Definition
A significant risk is an identified risk of material misstatement for which the assessed inherent risk is close to the upper end of the spectrum. Likelihood and magnitude both drive that judgment. Fraud risks are treated as significant risks, and under AU-C 240 so is the risk of management override of controls.
Why it matters in an audit or review
Significant risks get a response the routine plan does not cover. The auditor obtains an understanding of the controls that address them, evaluates their design and implementation, and cannot rely only on analytics: substantive procedures specific to the risk are required. If the auditor plans to rely on controls for a significant risk, those controls are tested in the current period. Communicating significant risks to those charged with governance is also part of the work under AU-C 260.
Example
A software company signs multi-element contracts with nonstandard acceptance terms in the last week of the quarter. The auditor designates revenue cutoff and allocation as a significant risk, reads each large contract, tests the timing of acceptance, and extends the testing to contracts signed in the first two weeks after year end.
Common mistakes
Labeling every high-dollar account as a significant risk. The label is about the risk of misstatement, not the size of the balance.
Sources
- AICPA, AU-C Section 315 (as amended by SAS No. 145)
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
- AICPA, AU-C Section 260, The Auditor's Communication With Those Charged With Governance
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error