Definition
AU-C 330 sets the second stage of the risk-based audit. After assessing risks, the auditor designs further procedures whose nature, timing and extent respond to those risks. The nature is the type and purpose of the test, the timing is when it is done, for example at interim or year end, and the extent is the quantity, such as sample size.
Why it matters in an audit or review
The higher the assessed risk, the more persuasive the evidence required. The response can change the nature of the work, perform more at year end, or increase sample sizes. The auditor must also respond to significant risks with procedures specific to them. Further procedures must be linked to the risk, with the link visible in the file.
Example
Revenue is assessed as a significant risk for cutoff (illustrative). In response, the auditor changes the nature by testing shipping documents instead of invoices, performs the work after year end, and increases the extent to 40 shipments on each side of year end, compared with 15 the year before.
Common mistakes
- Repeating the prior year's tests despite a changed risk assessment.
- Performing interim work without testing the remaining period.
- Using inquiry as the response to a significant risk.
FAQ
Are further audit procedures only substantive?
No. They include tests of controls where the auditor plans to rely on them.
Sources
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
- AICPA, AU-C Section 315, Identifying and Assessing the Risks of Material Misstatement
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error