whether a procedure suits a given assertion, taking into account the assessed risks and any tests of details. A8 lists four drivers of effectiveness and efficiency: the nature of the assertion, the plausibility and predictability of the relationship, the availability and reliability of the data, and the precision of the expectation. AS 2305 paragraph .11 lists the same four.
Both add the same practical points:
- Relationships in a stable environment are more predictable than in a dynamic one, and income statement accounts are more predictable than balance sheet accounts (AU-C 520 A10, AS 2305 paragraph .14).
- Transactions subject to management discretion, such as maintenance spending or advertising, are less predictable.
- Analytics suit large volumes of transactions that are predictable over time (A11).
Can analytics be the only procedure for a significant risk?
The wording differs here. AS 2305 paragraph .09 says that for significant risks of material misstatement, it is unlikely that audit evidence from substantive analytical procedures alone will be sufficient. Paragraph .10 adds that the auditor evaluates the risk of management override of controls when designing the procedures, because adjustments outside the normal period-end process could artificially change the relationships being analyzed, and says substantive analytics alone are not well suited to detecting fraud.
AU-C 520 has no equivalent sentence. The limit comes from AU-C 330 paragraph .22: for a significant risk, the auditor performs substantive procedures specifically responsive to the risk, and when the approach is substantive procedures only, they include tests of details. AU-C 330 A9 gives the allowance for doubtful accounts as a case where procedures beyond analytics, such as examining subsequent cash collections, are needed because of override risk or subjectivity. See significant risks under AU-C 315.
What must be done about the data?
AU-C 520 paragraph .05b requires the auditor to evaluate the reliability of the data behind the expectation, taking into account source, comparability, nature and relevance, and controls over preparation. A19 says the auditor may consider testing controls over the preparation of the information.
AS 2305 paragraph .16 is firmer. Before using results, the auditor should either test the design and operating effectiveness of controls over the financial information used or perform other procedures to support its completeness and accuracy. It lists reliability factors: whether the data came from outside the entity, whether internal sources are independent of those responsible for the amount, whether it came from a reliable system with adequate controls, whether it was audit tested in the current or prior year, and whether the expectation used data from several sources.
In practice, for either standard, tie the inputs (units, rates, headcount, budget) to something you have tested.
How precise must the expectation be?
Both tie precision to what the analytic is doing. AU-C 520 A21 says a less precise expectation may be appropriate when the result will be combined with tests of details, and a more precise one is necessary when the analytic is the only procedure for a risk. A22 and A23 say more precise expectations narrow the range of expected differences, and that monthly amounts may be more effective than annual ones and comparisons by location or line of business more effective than company-wide ones, because disaggregation reduces the risk that offsetting factors hide misstatements. AS 2305 paragraphs .17 to .19 make the same points.
How big a difference can be accepted?
AU-C 520 paragraph .05d requires the auditor to determine the amount of difference from expectation acceptable without further investigation. A24 says it is influenced by materiality and the desired level of assurance, and that as assessed risk goes up, the acceptable difference goes down. AS 2305 paragraph .20 says the amount is influenced primarily by materiality, consistent with the assurance desired, and considers the possibility that misstatements aggregate to an unacceptable amount.
Neither standard sets a percentage. Document your threshold and why it fits the risk.
What happens when the difference is too big?
AU-C 520 paragraph .07: inquire of management and obtain appropriate audit evidence relevant to the responses, and perform other procedures as necessary. AS 2305 paragraph .21 says management responses should ordinarily be corroborated with other evidence, and if no explanation is available, the auditor obtains sufficient evidence through other procedures, treating unexplained differences as a sign of increased risk.
What do you document?
| Item | AS 2305 (paragraph .22) | AU-C 520 (paragraph .08) |
|---|---|---|
| Trigger | When an analytic is the principal substantive test of a significant assertion | Whenever substantive analytics are performed |
| The expectation and factors | Yes, if not readily determinable | Yes, if not readily determinable |
| Comparison results | Yes | Yes |
| Follow-up procedures and results | Yes | Yes |
AU-C 520 therefore sets a lower trigger. A firm that audits both types of clients can use the stricter trigger for all of them.
Worked example: rental income
A client owns a 48-unit building. The auditor builds an expectation from rent rolls, which A13 of AU-C 520 cites as an example of a predictable analytic.
- Average contract rent: $1,450 per month
- Vacancy: 6 percent, from the prior year and the leasing report (tested for completeness)
- Expected rental income: 48 units x $1,450 x 12 months x (1 - 0.06) = $785,088
Recorded rental income is $805,000. The difference is $19,912, or 2.5 percent. Because the analytic is the only procedure planned for this risk, and performance materiality is $60,000, the auditor sets the acceptable difference at $15,000. This is an illustrative figure and is set by judgment, not by either standard.
The difference exceeds the threshold, so the auditor inquires. Management says two units were renovated and now rent at $1,950. That explanation is corroborated by inspecting the two new leases. The adjusted expectation adds 2 x $500 x 12 x 0.94 = $11,280, for $796,368. The remaining difference is $805,000 - $796,368 = $8,632, inside the threshold. The file contains the rent roll tie-out, the expectation, the $15,000 threshold and its basis, the comparison, the management response, and the lease inspection.
Frequently asked questions
Can I rely on management's explanation of a variance?
Not by itself. Both standards require corroborating evidence for the explanation.
Do the standards allow analytics instead of tests of details?
Yes, where the analytic is suitable and precise enough. AU-C 330 A48 says substantive analytics alone can be enough, for example when risk is supported by evidence from tests of controls. AS 2305 paragraph .04 says analytics can sometimes be more effective or efficient than tests of details.
Sources
- AICPA, AU-C Section 520, Analytical Procedures (paragraphs .05 to .08, A7 to A24): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (paragraph .22, A9, A48): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- PCAOB, AS 2305, Substantive Analytical Procedures (paragraphs .01 to .22): https://pcaobus.org/oversight/standards/auditing-standards/details/AS2305
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error