What SAS 145 changed and when it took effect

In this lesson you will

State the effective date of SAS 145.
List the major changes SAS 145 made to risk assessment.
Identify legacy practices that no longer meet AU-C 315.

Effective date and scope

SAS 145, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, was issued in October 2021. It superseded the prior AU-C 315 and amended AU-C 330, AU-C 240 and other sections. AU-C 315.10 states it is effective for audits of financial statements for periods ending on or after December 15, 2023. Every calendar 2023 and later audit is under it.

The objective did not change: identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement and assertion levels, to provide a basis for designing responses (AU-C 315.11). What changed is how much rigor the standard demands in getting there.

The main changes

Separate assessments of inherent and control risk. AU-C 315.05 requires a separate assessment of inherent risk and control risk at the assertion level. A combined "RMM is moderate" no longer meets the standard.

Inherent risk factors and the spectrum. Inherent risk is assessed by considering likelihood and magnitude, using inherent risk factors: complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or other fraud risk factors (AU-C 315.12). The result sits on a spectrum of inherent risk.

A new significant risk definition. A significant risk is one with inherent risk close to the upper end of the spectrum, or one another AU-C section requires to be treated as significant. The old "requires special audit consideration" wording is gone.

Significant classes, balances and disclosures, and relevant assertions. These are now defined terms (AU-C 315.12) and drive the substantive procedures required by AU-C 330.18.

Control risk at maximum unless you test. AU-C 315.38: if you do not plan to test operating effectiveness, control risk is assessed at maximum and RMM equals inherent risk.

Identified controls instead of "relevant to the audit." AU-C 315.27 lists the controls you must identify, and AU-C 315.30 requires design and implementation evaluation for each.

IT. AU-C 315.28-.29 require you to identify IT applications and other aspects of the IT environment subject to risks arising from IT, those risks, and the general IT controls that address them.

A stand-back. AU-C 315.40 requires you to reconsider material items you did not deem significant, and AU-C 330.18 requires substantive procedures for each relevant assertion of each significant item regardless of control risk.

Scalability. AU-C 315.09 notes the section is intended for all entities regardless of complexity, with scalability considerations in the application material.

Habits that no longer pass

Checklists that mark every control "relevant" and walk through none of them.
One RMM rating per account without separate inherent and control risk.
Control risk assessed "moderate" with no tests of operating effectiveness.
A one-line IT note saying "off-the-shelf software, low risk" with no identification of applications or GITCs.
Significant risks limited to revenue and management override because "those are presumed."

None of these require a bigger file for a small client. They require a file where each conclusion has a stated reason. The AICPA Audit Guide Risk Assessment in a Financial Statement Audit includes scalability examples that show short, complete documentation for less complex entities.

The SAS 145 overview guide and the AU-C 315 summary give a one-page view. The rest of this track walks through each requirement in order, starting with understanding the entity.

Worked example

Upgrading a legacy risk assessment

Lakeside Paving Co.'s prior-year file rated accounts receivable "RMM: moderate" with a note "controls appear adequate." No controls were tested.

Under SAS 145 the senior rebuilds the assessment for the year ending December 31, 2026:

Inherent risk, existence of receivables: the company bills on percentage-of-completion milestones (subjectivity), with 14 open contracts at year end (complexity). Inherent risk is assessed as higher on the spectrum, not significant.
Inherent risk, valuation: two customers are in dispute, together $410,000 against performance materiality of $60,000 (uncertainty). Assessed higher; the manager concludes it is close to the upper end and designates a significant risk.
Control risk: the team will not test the billing review control. Under AU-C 315.38, control risk is at maximum, so RMM equals inherent risk for both assertions.

Because valuation is a significant risk, the team still identifies the controller's monthly review of disputed and past-due balances as a control that addresses it (AU-C 315.27(a)) and evaluates its design and implementation through a walkthrough. Substantive procedures increase: confirmations of all 14 contract balances and tests of details on the two disputed accounts.

Self-check

Answer each question before you open the answer.

When did SAS 145 become effective?
Show answer
For audits of financial statements for periods ending on or after December 15, 2023 (AU-C 315.10).
What does SAS 145 require about inherent and control risk at the assertion level?
Show answer
A separate assessment of each (AU-C 315.05). A single combined RMM rating does not meet the standard.
If the auditor does not plan to test operating effectiveness of controls, what is control risk?
Show answer
Maximum, so the assessment of the risk of material misstatement equals the assessment of inherent risk (AU-C 315.38).
Name the five inherent risk factors in the AU-C 315.12 definition.
Show answer
Complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or other fraud risk factors.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error