AU-C 330 Responding to Assessed Risks: Tests of Controls and Substantive Procedures

AU-C section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained, is the second half of the audit risk process in a GAAS audit of a nonissuer. AU-C 315 identifies and assesses the risks of material misstatement. AU-C 330 sets out how the auditor responds: the overall response, then the further audit procedures (tests of controls and substantive procedures) tied to each assessed risk. SAS No. 145, which revised AU-C 315, also made conforming changes to AU-C 330, effective for audits of periods ending on or after December 15, 2023.

This page paraphrases the standard. The authoritative text is AU-C 330 in AICPA Professional Standards. It is written to be read with AU-C 315.

What is the objective of AU-C 330?

The auditor's objective is to obtain sufficient appropriate audit evidence about the assessed risks of material misstatement, through designing and implementing appropriate responses to those risks.

Each assessed risk needs a procedure that answers it, and the file has to show the link.

Overall responses

At the financial statement level, the auditor designs and implements overall responses to the assessed risks of material misstatement. Typical overall responses, as examples:

• emphasizing to the team the need to maintain professional skepticism
• assigning more experienced staff or specialists
• more supervision
• incorporating unpredictability in the selection of procedures
• changes in the general nature, timing or extent of procedures, such as performing substantive procedures at period end rather than at an interim date

The assessment of risks at the financial statement level, and so the choice of overall responses, is influenced by the auditor's understanding of the control environment.

Further audit procedures: nature, timing and extent

The auditor designs and performs further audit procedures whose nature, timing and extent are based on, and responsive to, the assessed risks of material misstatement at the assertion level. The higher the assessed risk, the more persuasive the evidence needed. The auditor considers:

• the significance of the risk and the likelihood of a material misstatement
• the characteristics of the class of transactions, account balance or disclosure, including its inherent risk factors
• whether the auditor plans to rely on the operating effectiveness of controls
• the nature of the specific controls and whether they are relevant

Nature is the purpose (test of controls or substantive) and type (inspection, observation, inquiry, confirmation, recalculation, reperformance or analytical procedure). Timing is when procedures are performed or the period the evidence covers. Extent is the quantity, such as sample size or the number of observations.

When must the auditor test controls?

The auditor designs and performs tests of controls to obtain sufficient appropriate evidence about operating effectiveness when either:

• the auditor's assessment of risks of material misstatement at the assertion level expects that controls are operating effectively (the auditor intends to rely on controls to reduce substantive procedures), or
• substantive procedures alone cannot provide sufficient appropriate evidence at the assertion level. This is common for highly automated, high-volume processing where there is little or no manual evidence outside the system.

Otherwise, testing controls is an efficiency choice. See substantive testing vs tests of controls.

A few rules apply when the auditor tests controls:

• Tests of controls include inquiry combined with other procedures. Inquiry alone is not enough to test operating effectiveness.
• The auditor tests controls at the times they operated and for the period of reliance. Interim testing needs further evidence for the remaining period.
• Where information produced by the entity is used in a control, the auditor evaluates whether it is reliable enough for the purpose. See AU-C 500.
• If deviations from controls are found, the auditor makes specific inquiries about them and the consequences, and determines whether the tests provide an appropriate basis for reliance. The auditor then considers whether to do more.

Using audit evidence about controls from prior audits

The auditor may use evidence from prior audits about operating effectiveness, but only after determining whether it is still relevant. This means establishing whether changes have occurred since the prior audit that affect that relevance, usually by inquiry combined with observation or inspection. If controls changed, the auditor tests them in the current audit.

AU-C 330 also sets rules for controls that address significant risks and for how often unchanged controls must be retested. A rotation plan is a firm practice choice that has to stay within those rules, and the file should show the reasoning behind it.

Substantive procedures: the SAS 145 wording

Whatever the assessed risks, the auditor designs and performs substantive procedures for each relevant assertion of each significant class of transactions, account balance and disclosure. This is the SAS 145 wording. It replaces the earlier requirement tied to each material class of transactions, account balance and disclosure.

What this means in practice:

• "Relevant assertion" and "significant class of transactions, account balance or disclosure" are the terms defined in AU-C 315. A class is significant if there are one or more relevant assertions. A relevant assertion is one with an identified risk of material misstatement, determined before considering controls.
• The requirement applies even if the assessed risk is low, and even if the auditor tested controls. Evidence from tests of controls does not replace substantive work.
• The nature of the substantive work should respond to the assessed risk. For a low risk, an analytical procedure may do. For a higher risk, tests of details are usually needed.

See AU-C 315 for how relevant assertions and significant classes are identified, and audit assertions for the assertion framework.

Substantive procedures for significant risks

If the auditor determined that an assessed risk at the assertion level is a significant risk, the auditor performs substantive procedures that are specifically responsive to it. If the response to a significant risk consists only of substantive procedures, those procedures must include tests of details. That is, substantive analytical procedures alone cannot answer a significant risk.

For significant risks, the auditor also obtains an understanding of the controls relevant to the risk under AU-C 315, so the response is incomplete without that understanding.

Substantive analytical procedures and tests of details

Tests of details suit assertions such as existence, accuracy and valuation. Substantive analytical procedures suit large volumes of predictable transactions. When designing tests of details, the auditor determines the extent of testing, including through audit sampling under AU-C 530, or by testing specific items, or all items.

External confirmations

Under the current AU-C standards, there is a presumption that the auditor will request confirmation of accounts receivable. The auditor can overcome it only in the circumstances the standards list, such as receivables being immaterial, confirmation being ineffective, or the assessed risk being low with other substantive procedures addressing it, and documents the basis. See AU-C 505 and the audit confirmations guide.

SAS No. 150, External Confirmations, issued by the Auditing Standards Board in July 2026, mainly revises AU-C 505 and also amends other sections, including AU-C 330. It applies to audits of financial statements for periods ending on or after December 15, 2028. Among its changes, it requires external confirmation of cash and cash equivalents held by third parties when needed to respond to assessed risks of material misstatement, unless specific exceptions apply. See AU-C 505.

Substantive procedures at an interim date

If substantive procedures are performed at an interim date, the auditor covers the remaining period by performing substantive procedures, or substantive procedures combined with tests of controls, that give a reasonable basis for extending the conclusions to period end. The auditor compares and reconciles period-end information with the interim information, and investigates unusual amounts. The higher the risk, the less appropriate interim testing is. Also, interim testing is less suitable if there is an unpredictable element in the risk, such as unusual year-end transactions.

The financial statement closing process

The auditor's substantive procedures include procedures related to the financial statement closing process. They include:

• agreeing or reconciling the financial statements, including disclosures, to the underlying accounting records, including those from outside the general ledger
• examining material journal entries and other adjustments made during the preparation of the financial statements

The nature and extent of that work depend on the complexity of the entity's reporting process and the associated risks. This work links to journal entry testing under AU-C 240.

Evaluating the sufficiency and appropriateness of audit evidence

Before concluding, the auditor evaluates whether the assessments of risk at the assertion level remain appropriate, based on the audit procedures performed and the evidence obtained. If they do not, the auditor revises the assessment and modifies the planned procedures. The auditor also concludes whether sufficient appropriate evidence has been obtained. In forming the conclusion, the auditor considers all relevant evidence, whether it corroborates or contradicts the assertions. If the auditor has not obtained sufficient appropriate evidence about a relevant assertion, the auditor tries to get more. If still not, the auditor expresses a qualified opinion or disclaims, per AU-C 705.

Documentation

The auditor documents the overall responses to the assessed risks at the financial statement level, the nature, timing and extent of further audit procedures, the linkage of those procedures with the assessed risks at the assertion level, and the results, including conclusions where not otherwise clear. If planning to use evidence about controls from prior audits, the auditor documents the conclusions about reliance. The documentation must allow another experienced auditor to see which risk each procedure answers. See AU-C 230.

File checks on responses to risk

These are practice checks, not requirements of the standard. Weaknesses to look for:

• Audit programs that are standard across clients and do not change with the assessed risks
• Significant risks addressed by analytical procedures alone
• Substantive procedures not documented for a relevant assertion of a significant class
• Reliance on controls with only inquiry as the test
• Interim testing with no roll-forward procedures
• Confirmation of receivables skipped with no stated reason

Related

• AU-C 315 risk assessment and SAS 145
• AU-C 530 audit sampling
• Substantive testing vs tests of controls
• Audit risk assessment worksheet

Sources

• AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (AICPA Professional Standards)
• AICPA, SAS No. 145 (conforming amendments to AU-C 330; periods ending on or after December 15, 2023)
• AICPA, SAS No. 150, External Confirmations (periods ending on or after December 15, 2028)
• AICPA & CIMA, "SAS 150: New requirements related to external confirmations" (July 2026), https://www.aicpa-cima.com/resources/article/sas-150-new-requirements-related-to-external-confirmations
• RSM US, "AICPA confirmations auditing standard", https://rsmus.com/insights/financial-reporting/aicpa-confirmations-auditing-standard.html
• AICPA, AU-C Sections 230, 240, 315, 500, 505, 530 and 705 (cross-referenced sections)

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error