Documenting the risk assessment so it survives review

• List the documentation requirements of AU-C 315.42.
• Structure risk assessment workpapers so the reasoning is traceable.
• Identify and fix common documentation gaps before review.

What AU-C 315.42 requires

AU-C 315.42 requires documentation of:

• (a) the engagement team discussion under AU-C 315.17-.18 and the significant decisions reached;
• (b) key elements of the understanding under AU-C 315.19, .21-.22 and .24-.25, the sources of information, and the risk assessment procedures performed;
• (c) the evaluation of design and the determination of implementation of identified controls under AU-C 315.30; and
• (d) the identified and assessed risks at the financial statement and assertion levels, including significant risks and risks for which substantive procedures alone cannot provide sufficient appropriate evidence, and the rationale for the significant judgments made.

AU-C 240.43-.46 add fraud-specific items, and AU-C 330.30 adds the responses and their linkage. AU-C 230.08 sets the overall test: an experienced auditor with no previous connection to the audit can understand what was done and why.

A file structure that works

1. Planning memo. Materiality, overall strategy, financial statement level risks and overall responses. See the audit planning memo guide.
2. Understanding of the entity. Business model, external factors, performance measures, framework and policies, and how inherent risk factors apply. Sources and procedures named.
3. Team discussion memo. Date, attendees, content, significant decisions, fraud brainstorming, and what was communicated to absent members.
4. Internal control components. Control environment, risk assessment process, monitoring and information system understanding, each with an evaluation conclusion.
5. Identified controls and IT. Controls by AU-C 315.27 category, in-scope applications, risks arising from IT, GITCs, design and implementation conclusions.
6. Risk matrix by assertion. For each material line item and disclosure: relevant assertions, inherent risk factors, likelihood and magnitude, inherent risk rating, control risk with basis, significant risk flag, substantive-only determination, response reference.
7. Stand-back memo. Material items not significant, with the reason.

Rationale, not ratings

The most common SAS 145 documentation problem is ratings without reasons. AU-C 315.42(d) requires the rationale for significant judgments. For each significant risk and each higher inherent risk, write one or two sentences that name the factors and the likelihood and magnitude conclusion. For control risk below maximum, reference the tests of operating effectiveness.

Keep it current

The risk assessment is iterative (AU-C 315.07). When fieldwork reveals new information, AU-C 315.41 requires revision, and AU-C 300.14 requires documenting significant changes to the strategy and plan. Date the revisions and show what changed. A matrix still showing December's assessment after a material misstatement found in February suggests the team did not respond.

Peer review gaps to fix before review

• No documentation of the engagement team discussion beyond attendance.
• Understanding of components without evaluation conclusions.
• Identified controls listed with no design and implementation work.
• Inherent and control risk not assessed separately.
• Control risk below maximum with no tests of controls.
• No IT applications or GITCs identified.
• No stand-back.
• Significant risks without specific responses.

Most of these are not failures of work performed. The team did the walkthrough or held the discussion but did not write down the conclusion. Fixing them costs minutes during fieldwork and hours after a review comment.

Run the file through a checklist before partner review. The audit risk assessment worksheet maps to each paragraph of AU-C 315.42. The first lesson summarizes every requirement this track covered.

Rewriting a matrix row