AU-C section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, is the starting point of every GAAS audit of a nonissuer. SAS No. 145 revised it, and the revised standard applies to audits of financial statements for periods ending on or after December 15, 2023.
This page paraphrases the standard. The authoritative text is AU-C 315 in AICPA Professional Standards.
What is the objective of AU-C 315?
The auditor's objective is to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement level and the assertion level. That assessment gives the auditor a basis for designing and implementing responses to the assessed risks (the further audit procedures in AU-C 330).
Every procedure in the file should trace back to an assessed risk. A risk assessment that stays in the planning memo and never drives the audit program does not meet that aim.
What changed with SAS 145?
SAS 145 did not change the audit risk model, but it made the process more explicit and more structured. The changes that affect daily work:
- Inherent risk and control risk are assessed separately. The auditor assesses inherent risk, then separately assesses control risk.
- Inherent risk factors and a spectrum. The standard names the factors that affect inherent risk and asks the auditor to place each identified risk on a spectrum from low to high.
- A revised definition of significant risk. A significant risk is now tied to the upper end of that spectrum.
- Relevant assertions are defined more tightly. An assertion is relevant when there is an identified risk of material misstatement for it.
- A stand-back requirement. After assessing risks, the auditor steps back and evaluates whether anything material was missed.
- More on IT. The auditor identifies the IT applications and other IT aspects relevant to the audit, the risks that arise from their use and the general IT controls that address those risks.
- Scalability language. The standard says the work should scale with the size and complexity of the entity, and the application material gives examples for smaller, less complex entities.
Risk assessment procedures
The standard requires the auditor to perform risk assessment procedures that provide a basis for identifying and assessing risks. The procedures are:
- inquiries of management and others within the entity
- analytical procedures
- observation and inspection
Risk assessment procedures do not, on their own, provide sufficient appropriate audit evidence for the opinion. Information from client acceptance or continuance and from prior-year audits can be used, but the auditor has to consider whether it is still relevant and reliable.
The engagement partner and key members of the team also discuss the susceptibility of the financial statements to material misstatement. That discussion is a required step. See the documentation section below.
What must the auditor understand?
AU-C 315 asks for an understanding of three broad areas.
The entity and its environment. This covers the entity's organizational structure, ownership and governance, business model, industry and regulatory factors, the applicable financial reporting framework and how the entity measures its own performance.
The applicable financial reporting framework and accounting policies. The auditor considers how the framework applies to the entity's circumstances, and whether the accounting policies are appropriate and consistent with the framework and the industry.
The system of internal control. The standard describes five components of the system of internal control:
| Component | What the auditor is looking at |
|---|---|
| Control environment | Tone at the top, governance, management's attitude to controls |
| The entity's risk assessment process | How management identifies and responds to business risks |
| The entity's process to monitor the system of internal control | How management checks that controls keep working |
| The information system and communication | How transactions are initiated, recorded, processed and reported |
| Control activities | Authorization, reconciliations, segregation of duties, IT controls |
For the first four components, the auditor obtains an understanding and evaluates them, for example whether the control environment provides an appropriate foundation for the other components and whether the information system supports the preparation of the financial statements. For control activities, the auditor identifies specific controls (listed below) and evaluates their design and whether they have been implemented.
What are inherent risk factors?
Inherent risk factors are characteristics of events or conditions that affect the susceptibility of an assertion to misstatement before considering controls. SAS 145 lists them as:
- complexity
- subjectivity
- change
- uncertainty
- susceptibility to misstatement due to management bias or other fraud risk factors, to the extent they affect inherent risk
Use them as a vocabulary for the risk assessment. A revenue stream with variable consideration scores on complexity and subjectivity. A new accounting system scores on change. A long-lived estimate with unobservable inputs scores on uncertainty and subjectivity.
What is the spectrum of inherent risk?
For each identified risk of material misstatement, the auditor assesses inherent risk by considering how likely a misstatement is and how large it could be, given the inherent risk factors. The result sits somewhere on a spectrum from lower to higher. The standard does not set fixed categories, so a firm can use low / moderate / high, or a numeric scale, as long as the assessment reflects the spectrum and is applied consistently.
A significant risk is an identified risk of material misstatement whose assessment is close to the upper end of the spectrum. Other AU-C sections also require certain risks to be treated as significant. In AU-C 240, for example, the presumed risk of fraud in revenue recognition is treated as a significant risk unless rebutted.
Significant risks matter because they bring extra requirements: the auditor must obtain an understanding of the controls relevant to them, and AU-C 330 requires specific responses.
Which controls must the auditor identify?
The auditor does not need to understand every control. Older versions of the standard called these "controls relevant to the audit". SAS 145 instead lists the controls in the control activities component that the auditor must identify:
- controls that address a significant risk
- controls over journal entries, including non-standard journal entries
- controls the auditor plans to test for operating effectiveness, including those addressing risks where substantive procedures alone cannot provide sufficient appropriate evidence
- other controls the auditor judges appropriate
For each of those, the auditor evaluates whether the control is designed effectively and whether it has been implemented. Implementation is established by inquiry plus another procedure, typically observation or inspection. Inquiry alone does not establish it.
If the auditor does not plan to test the operating effectiveness of controls, the control risk assessment is set so that the assessed risk of material misstatement is the same as the inherent risk assessment (in practice often described as assessing control risk at the maximum).
IT: applications, risks and general IT controls
For the controls identified in the control activities component, the auditor identifies the IT applications and other aspects of the IT environment that those controls depend on, and the risks arising from the use of IT. The auditor then identifies the general IT controls (for example, over access, program changes and operations) that address those risks.
Risks from IT include unauthorized access to data, unauthorized changes to programs or data and failures in automated processing. If the entity's IT environment is simple, for example off-the-shelf accounting software with no custom code and limited access, the work may be limited, and the file should say why.
The stand-back evaluation
After the risks are assessed, the auditor evaluates whether the assessment is complete. The stand-back asks specifically about classes of transactions, account balances and disclosures that are quantitatively or qualitatively material but were not determined to be significant classes (that is, no relevant assertion was identified for them). For each one, the auditor concludes whether the assessment of that item is appropriate. This prevents a file where a material balance, such as inventory or a large related-party loan, drops through because nobody assessed it.
What must be documented?
AU-C 315 asks the auditor to document:
- the discussion among the engagement team and the significant decisions reached
- key elements of the understanding of the entity, its environment, the framework and the system of internal control, and the sources of that understanding
- the evaluation of the design of identified controls and the determination that they have been implemented
- the identified and assessed risks of material misstatement at the financial statement level and the assertion level, including significant risks and risks where substantive procedures alone are not sufficient, and the rationale for significant judgments made
AU-C 230 sets the general documentation standard for all of this. See AU-C 230 audit documentation.
File checks on risk assessment
These are practice checks, not requirements of the standard. Weaknesses to look for:
- Risks are not assessed at the assertion level, only at a general or financial statement level
- The audit program is not linked to the risk assessment, so procedures do not trace to a risk
- No documentation of the specific response to each identified risk
- A planning checklist is completed with "N/A" or boilerplate and no entity-specific content
- Inherent risk and control risk are combined in a single rating
- Controls are described, but not evaluated for design and implementation
- The team discussion is not documented or has no real content
- IT is ignored for entities that clearly rely on it
How to scale the work for a smaller audit
The application material gives scalability examples for smaller, less complex entities. A small not-for-profit with one bookkeeper still needs the same structure, but each step can be short. What cannot be skipped is the logic: understand the entity, identify what could go wrong, assess it, respond to it, and link the response to the risk.
Related
- AU-C 230 audit documentation
- AU-C 320 materiality
- AU-C 530 audit sampling
- Audit working papers: types and how to prepare them
- Materiality calculator (AU-C 320)
Sources
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (AICPA Professional Standards), as revised by SAS No. 145 (audits of periods ending on or after December 15, 2023)
- AICPA, AU-C Sections 230, 240 and 330 (cross-referenced sections)
Part of CORAA University · Planning and risk assessment: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error