SA 315 and SA 330 work as a pair. SA 315 helps the auditor identify what can go wrong and where a material misstatement could arise; SA 330 requires the auditor to design and perform procedures that respond to those assessed risks. A strong audit file therefore shows a visible chain from understanding the entity, to a specific risk, to the affected assertion, to the audit response, and finally to the evidence and conclusion.
ICAI’s current Engagement and Quality Control Standards repository lists both standards under risk assessment and response. The detailed requirements are in the official SA 315 text and the official SA 330 text.
Step 1: understand the business before writing risks
SA 315 requires risk assessment procedures that include inquiries, analytical procedures, and observation and inspection. The auditor also obtains an understanding of the entity and its environment, relevant accounting policies, objectives and strategies, performance measurement, and internal control relevant to the audit.
A risk register should not begin with generic phrases such as “revenue is risky.” Understand how transactions are initiated, processed, authorised, recorded and reported, including relevant IT and manual steps, and then identify the condition that could create a material misstatement.
Step 2: write the risk as a specific misstatement scenario
SA 315 requires risks to be identified and assessed at both the financial statement level and the assertion level. A financial-statement-level risk is typically pervasive: for example, weak governance or a deficient control environment may affect many balances. An assertion-level risk is more specific to a class of transactions, account balance or disclosure.
A useful risk statement describes what could go wrong, why it could happen, and which assertion is affected. For example: “Revenue may be recorded before dispatch near year-end because sales targets create pressure to accelerate billing, causing an occurrence and cut-off misstatement.”
Step 3: decide whether the risk requires special attention
SA 315 requires the auditor to determine which identified risks are significant risks. In making that judgment, the standard points to matters such as fraud risk, significant recent developments, transaction complexity, significant related-party transactions, subjectivity in measurement, and significant transactions outside the normal course of business.
Some risks cannot be addressed with sufficient appropriate evidence from substantive procedures alone, for example where highly automated processing leaves little evidence outside the IT system. In those circumstances, relevant controls become important to the audit approach.
Step 4: separate overall responses from assertion-level procedures
SA 330 first requires overall responses to financial-statement-level risks. Depending on the circumstances, these may include more experienced staff, greater supervision, unpredictability, changes in procedure timing or nature, and reinforced professional scepticism.
At the assertion level, the auditor designs further audit procedures whose nature, timing and extent respond to the assessed risk. As assessed risk increases, the auditor ordinarily seeks more persuasive audit evidence. The response should therefore be driven by the reason for the risk assessment, not by a standard programme copied from another engagement.
Step 5: know when tests of controls are necessary
Under SA 330, tests of controls are required when the auditor plans to rely on the operating effectiveness of controls in determining substantive procedures, or when substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level.
Understanding that a control exists is not the same as testing whether it operated effectively. SA 315 requires evaluation of design and implementation using procedures in addition to inquiry. Under SA 330, inquiry alone is also insufficient for testing operating effectiveness; combine it with procedures appropriate to the control, such as inspection, observation or reperformance.
Step 6: remember that substantive procedures do not disappear
SA 330 requires substantive procedures for each material class of transactions, account balance and disclosure regardless of assessed risk. A controls-reliance strategy therefore does not mean “no substantive work”; it affects the nature, timing or extent of that work.
For a significant risk, if the planned response consists only of substantive procedures, SA 330 requires those procedures to include tests of details. The auditor should also perform procedures relating to the financial statement closing process, including agreeing or reconciling the financial statements with the underlying accounting records and examining material journal entries and other adjustments made during preparation.
Worked example: year-end revenue cut-off
Assume a B2B company has aggressive annual sales targets and allows manual revenue journals near year-end. During the risk assessment, the auditor identifies pressure to accelerate sales and notes that non-standard entries can be posted by a small finance team. The risk is stated as: revenue may be recorded before the underlying sale has occurred, affecting occurrence and cut-off.
The auditor then identifies relevant controls, such as approval of non-standard revenue entries and controls linking invoices to dispatch or customer acceptance. If the audit strategy relies on those controls, the auditor tests their operating effectiveness. Substantive responses may include inspecting contracts and invoices, testing dispatch or acceptance evidence around year-end, examining subsequent credit notes, testing selected manual journals, and performing other procedures responsive to the specific risk.
If control testing shows repeated exceptions, the auditor should not leave the original plan untouched. The reliance decision and assessed risk may need revision, and substantive procedures may need to become more extensive or more persuasive.
Step 7: reassess when new evidence changes the picture
Risk assessment is not frozen at planning. SA 315 requires revision when further evidence contradicts the basis of the original assessment. Before concluding, SA 330 requires evaluation of whether the assessments remain appropriate and sufficient appropriate audit evidence has been obtained.
An unexpected control failure, unusual journal pattern or contradictory evidence may therefore change both the risk assessment and the required response.
Practical audit-file checklist
- Describe the business process and relevant accounting flow before finalising the risk.
- Write the risk as a concrete misstatement scenario rather than a generic account heading.
- Identify whether the risk is financial-statement-level or assertion-level.
- Document the relevant assertion and the reason for the risk assessment.
- Record whether the risk is significant and why.
- Identify relevant controls and document design and implementation where required.
- State whether control reliance is planned and, if so, perform appropriate tests of controls.
- Link each further audit procedure to the assessed risk and assertion.
- Perform the substantive procedures required for material classes, balances and disclosures.
- Record exceptions, their impact on reliance, any reassessment, and the final conclusion.
Common mistakes to avoid
- Copying last year’s risks without considering current-year changes.
- Using vague descriptions such as “high risk” without explaining the possible misstatement.
- Treating inquiry as enough evidence that a control is implemented or operating effectively.
- Designing procedures that do not clearly address the affected assertion.
- Assuming strong controls eliminate the need for substantive procedures on material areas.
- Failing to revise the audit approach after control deviations or contradictory evidence.
For another practical perspective, ICAI’s Chartered Accountant Journal article on risk and its impact on audit discusses how risk identification can be made more operational at the transaction and account-balance level.
Practical takeaway
The cleanest way to apply SA 315 and SA 330 is to make the audit trail explicit: understand the entity, identify a precise risk, map it to the relevant assertion, decide whether controls matter, design procedures that respond to the assessed risk, evaluate the results, and reassess when evidence changes. If another reviewer can follow that chain without guessing why a procedure was performed, the risk-response linkage is far more defensible and useful.
