SAS No. 145 is the AICPA auditing standard, issued by the Auditing Standards Board in October 2021 and effective for audits of periods ending on or after December 15, 2023, that overhauls how auditors identify and assess the risk of material misstatement in financial statements.1AICPA & CIMA. What NFPs Need to Know About SAS No. 145 It replaces the previous AU-C Section 315 under SAS No. 122. The central shift is away from treating inherent risk as a simple high, medium, or low bucket and toward placing it on a continuous spectrum, which forces auditors to reason more carefully about exactly how risky each assertion is and why.
What SAS 145 Changed From the Prior Standard
The standard was built on ISA 315 (Revised 2019), the international risk assessment standard, with the aim of aligning U.S. generally accepted auditing standards with international practice and addressing weaknesses regulators had observed in how auditors were performing risk assessments.2AICPA & CIMA. Applying and Scaling Audit Risk Assessment Procedures Under SAS No. 145 Three changes stand out.
Inherent risk and control risk must be assessed separately. Many auditors used to evaluate them together as a combined risk of material misstatement. SAS 145 requires evaluating each independently, which prevents the perceived strength of internal controls from masking a genuinely high inherent risk.
Inherent risk now sits on a spectrum. Rather than sorting each risk into high, medium, or low, auditors place each assertion on a spectrum from low to high based on five defined factors. This demands more granular judgment and pushes back against boilerplate assessments recycled from prior years.
The definition of “relevant assertion” is narrower. Previously, an assertion was relevant if it had a reasonable possibility of misstatement. Now an assertion is relevant only when a risk of material misstatement has actually been identified for it. The focus shifts to assertions where a specific risk exists rather than casting a broader net.
Together, these changes mean each engagement needs a fresh, documented evaluation tied to the specific inherent risk factors present in the current period.
The Inherent Risk Spectrum and the Five Factors
Inherent risk under SAS 145 is the chance an assertion could be materially misstated before considering any internal controls. Instead of slotting that risk into a generic category, the auditor evaluates where it falls on the spectrum using five inherent risk factors:3AICPA & CIMA. AICPA Statement on Auditing Standards No. 145
- Subjectivity. How much judgment goes into measuring the item. Fair value estimates and allowances for credit losses involve significant judgment.
- Complexity. Whether the transactions or accounting treatment involve multiple steps, data sources, or technical requirements. Revenue recognition under ASC 606 contracts with variable consideration is a common example.
- Change. New economic conditions, regulations, or business operations that force the entity to use unfamiliar accounting treatments or modify established processes.
- Uncertainty. The width of possible outcomes for a transaction or event. A wider range makes selecting an appropriate estimate harder.
- Susceptibility to management bias or fraud. Situations where management has incentive, opportunity, or pressure to manipulate results. This connects directly to fraud risk assessment obligations.
The more of these factors present for a given assertion, the higher on the spectrum the inherent risk lands, and the more persuasive the evidence needed to support the assertion. One rule matters here: the spectrum assessment must be documented without reference to internal controls or planned audit procedures. Inherent risk stands on its own.4AICPA & CIMA. Inherent Risk Assessment Documentation Requirements (and Myths) SAS 145 Peer Review MFCs — Part II
How Control Risk Works Under SAS 145
Control risk is the chance that the entity’s internal controls will fail to prevent, detect, or correct a material misstatement. The standard keeps this assessment cleanly separated from inherent risk and introduces an important default: when the auditor does not plan to test the operating effectiveness of controls, control risk must be assessed at maximum.2AICPA & CIMA. Applying and Scaling Audit Risk Assessment Procedures Under SAS No. 145
When control risk sits at maximum, the combined risk of material misstatement equals the inherent risk assessment. If the auditor decides not to rely on controls for an assertion, the full weight of the inherent risk carries through to drive the audit response. The only way to bring the combined risk below the inherent risk level is to test controls and find them operating effectively. This eliminates the old practice of implicitly crediting controls that were never actually tested.
Where the auditor does plan to rely on controls, the standard requires testing their operating effectiveness. Well-designed and effective controls can bring the combined risk below the inherent risk level, potentially allowing reduced substantive testing. Poorly designed or unimplemented controls push control risk to the high end regardless of where inherent risk sits.
Understanding the Entity’s System of Internal Control
SAS 145 requires a structured understanding of the entity’s internal control system organized around the five components from the COSO framework:3AICPA & CIMA. AICPA Statement on Auditing Standards No. 145
- Control environment — the overall tone and governance structure, including management’s commitment to integrity and ethical values.
- Risk assessment process — how the entity identifies and responds to business risks that could affect financial reporting.
- Information system and communication — how transactions are initiated, recorded, processed, and reported.
- Control activities — the specific policies and procedures designed to prevent or detect misstatements.
- Monitoring of controls — how the entity evaluates whether its controls are working over time.
Documenting that these components exist is no longer enough. Auditors must evaluate design and implementation for controls in specific areas: controls over significant risks, controls over journal entries, controls whose operating effectiveness will be tested, and general IT controls. The focus on journal entry controls is a targeted addition, reflecting longstanding concerns that journal entries are a primary vehicle for fraudulent financial reporting. The standard also places heightened emphasis on how the entity uses information technology to process financial data, requiring auditors to identify the relevant applications and infrastructure, understand transaction flows, and pinpoint where misstatements could occur.3AICPA & CIMA. AICPA Statement on Auditing Standards No. 145
One requirement catches many teams off guard: understanding the design and implementation of controls cannot rest on inquiry alone. The auditor must corroborate management’s descriptions through observation, inspection of documents, or walkthroughs that trace a transaction from origination to the financial statements. Peer reviewers have flagged this repeatedly, finding firms that produced extensive process narratives without ever confirming the controls actually existed or were in place.
Significant Risks and the Stand-Back Requirement
Risk of material misstatement is assessed at two levels. At the financial statement level, the auditor considers risks that affect the statements broadly, such as a weak control environment or entity-wide fraud risk. At the assertion level, the assessment gets specific, linking inherent risk factors to particular assertions like existence, completeness, accuracy, or valuation for individual account balances and transaction classes.3AICPA & CIMA. AICPA Statement on Auditing Standards No. 145
The standard also redefines “significant risk.” A significant risk is one where inherent risk falls close to the upper end of the spectrum because of the combined effect of the inherent risk factors on both the likelihood and magnitude of a potential misstatement. Under this definition, fraud risks should always be assessed with high inherent risk. For every identified significant risk, the auditor must evaluate the design and implementation of the entity’s related controls, even if no reliance on those controls is planned.
After completing risk identification and assessment, SAS 145 requires a stand-back: the auditor pauses to evaluate whether the work is complete. Have all significant classes of transactions, account balances, and disclosures been identified? Have any risks been overlooked? This is not a formality. It forces a deliberate check before moving into the audit response phase, and the conclusion must be documented.
Documentation Requirements and Scalability
The standard demands specific, well-reasoned documentation throughout the risk assessment. The auditor must document the understanding of the entity and its environment, the inherent risk factors considered for each material account and disclosure, the rationale for where each risk falls on the inherent risk spectrum, the assessed risk of material misstatement at both the financial statement and assertion levels, all identified significant risks, and the evaluation of relevant controls.3AICPA & CIMA. AICPA Statement on Auditing Standards No. 145
SAS 145 is explicitly scalable. A large, complex entity with multiple IT systems and formal governance requires far more extensive documentation than a small owner-managed business. The fundamental requirements apply to every engagement, but how they are met varies with the entity’s size and complexity. For less complex entities, the system of internal control is often informal, with limited or no written policies. An owner-managed business may have no documented risk assessment process or formal monitoring procedures, and that is expected.5Journal of Accountancy. Scaling SAS 145 for Less-Complex Entities The auditor can document the understanding of each control component through memoranda summarizing discussions with management, direct observations, and conclusions reached. A tabular list of identified controls with the auditor’s evaluation of design and implementation can satisfy documentation requirements without a full narrative.
What to Expect if Your Business Is Being Audited
If your organization undergoes an annual audit, SAS 145 changes what your auditor asks for and how deeply they probe. Being prepared shortens the process.
Expect close attention to journal entry controls. Be ready to explain and show documentation for who can create, modify, and post journal entries in your accounting system, what approval workflows exist, and whether any system-enforced restrictions limit access to those functions. If a single person can create and post entries without review, the auditor will assess higher control risk in that area.
IT controls will get more scrutiny than under the prior standard. Your auditor will likely want to discuss how you manage user access to financial systems, how program changes are authorized and tested before deployment, what disaster recovery procedures exist, and how you handle security incidents. Documentation of these processes should be readily available.
For each significant risk your auditor identifies, they must evaluate the design and implementation of your related controls. If revenue recognition is flagged as a significant risk, prepare to walk the auditor through the specific controls ensuring transactions are recorded accurately, in the correct period, and at the right amounts. Generic descriptions of your revenue process are not enough; the auditor needs to see the controls and evidence that they are in use.6Journal of Accountancy. Lessons Learned From the First Year of SAS 145
Smaller organizations should not feel pressured to create documentation that does not reflect how they actually operate. The standard allows for informal controls, and auditors can document their understanding through memos and discussions. What matters is that controls exist and function, not that they appear in a policy manual.