Risk assessment procedures

Definition

AU-C 315 requires risk assessment procedures on every audit. They include inquiries of management and others, analytical procedures, and observation and inspection. They are used to understand the entity's business, its financial reporting framework, its system of internal control, and the inherent risk factors affecting classes of transactions, balances and disclosures. SAS 145 revised AU-C 315 and applies to audits of financial statements for periods ending on or after December 15, 2023.

Why it matters in an audit or review

The assessed risks decide the nature, timing and extent of further procedures. Weak risk assessment leads to a program that tests the wrong things. These procedures do not by themselves provide enough evidence to support an opinion, but they are required and must be documented.

Example

During planning, the auditor reads the board minutes, asks the CFO about new contracts, and runs a quarter-by-quarter revenue analytic. Revenue from one distributor jumped from $0.9 million to $3.1 million (illustrative) in the fourth quarter. The result raises the assessed risk of cutoff and occurrence for revenue and leads to added procedures.

Common mistakes

• Treating the risk assessment as a form to complete rather than an analysis.
• Not following up on analytical fluctuations found in planning.
• Identifying risks at the financial statement level only.

FAQ

Are these the same as tests of controls?

No. They assess risk and understand design and implementation. They are not a test of operating effectiveness.

Sources

• AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as amended by SAS No. 145)
• AICPA, SAS No. 145, effective for audits of financial statements for periods ending on or after December 15, 2023
• AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks