What it is
AU-C 315, as revised by SAS 145, asks the auditor to assess inherent risk and control risk separately for each relevant assertion, using the inherent risk factors: complexity, subjectivity, change, uncertainty and susceptibility to misstatement due to management bias or other fraud risk factors. The matrix gives each assertion its own row so the assessment is visible where the work is planned.
Each row records the five factor ratings, a screened indication of inherent risk, your assessment, whether it is a significant risk, whether controls will be tested, the assessed risk of material misstatement and the planned response. Check formulas catch an assessment that disagrees with the screen without explanation and a significant risk answered only by analytical procedures.
When to use it
- During risk assessment, to document the assertion-level assessment by significant class of transactions, balance and disclosure.
- When the team needs to see where significant risks sit before building the audit program.
- After changes to the entity or its environment that alter the assessment.
What’s inside
- Assertions tab listing the assertions by category, used for the drop-down
- Matrix of 40 rows with five factor ratings and a screened inherent risk indication
- Significant risk flag, control reliance, assessed risk and planned response
- Check column for no-reliance mismatches, below-screen assessments and significant risk responses
- Summary by risk level with a count of significant risks
Standard cited
This template follows AU-C 315 / AU-C 330. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 315 explained, AU-C 330 explained.
Questions
What are the inherent risk factors in AU-C 315?
Complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or other fraud risk factors, to the extent they affect inherent risk. The auditor considers how and to what degree they affect the susceptibility of each assertion to misstatement.
What is the spectrum of inherent risk?
Inherent risk is not a fixed set of boxes. It varies along a scale depending on the degree to which the factors affect the likelihood and magnitude of a possible misstatement. A significant risk is one close to the upper end of that spectrum, or one that the AU-C sections require to be treated as significant.
Which risks are always significant?
The standards require two to be treated as significant in every audit: the presumed risks of fraud in revenue recognition, unless the presumption is rebutted and documented, and the risk of management override of controls.
What if I do not test controls?
Then the assessed risk of material misstatement equals the inherent risk assessment. The check column flags a row where the two differ with no control reliance. For a significant risk answered only with substantive procedures, the procedures must include tests of details.
Related templates
- Audit Risk Assessment Worksheet (SAS 145)
- Audit Planning Memo (AU-C 300)
- Audit Walkthrough Documentation Template
- Revenue Recognition Fraud Risk Presumption Memo (AU-C 240)
Last updated 11/05/2026. All free templates.