Significant risks: definition, determination and required responses

In this lesson you will

Apply the AU-C 315.12 definition of significant risk.
Identify risks that other AU-C sections require to be treated as significant.
List the required responses to a significant risk.

The definition

AU-C 315.12 defines a significant risk as an identified risk of material misstatement:

(i) for which the assessment of inherent risk is close to the upper end of the spectrum of inherent risk, due to the degree to which inherent risk factors affect the combination of likelihood and magnitude; or
(ii) that is to be treated as a significant risk in accordance with the requirements of other AU-C sections.

AU-C 315.36 requires you to determine whether any assessed risks are significant. The determination is based on inherent risk, before controls. A strong control does not make a risk insignificant; it may reduce control risk, but the inherent risk stays at the top of the spectrum.

Significant by rule

Some risks are significant because another section says so:

Fraud risks. AU-C 240.27 requires you to treat assessed risks of material misstatement due to fraud as significant risks. That includes the presumed fraud risk in revenue recognition (AU-C 240.26) unless you rebut it and document why (AU-C 240.46).
Related parties. AU-C 550.20 requires identified related party transactions that are also significant unusual transactions to be treated as giving rise to significant risks.
Management override. AU-C 240.31 states that the risk of management override of controls is present in all entities and is a fraud risk and, thus, a significant risk. AU-C 240.32 requires specific procedures to address it, whatever else the risk assessment concludes.

Judging "close to the upper end"

AU-C 315.A15 describes significance in the context of inherent risk factors affecting likelihood and magnitude. Areas that often land there: complex estimates with high uncertainty, significant unusual transactions, revenue arrangements with complex terms, and items management has strong incentive to influence. Use the factors from the previous lesson, not a list from last year.

Be specific about the assertion. "Inventory is a significant risk" is too broad. "Valuation of slow-moving inventory, because obsolescence reserves are judgmental and a new product line made 30% of the SKUs obsolete" is a significant risk you can respond to.

Required responses

Once a risk is significant:

Identify controls that address it and evaluate their design and implementation (AU-C 315.27(a) and .30). This is required even if you will not test them.
If you rely on those controls, test them in the current period (AU-C 330.15). You cannot rotate testing of controls over significant risks.
Perform substantive procedures specifically responsive to the risk (AU-C 330.22). If your approach consists only of substantive procedures, they must include tests of details. Analytics alone are not enough.
Document the significant risks and the rationale (AU-C 315.42(d)) and the linkage of procedures to them (AU-C 330.30).
Communicate significant risks identified by the auditor to those charged with governance as part of the planned scope and timing (AU-C 260.11).

Common findings

Only revenue and management override listed as significant, with no evaluation of other areas.
Significant risks with no identified controls or no design and implementation work.
Substantive responses that are the standard program, not specifically responsive.
Significant risk responses consisting only of analytics.
Fraud risk in revenue rebutted with "revenue is simple" and no documented reasons.

Revisit the list at completion. A significant risk identified late, such as a large unusual transaction in the last month, still needs every required response before the report date.

Use the revenue fraud risk presumption memo when you consider rebutting.

Worked example

A significant risk in warranty reserves

Stonebridge Water Heaters, Inc. reports a warranty reserve of $2.4 million; materiality is $300,000. A new tankless model launched last year now accounts for 40% of units sold, and early claims are three times the rate of older models.

Inherent risk factors: uncertainty (no claims history beyond 14 months), subjectivity (choice of claim rate), change (new product), and susceptibility to bias (management's bonus is based on operating income). Magnitude: if the claim rate assumption is off by one percentage point on $90 million of tankless sales, the effect is $900,000, three times materiality. The manager concludes inherent risk is close to the upper end: significant risk for valuation.

Responses:

Identify the controller's quarterly reserve review as a control addressing the risk; walk through it and inspect evidence of review to evaluate design and implementation.
Do not rely on the control, so control risk is maximum.
Tests of details: recompute the reserve, test claim data to source records, and develop an independent estimate using actual claims through February. The independent estimate is $2.75 million, $350,000 above recorded and above materiality. Management increases the reserve to $2.7 million. The remaining $50,000 goes on the summary of uncorrected misstatements.

Self-check

Answer each question before you open the answer.

Under SAS 145, what makes a risk significant?
Show answer
Inherent risk close to the upper end of the spectrum, based on how inherent risk factors affect likelihood and magnitude, or a requirement in another AU-C section to treat it as significant (AU-C 315.12).
Can effective controls make a risk not significant?
Show answer
No. The determination is based on inherent risk, before controls. Controls affect control risk, not whether the risk is significant.
Your only response to a significant risk is substantive. What must it include?
Show answer
Tests of details (AU-C 330.22). Substantive analytical procedures alone are not enough.
You relied on controls over a significant risk last year and they have not changed. Can you skip testing this year?
Show answer
No. AU-C 330.15 requires testing controls over significant risks in the current period when you rely on them.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error