SA 315 is the foundation of a risk-based financial statement audit. Instead of starting with a fixed set of vouchers, the auditor first understands the entity and its environment, including relevant internal control, identifies where material misstatement could arise, assesses those risks at the financial-statement and assertion levels, and uses that assessment to design further work. ICAI lists SA 315 in its current Engagement and Quality Control Standards library, with detailed requirements in the official SA 315 text.
What SA 315 is trying to achieve
The objective is to identify and assess risks of material misstatement, whether caused by fraud or error, at both the financial-statement level and assertion level. A financial-statement-level risk is pervasive: weak management integrity, major weaknesses in the control environment or an unreliable accounting system may affect many balances and disclosures. An assertion-level risk is more specific: year-end revenue may carry occurrence or cut-off risk, while inventory may carry existence or valuation risk.
Step 1: Perform the required risk-assessment procedures
SA 315 requires risk-assessment procedures including inquiries, analytical procedures, and observation and inspection. These help the auditor build an evidence-based understanding of the business. The standard also makes clear that risk-assessment procedures by themselves do not provide sufficient appropriate audit evidence for the audit opinion.
- Inquiries: speak with finance and, where relevant, operations, internal audit, IT, legal, sales, procurement and others who may reveal different risks.
- Analytical procedures: examine trends, ratios, margins, unusual movements and relationships that may indicate where misstatement risk is concentrated.
- Observation and inspection: inspect documents, contracts, reports, systems and processes and observe how controls operate rather than relying only on descriptions.
Step 2: Understand the entity before rating the risk
The auditor obtains an understanding of relevant industry and regulatory factors, the financial reporting framework, operations and ownership, structure and financing, accounting policies, objectives and strategies, related business risks, and how financial performance is measured and reviewed. This prevents risk assessment from becoming a generic checklist copied from the prior year.
A useful practical question is: what changed, what is complex, what is judgmental, what is unusual, and where is management under pressure? A new ERP, acquisition, major financing arrangement, aggressive sales target, complex estimate or unusual related-party transaction can materially change the risk profile.
Step 3: Understand relevant internal control properly
For controls relevant to the audit, SA 315 requires the auditor to evaluate their design and determine whether they have been implemented, using procedures in addition to inquiry. Asking whether a control exists is not enough; the auditor needs evidence that it has actually been put into operation.
The understanding covers the control environment, the entity's risk-assessment process, the information system and related business processes relevant to financial reporting, relevant control activities, and monitoring of controls. The standard also requires understanding how the entity has responded to risks arising from IT. That matters because highly automated processing can make a weakness pervasive rather than isolated.
Step 4: Convert business understanding into specific risks
The key discipline is to translate a broad concern into a specific statement of what can go wrong and then connect that risk to an assertion.
Worked example: year-end revenue
Assume a company is under strong pressure to meet an annual sales target, a large share of revenue is booked in the final two weeks, and some customer contracts contain acceptance clauses. Writing only “revenue is a significant area” is too vague.
A better risk assessment identifies the possibility that revenue is recorded before the contractual recognition point, creating an occurrence or cut-off risk. The audit response can then focus on contract terms, dispatch and acceptance evidence, subsequent credit notes, year-end cut-off testing, journal entries and other evidence relevant to that risk. The chain becomes visible: business fact → risk → assertion → audit response.
When does a risk need special audit consideration?
SA 315 requires the auditor to determine whether identified risks are significant risks requiring special audit consideration. Relevant factors include fraud risk, significant recent economic or accounting developments, transaction complexity, significant related-party transactions, subjectivity in measurement, and significant unusual transactions outside the normal course of business.
That does not mean every large balance is automatically a significant risk. Nature, susceptibility to fraud, complexity, uncertainty and the surrounding controls can make a smaller area more important than a mechanically larger balance.
Step 5: Link SA 315 to SA 330
Risk assessment matters only if it changes the audit response. ICAI's official SA 330, The Auditor's Responses to Assessed Risks, requires overall responses to assessed risks at the financial-statement level and further audit procedures whose nature, timing and extent respond to assessed risks at the assertion level.
Further procedures may include tests of controls and substantive procedures. If the identified risk concerns year-end cut-off, testing random invoices from the middle of the year is not a strong response. If the risk concerns a highly automated transaction stream, relevant controls may need to be understood and tested rather than relying only on manual substantive work.
Risk assessment must change when the evidence changes
If further audit procedures or new information contradict the assumptions used at planning stage, SA 315 requires the auditor to revise the risk assessment and modify planned procedures accordingly. A genuinely risk-based audit changes when the facts change.
Documentation checklist for a defensible SA 315 file
- Document the engagement-team discussion about susceptibility to material misstatement and significant decisions reached.
- Record the key understanding of the entity, its environment and relevant internal-control components, including sources and procedures used.
- Identify risks at both financial-statement and assertion levels.
- State what can go wrong and link each material risk to the relevant assertion.
- Document significant risks and the related controls understood for those risks.
- Show how assessed risks drive the nature, timing and extent of further procedures under SA 330.
- Update the risk assessment when new evidence changes the original conclusion.
Common mistakes to avoid
- Copying last year's risk register without reassessing current-year changes.
- Calling every material balance “high risk” without explaining the actual misstatement scenario.
- Documenting controls from inquiry alone without checking design and implementation.
- Listing risks without mapping them to assertions and responsive procedures.
- Keeping the original risk rating after evidence contradicts the planning assumptions.
- Treating risk assessment as sufficient evidence instead of a basis for further audit procedures.
ICAI's February 2026 professional article Understanding the Risk and Its Impact on Audit also illustrates the practical connection between SA 315 risk identification and SA 330 responses at transaction and account-balance level.
Practical takeaway
A strong SA 315 file does not merely label balances low, medium or high risk. It shows why a misstatement could occur, where it could affect the financial statements, which assertion is exposed, what relevant controls exist, and how the audit response addresses that risk. Another experienced auditor should be able to follow that chain without guessing why the work was performed.
