ISA 315: Risk Procedures, Internal Controls, and Documentation

ISA 315 (Revised 2019) is the international auditing standard governing how auditors identify and assess the risks of material misstatement in financial statements, including the understanding of internal control that supports that assessment. Issued by the International Auditing and Assurance Standards Board, it took effect for audits of financial periods beginning on or after December 15, 2021, and applies to entities of every size and level of complexity.¹ The 2019 revision reshaped how risk gets measured (a formal spectrum of inherent risk replaced binary judgments), expanded the treatment of IT controls, and added explicit scalability guidance. Everything the auditor does under ISA 315 feeds directly into ISA 330, which governs the response.

The Four Risk Assessment Procedures

ISA 315 sets out four categories of procedures the auditor must perform while building the understanding the standard demands. Not every procedure has to touch every aspect of that understanding, but all four must appear in the engagement.²

Inquiries of management, operational staff, internal auditors, and legal counsel, which surface operational shifts, upcoming changes, and areas of known difficulty.
Analytical procedures that compare current figures against prior periods or industry benchmarks to highlight unusual trends.
Observation of processes as they actually run, rather than as they are described in a manual.
Inspection of tangible documents: board minutes, loan agreements, contracts, internal reports.

These procedures reinforce one another. A conversation with the CFO may flag a new revenue stream; analytical procedures test whether the numbers look reasonable; inspection of the underlying contracts confirms the terms. No single source carries the assessment on its own.

Understanding the Entity and Its Environment

Before mapping any risk, the auditor builds a picture of the organization and the world it operates in. Externally, that means the industry, the regulatory environment, competitive conditions, and the economic context. A manufacturer selling into a declining market faces different reporting risks than a software company growing quickly. Internally, the auditor examines ownership, governance, accounting policy choices, and how the business invests and finances itself.

The applicable financial reporting framework matters here too, whether that is IFRS, a local GAAP, or another framework, because the rules on recognition, measurement, and disclosure shape where misstatements can occur. A framework requiring fair-value measurement on complex instruments creates different risks than one built on historical cost. This understanding is the foundation for every judgment that follows on the engagement.

The Five Components of Internal Control

ISA 315 organizes internal control into five components. For each, the auditor must understand the design of relevant controls and determine whether those controls have been implemented, meaning they actually operate rather than just appearing in a policy document.²

Control Environment

The control environment reflects management’s commitment to integrity, ethical values, and competent oversight. It sets the tone for the organization: how authority is delegated, how people are held accountable, and whether the board exercises genuine independent oversight. A weak control environment tends to have a pervasive effect on the reliability of everything else, because employees take their cues from leadership.

The Entity’s Risk Assessment Process

This is the organization’s own method for identifying business risks that could affect financial reporting and deciding what to do about them. The auditor evaluates whether management estimates the significance of risks, assesses their likelihood, and selects responses. Entities without a formal process are not automatically deficient, since smaller organizations often handle this informally, but the auditor still needs to understand how the entity identifies and reacts to change.

Information System and Communication

The information system covers the procedures and records used to initiate, record, process, and report transactions. The auditor traces how a transaction enters the system, moves through processing, and lands in the financial statements. Communication matters here too, particularly whether financial reporting roles and responsibilities are clearly conveyed to the people who hold them.

Control Activities

Control activities are the specific policies and actions that help ensure management’s directives are carried out: authorizations, reconciliations, segregation of duties, and physical security over assets. In less complex entities, many of these are applied directly by the owner-manager rather than through formal procedures, and the standard acknowledges that formality varies with the size and nature of the organization.²

Monitoring of Controls

Monitoring is the assessment of internal control performance over time, through ongoing activities, separate evaluations, or both. Internal audit functions, management reviews of exception reports, and external regulatory examinations all contribute. The auditor evaluates whether monitoring is sufficient to identify control deficiencies and whether corrective action follows.

IT Controls and Technology Risks

The 2019 revision substantially expanded the treatment of information technology. Instead of sitting in the background, IT now demands explicit identification of risks arising from its use and evaluation of the general IT controls that address them.

The auditor starts by mapping the IT environment: which applications generate, process, or maintain financial data; how information flows from transaction initiation to the general ledger; and whether the entity relies on off-the-shelf software, custom-built systems, or outsourced IT services. The standard then requires the auditor to identify specific IT-related risks, which include unauthorized access to data, unauthorized or untested changes to programs and configurations, failures or interruptions in IT processing, risks in data migration when new systems are implemented, and inadequate segregation of duties within the IT function.²

For applications affected by those risks, the auditor identifies and evaluates general IT controls: the controls designed to maintain data integrity and support the consistent operation of application-level controls. Automated controls warrant particular attention because they can be more reliable than manual controls, since they cannot easily be bypassed or forgotten. That reliability holds only if the underlying general IT controls are working. If those general controls are ineffective, automated controls running within the affected applications cannot be relied on, which typically means significantly more substantive testing.³

The Spectrum of Inherent Risk

One of the most consequential changes in the 2019 revision is the spectrum of inherent risk. Rather than a binary judgment (high or not high), inherent risk varies along a continuum, and where an assertion falls on that spectrum depends on the combined effect of several inherent risk factors.²

The standard identifies five qualitative inherent risk factors:

Complexity. Transactions or balances that involve complicated calculations, unusual structures, or difficult accounting requirements are more prone to error.
Subjectivity. When a balance depends on management judgment, such as the fair value of an unquoted investment, the range of possible outcomes widens.
Change. New transactions, new systems, new accounting standards, and organizational restructuring all create conditions where misstatements are more likely.
Uncertainty. Measurement uncertainty in areas such as litigation provisions or insurance reserves means that even honest, competent people can arrive at materially different figures.
Susceptibility to misstatement from management bias or other fraud risk factors. Some assertions, such as revenue recognition or estimates with wide acceptable ranges, are inherently more vulnerable to manipulation.

Alongside these qualitative factors, the standard weighs quantitative characteristics: the dollar significance of a transaction class or account balance, the volume of transactions, and the uniformity of items within a population. A payroll account processing millions of small, uniform transactions has a different inherent risk profile than a portfolio of one-off derivative contracts.²

Assertion-Level and Financial-Statement-Level Risks

Once the information is in hand, the focus shifts to mapping findings to potential misstatements at two levels.

Financial-statement-level risks are pervasive. They affect the statements broadly rather than a specific account. A weak control environment, management’s disregard for proper reporting, or deteriorating economic conditions that threaten going concern are typical examples. These call for overall responses: assigning more experienced staff, heightened professional skepticism, or unpredictability in the procedures selected.

Assertion-level risks are granular. They connect a specific threat to a specific claim about a specific account or disclosure. ISA 315 groups those claims into assertions about classes of transactions and events during the period (occurrence, completeness, accuracy, cut-off, classification, and presentation) and assertions about account balances at period end (existence, rights and obligations, completeness, accuracy/valuation/allocation, classification, and presentation). The auditor determines which assertions are relevant for each significant class of transactions, account balance, and disclosure. Not every assertion matters equally: valuation tends to dominate for inventory, occurrence and cut-off for revenue. Each assessed assertion-level risk then drives the nature, timing, and extent of further procedures under ISA 330.⁴

Significant Risks

Some assessed risks sit at the upper end of the inherent risk spectrum and qualify as significant risks. These often involve non-routine transactions, heavy management judgment, or a convergence of inherent risk factors. Complex revenue recognition, fair-value measurements of illiquid assets, and estimates with wide possible ranges are common examples. When a risk is designated significant, the auditor must obtain an understanding of the entity’s controls specifically relevant to it, and substantive procedures in response must be specifically designed to address it.⁴

Presumed Fraud Risks

ISA 315 works alongside ISA 240 on fraud. Two risks are presumed on every audit unless there is specific evidence otherwise. The first is a presumed risk of fraud in revenue recognition, and the auditor must evaluate which types of revenue or revenue-related assertions give rise to that risk. The second is management override of controls, which is always treated as a significant risk because management is uniquely positioned to manipulate records by overriding otherwise-effective controls.⁵

Regardless of how well-controlled an entity looks, the auditor must test the appropriateness of journal entries, review estimates for bias, and evaluate whether unusual significant transactions outside the normal course of business have a legitimate purpose. Those procedures are mandatory on every engagement.

The Engagement Team Discussion

ISA 315 requires the engagement partner and other key team members to discuss how the applicable financial reporting framework applies and where the statements might be susceptible to material misstatement, including from fraud. Experienced members share insights newer staff lack, everyone sees how their individual work fits into the wider audit, and a baseline is set for sharing new information as fieldwork progresses.²

A partner who has audited the client for years might flag that the new CFO has been pushing aggressive revenue recognition. A staff member on inventory might know that the warehouse management system was recently migrated to a new platform. Those observations inform every risk assessment that follows. Significant decisions from the discussion must be documented.

The Stand-Back Check

After completing the risk identification and assessment work, the standard requires a stand-back evaluation. For any material class of transactions, account balance, or disclosure not identified as significant, the auditor must evaluate whether that determination remains appropriate. It is a safeguard against tunnel vision, against the audit team becoming so focused on the obvious problem areas that something material is missed in an account everyone assumed was straightforward.²

In practice, the stand-back often catches intercompany elimination entries, unusual clearing account activity, or newly significant disclosures triggered by changes in the reporting framework.

Documentation

The audit file must include four things:

The engagement team discussion, together with significant decisions reached.
Key elements of the auditor’s understanding of the entity, its environment, the reporting framework, and internal control, along with the sources of information and the risk assessment procedures performed.
The auditor’s evaluation of the design of identified controls and whether those controls have been implemented.
The identified and assessed risks of material misstatement at both the financial statement and assertion levels, including which risks are significant and which cannot be addressed by substantive procedures alone, with the rationale for significant judgments.⁴

Form and extent scale with complexity. For less complex audits, documentation can be brief and simple. It does not need to capture every detail of the auditor’s understanding, only the key elements and the rationale for significant judgments. What matters is that a later reviewer can follow the logic from understanding, through risk assessment, to the procedures designed in response.²

How the Assessment Flows into ISA 330

Risk assessment is not the point on its own. Its purpose is to drive the auditor’s response under ISA 330. At the financial statement level, assessed risks shape overall responses: staffing, supervision, the degree of unpredictability, and the general approach. At the assertion level, they shape further procedures, including specific tests of controls and substantive procedures. The nature, timing, and extent of those procedures must be directly responsive to the assessed risks.⁶

When the auditor plans to rely on controls, ISA 330 requires tests of those controls to confirm they operate effectively. If a risk is significant and the auditor plans to rely on controls that mitigate it, those tests must be performed in the current period; reliance cannot be carried forward from a prior year. And for any significant risk, substantive procedures specifically responsive to it are always required, regardless of the control testing results.⁶

Risk assessment is not a one-time event either. If new information during fieldwork contradicts the original assessment, the auditor must revise it and modify the planned procedures accordingly.

Scalability for Less Complex Entities

A common concern is that ISA 315 looks designed for large, complex organizations and becomes disproportionate on smaller engagements. The standard addresses this directly. It applies to entities of every size, but the nature and extent of the understanding, and the depth of work required, vary with complexity.²

For a less complex entity, such as an owner-managed business with straightforward transactions and a simple IT environment, the risk assessment procedures can be less extensive, documentation can be simpler, and the understanding of internal control may focus heavily on the owner-manager’s direct involvement rather than formal procedures. Size alone does not determine complexity. A small entity with international operations, complex financial instruments, or significant regulatory requirements may be quite complex, while a large entity with routine operations may be relatively simple.

Where ISA 315 Does Not Apply

Auditors on U.S. public company engagements do not apply ISA 315 directly. They follow PCAOB Auditing Standard 2110, developed independently by the Public Company Accounting Oversight Board, which covers the same territory of identifying and assessing risks of material misstatement.⁷ The frameworks are similar: both require understanding of the entity and its environment, understanding of internal control, analytical procedures, an engagement team discussion, and risk assessment at both levels. AS 2110 also requires consideration of information from client acceptance and retention evaluations and from past audits, areas ISA 315 addresses but structures somewhat differently. For U.S. non-public audits, the AICPA’s Statement on Auditing Standards No. 145 (SAS 145) is the equivalent standard, designed to converge closely with ISA 315 (Revised 2019), though an appendix maintained by AICPA staff highlights certain substantive differences.

1
International Auditing and Assurance Standards Board. ISA 315 (Revised 2019) Identifying and Assessing the Risks of Material Misstatement
2
Independent Regulatory Board for Auditors. ISA 315 (Revised 2019) Identifying and Assessing the Risks of Material Misstatement
3
Irish Auditing and Accounting Supervisory Authority. ISA 315 (Revised 2019) Identifying and Assessing the Risks of Material Misstatement
4
IBR-IRE. ISA 315 (Revised 2019) Identifying and Assessing the Risks of Material Misstatement
5
Irish Auditing and Accounting Supervisory Authority. ISA 240 The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements
6
ICJCE. ISA 330 The Auditor’s Responses to Assessed Risks
7
Public Company Accounting Oversight Board. AS 2110 Identifying and Assessing Risks of Material Misstatement