AU-C 330: Performing Audit Procedures for Assessed Risks

AU-C 330 is the AICPA auditing standard that tells an auditor of a non-issuer how to respond to the risks of material misstatement identified under AU-C 315. It requires overall responses at the financial statement level, further audit procedures (tests of controls and substantive procedures) designed at the assertion level, and an evaluation of whether the evidence obtained is sufficient and appropriate to support the opinion. The standard was updated through conforming amendments when SAS No. 145 overhauled AU-C 315, effective for audits of periods ending on or after December 15, 2023.¹

Overall Responses at the Financial Statement Level

Before designing procedures for individual accounts, the auditor sets the overall engagement response to assessed risks. The most fundamental piece is maintaining heightened professional skepticism across the team, which means not accepting evidence at face value and questioning management representations more aggressively when risks are elevated.

Staffing is part of the response. When risks are high, particularly fraud risk or complex accounting judgments, the standard calls for assigning team members with more experience or specialized knowledge. An auditor dealing with fair value estimates on exotic financial instruments needs someone on the team who understands the valuation models, not a staff auditor running a standard confirmation.

The nature, timing, and extent of the overall approach also shift with the risk profile. A common adjustment is moving substantive testing from interim dates to the period end, because year-end evidence is more direct and harder to manipulate. The auditor may change the mix of procedures as well, leaning on external evidence sources when internal evidence seems less reliable, or expanding coverage to locations or subsidiaries that would not normally get detailed attention.

One boundary worth noting: the requirement to incorporate an element of unpredictability into procedures comes from AU-C 240, the fraud standard, not AU-C 330.² It dovetails with the overall response framework, but the authority sits elsewhere.

Designing Further Audit Procedures Linked to Assertions

AU-C 330 requires the auditor to design further audit procedures whose nature, timing, and extent are responsive to and clearly linked with the assessed risks at the assertion level.¹ The phrase “assertion level” is doing real work. You do not respond to a general sense that accounts receivable is risky; the response targets the specific assertion at risk, whether that is existence (are these receivables real?), valuation (are they recorded at the right amount?), or completeness (are all receivables captured?).

Further procedures fall into two categories:

Tests of controls, which evaluate whether the entity’s internal controls are operating effectively. The auditor runs them when planning to rely on controls to reduce substantive work.
Substantive procedures, aimed directly at detecting material misstatements in balances, transaction classes, or disclosures. These come as tests of details (examining specific items) or substantive analytical procedures (analyzing relationships in the data for unexpected patterns).

The interplay matters. A high-risk assertion demands more persuasive evidence, which typically means tests of details performed at or near year-end with a larger sample. A lower-risk assertion might be handled with a substantive analytical procedure at an interim date. A single dual-purpose test can evaluate a control’s effectiveness and provide substantive evidence about the underlying transactions at the same time, but each component must be evaluated against its own criteria.

Tests of Controls

Testing controls is not optional in two situations. First, when the risk assessment assumes controls are operating effectively; you cannot reduce substantive testing based on a control you have not tested. Second, when substantive procedures alone cannot provide enough evidence. The second scenario is common in heavily automated environments. If every sales transaction is initiated, processed, and recorded electronically with no paper trail, you have to test the IT general controls and application controls that govern the system.

Evidence must cover the entire period of intended reliance, not just a single day. How much evidence depends on how frequently the control operates and how much reliance is planned. A control that runs with every transaction, such as an automated three-way match, requires different testing than a monthly bank reconciliation review. Higher reliance means a larger sample.

Using Prior-Period Evidence

The standard allows an auditor to use evidence from a prior audit about control effectiveness, but with guardrails. Before relying on last year’s testing, the auditor must perform inquiry combined with observation or inspection to confirm the control has not changed. Inquiry alone is not enough. If the control environment, personnel, or systems have changed in ways that affect the control, prior-period evidence is no longer relevant and the control must be retested.³

Even when nothing has changed, each control must be tested at least once every third audit on a rotation basis. Controls that address a significant risk get no such grace period. Those must be tested in the current period every year.³

When a Control Fails

If testing shows a control is not working as designed, you cannot note the failure and move on. The initial control risk assessment must be revised upward, and the planned substantive procedures must be expanded in nature, timing, or extent (often all three) to compensate. A control that was supposed to reduce the risk of revenue overstatement now leaves that risk unaddressed, and more detailed testing of revenue transactions is needed to fill the gap.

Substantive Procedures

Every material class of transactions, account balance, and disclosure requires substantive procedures regardless of the assessed risk level. Even if controls are strong and inherent risk is low, some substantive work is always required. The standard does not allow testing controls alone and calling it done.

For significant risks, the rule is sharper. When the approach to a significant risk relies only on substantive procedures with no control reliance, those procedures must include tests of details. Substantive analytical procedures alone are not sufficient for a significant risk.⁴ Analytical procedures identify anomalies but do not examine individual items, and significant risks require the most direct evidence available.

Substantive analytical procedures work best for large, predictable populations. Payroll expense for a company with stable headcount and known salary rates is a natural candidate; you can build an expectation and compare it to the recorded amount with high precision. For areas involving judgment, unusual transactions, or existence questions, tests of details are typically necessary. You cannot analytically review whether inventory physically exists. You have to count it.

External Confirmations

When the combined assessed level of inherent and control risk is high, external confirmations are particularly valuable because they provide evidence from a source independent of the entity. For unusual or complex transactions with elevated risk, consider confirming the terms directly with the counterparty rather than relying solely on documents the entity holds. A year-end sale with unusual terms is exactly where a confirmation provides evidence that internal records cannot match.

Interim Testing and Roll-Forward Procedures

Performing substantive work before year-end creates efficiency but also creates a gap: the period between the interim date and the balance sheet date. Any misstatement arising in that roll-forward period would be missed by the interim work. The auditor must bridge the gap.

Roll-forward procedures typically compare the interim balance to the year-end balance and investigate unusual movements, or apply targeted substantive tests on transactions during the intervening period. Control effectiveness over the roll-forward period matters too. If controls are weak during that window, the roll-forward procedures need to be more extensive, potentially negating the efficiency gain of interim testing in the first place.

Evaluating the Evidence Obtained

After completing planned procedures, the auditor reconsiders whether the initial risk assessments still hold up in light of the evidence gathered. If the evidence suggests risk is higher than originally assessed, because a control failed or a test of details revealed more errors than expected, the auditor must perform additional procedures. The risk assessment is not locked at planning.

Contradictory evidence gets special attention. If one procedure points one way and another points the opposite way, the auditor cannot cherry-pick the favorable result. The discrepancy must be investigated and resolved before forming an opinion.

The auditor also aggregates all identified misstatements, both the specific errors found in testing and projected misstatements extrapolated from samples, and compares the total to the established materiality level. If the aggregate exceeds materiality, the financial statements are materially misstated, and management needs to correct them or the opinion will reflect the problem.

A related requirement under AU-C 520 calls for analytical procedures near the end of the audit to form an overall conclusion about whether the financial statements are consistent with the auditor’s understanding of the entity.⁵ That standard sits alongside AU-C 330, not inside it, but the two work in tandem at the evaluation stage.

When Evidence Remains Insufficient

If sufficient appropriate evidence has not been obtained despite performing all feasible procedures, AU-C 330 requires action. The auditor must first attempt additional procedures to close the gap. If the gap cannot be closed, perhaps because the client cannot produce needed records, or a confirmation response never arrives and alternative procedures fall short, the opinion must be modified. Depending on severity and pervasiveness, the result is a qualified opinion (the limitation affects specific areas) or a disclaimer of opinion (the limitation is so pervasive that no opinion can be formed).

Documentation

AU-C 330 requires the auditor to document the linkage between the assessed risks and the further audit procedures performed in response.¹ An experienced auditor reviewing the workpapers should be able to trace from a risk identified under AU-C 315 to the specific procedure designed to address it, and then to the results and conclusions drawn from that procedure.

Documentation must cover the overall responses at the financial statement level, the nature, timing, and extent of further audit procedures performed, the results of those procedures, and the conclusions reached about the sufficiency of evidence. For tests of controls, the auditor must also document the basis for any reliance on prior-period testing and the evidence obtained to confirm the control has not changed.⁶

Communicating Control Deficiencies You Find

When AU-C 330 testing reveals that a control is not operating effectively, the obligation to communicate the deficiency comes from a different standard. Under AU-C 265, the auditor evaluates whether identified deficiencies, alone or combined with others, rise to the level of a significant deficiency or material weakness.⁷

A material weakness means there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. A significant deficiency is less severe but still important enough to warrant the attention of those overseeing financial reporting. Both must be communicated in writing to those charged with governance and to management no later than 60 days after the report release date. Other deficiencies the auditor considers noteworthy should be communicated to management, either in writing or orally with oral communications documented in the workpapers.⁷ AU-C 265 does not require you to go hunting for deficiencies beyond what you already do under AU-C 315 and AU-C 330. The obligation is to communicate what you find during the normal course of the audit.

1
Wiley Online Library. AU-C 330 Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
2
Ohio State University. AU-C 240 Consideration of Fraud in a Financial Statement Audit
3
CeriFi CPEdge. Companion to PPC’s Guide to Audit Risk Assessment
4
PASAI. International Standard on Auditing 330 – The Auditor’s Responses to Assessed Risks
5
PCAOB. Comparison of Proposed AS 2305 with ISA 520 and AU-C Section 520
6
AICPA & CIMA. AICPA Audit Risk Assessment Resource
7
AICPA. AU-C 265 Communicating Internal Control Related Matters Identified in an Audit