AUD, Auditing and Attestation

Sources for Assessing and Responding to Risk, Including Fraud

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Assessing and Responding to Risk, Including Fraud. The topic rests on AU-C 315.

About this topic

Once the auditor understands the entity, the assessed risks drive the response. The audit risk model ties the pieces together, significant risks get special attention, and fraud risk receives its own required treatment because fraud is concealed and management can override controls.

This is the highest-weighted group in Area II, and almost every question in it is one of six questions wearing a costume. Identify the question first and the answer choices sort themselves.

Key points

• Audit risk equals inherent risk times control risk times detection risk; the auditor controls detection risk through the nature, timing, and extent of procedures.
• A significant risk is an identified risk requiring special audit consideration, such as fraud or unusual transactions.
• Fraud risk assessment addresses both fraudulent financial reporting and misappropriation of assets.
• Responses to assessed risks include changes to the nature (more reliable evidence), timing (closer to period end), and extent (larger samples) of procedures.

What the lessons cover

1. The audit risk model
2. Fraud risk (AU-C 240)
3. Responding to assessed risks (AU-C 330)
4. Significant risks: what they are, and what they force
5. Tests of controls: two triggers, and two limits
6. Substantive procedures, interim testing, and the roll-forward
7. What is required irrespective of the assessed risk
8. AU-C and PCAOB AS held apart

Authoritative references

Where these requirements sit in the literature.

• AU-C 200 carries the audit risk model: audit risk, the risk of expressing an inappropriate opinion when the statements are materially misstated, is the risk of material misstatement (inherent risk combined with control risk, both properties of the entity) times detection risk (the risk the auditor's own procedures fail to detect an existing misstatement). Detection risk is set inversely and delivered through the nature, timing, and extent of substantive procedures. Solving for it divides desired audit risk by the assessed risk of material misstatement.
• AU-C 315 requires risks of material misstatement to be identified and assessed at both the financial statement level, where they relate pervasively and often arise from the control environment, and the assertion level. It also requires the auditor to determine whether a risk is a significant risk. As amended by SAS No. 145, that means an inherent risk assessment close to the upper end of the spectrum of inherent risk, judged on complexity, subjectivity, degree of change, uncertainty, and susceptibility to management bias or fraud, and assessed before the effect of controls.
• AU-C 240 carries fraud:
  • the two kinds of misstatement, and the three triangle conditions.
  • professional skepticism throughout, and the engagement team discussion.
  • the requirement to treat fraud risks as significant risks with both an overall response and assertion-level responses.
  • the required element of unpredictability on every audit.
• AU-C 240 carries both presumptions. Improper revenue recognition is a presumed fraud risk, the presumption is rebuttable, and the reasons must be documented if the auditor concludes it does not apply. Management override is a fraud risk in every entity and is not rebuttable, so on every audit the auditor:
  • tests the appropriateness of journal entries and other adjustments.
  • reviews estimates for bias including a retrospective review, and evaluates whether the circumstances producing any bias represent a fraud risk.
  • evaluates the business rationale for significant transactions outside the normal course of business.
• AU-C 330.06 and AU-C 330.07 frame the response: more persuasive evidence as assessed risk rises, expressed in the procedure's nature, meaning both its purpose as a test of controls or a substantive procedure and its type, plus timing and extent.
• AU-C 330.08 requires tests of controls in two situations only:
  • where the risk assessment expects controls to operate effectively and the plan relies on that operating effectiveness.
  • where substantive procedures alone cannot provide sufficient appropriate audit evidence at the relevant assertion level, the standard illustration being highly automated processing with no manual audit trail.
• AU-C 330.18 sets the substantive-procedures floor: irrespective of the assessed risks, substantive procedures for each relevant assertion of each material class of transactions, account balance, and disclosure. Effective controls may reduce the extent but can never eliminate it, because internal control carries inherent limitations including management override, and nothing bars tests of details when controls are effective. AU-C 330.21 adds two required procedures over the period-end financial reporting process:
  • agreeing or reconciling the statements to the underlying accounting records.
  • examining material journal entries and other adjustments made in preparing them.
• AU-C 330.22 governs the significant-risk response: procedures specifically responsive to the risk, and where the approach consists only of substantive procedures, those procedures must include tests of details, so substantive analytical procedures alone are insufficient.
• Prior-audit evidence: a control that has not changed and is not related to a significant risk may be relied on with rotational testing at least once every third audit, while a control addressing a significant risk must be tested in the current period whenever the auditor plans to rely on it.
• Interim testing: the auditor must cover the remaining period with substantive procedures, alone or combined with tests of controls, sufficient to extend the interim conclusions to the balance-sheet date.
• AS 1101.04 through .11 carry the PCAOB statement of audit risk.
  • A function of the risk of material misstatement and detection risk (.04), assessed at both levels (.05), with assertion-level risk consisting of inherent and control risk (.07).
  • Detection risk is the risk the auditor's procedures miss an existing misstatement (.09).
  • The higher the risk of material misstatement, the lower detection risk must be (.10).
  • The auditor reduces it through nature, timing, and extent, with the evidence required increasing as detection risk falls (.11).
• AS 2110 carries PCAOB risk identification.
  • Revenue analytics as a risk assessment procedure (.47).
  • The key engagement team discussion (.49) and its brainstorming content, prior beliefs about management's honesty set aside (.52).
  • Assessment at both levels (.59).
  • The three fraud risk factor conditions (.65) and the rule that one may suffice (.66).
  • The revenue presumption, with no rebuttal clause (.68).
  • Fraud risk identification including management override (.69).
  • The significant-risk determination on inherent risk without regard to controls, noting that a fraud risk is a significant risk (.70 and .71).
  • Evaluating the design and implementation of controls addressing significant and fraud risks (.72).
  • Continuous revision on contradicting evidence (.74).
• AS 2301 carries the PCAOB responses.
  • Overall responses including unpredictability (.05).
  • Assertion-level procedures for each significant account and disclosure (.08) with more persuasive evidence as risk rises (.09).
  • Tests of details for significant risks (.11) and fraud risks (.13), significant unusual transactions fed into procedure design (.11A), override procedures cross-referenced (.15).
  • The two tests-of-controls triggers (.16 and .17).
  • Direct testing of effectiveness (.23) and inquiry alone as insufficient (.24).
  • Current-year evidence about every control relied on (.31).
  • Control risk at the maximum where controls are missing, ineffective, or unsupported (.33).
  • The substantive floor regardless of control risk (.36), evidence rising with risk (.37), inherent limitations (.38), inquiry insufficient substantively (.39).
  • The period-end reconciliation and adjustment examination (.41).
  • The interim risk (.43), the two remaining-period acts (.45), revision on contradicting evidence (.46).
  • Dual-purpose tests (.47).
  • The reasonable-possibility evaluation of items not selected (.50).
• AS 2401 carries PCAOB fraud.
  • Intent as the distinguishing factor, with no legal determination by the auditor (.05).
  • The two kinds of misstatement (.06).
  • The three conditions, opportunity including the ability to override (.07).
  • Management's unique ability to perpetrate fraud in unpredictable ways (.08).
  • The required mindset regardless of past experience or beliefs about integrity (.13).
  • The override procedures are mandatory (.57).
  • Journal entries and other adjustments including those never in a formal entry (.58), selected on named characteristics and not excused by effective controls over entries (.61), focused on period end but not confined to it (.62).
  • Estimates reviewed for bias (.63) via a retrospective review of estimates carrying an assessed fraud risk (.64), with bias evaluated as a possible fraud risk (.65).
  • Significant unusual transactions defined by timing, size, or nature (.66), with required procedures on documentation, authorization, and the other parties' financial capability (.66A), a factor list (.67), and a test of proper accounting and disclosure (.67A).
  • Documentation is enumerated (.83), including the linkage of fraud risks to responses and the reasons where improper revenue recognition was not identified as a fraud risk.
  • Fraud risk factor examples sit in the appendix, classified by the three conditions (.85).
• AS 2810 carries the back end.
  • Revenue analytics again through the end of the reporting period (.07).
  • An unusual relationship as a possible fraud-risk indicator (.09).
  • Whether misstatements are indicative of fraud (.20).
  • Bias in management's judgments (.24) including the selective correction of misstatements (.25).
  • Bias in estimates grouped at opposite ends of the reasonable range across years (.27).

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.

See also

• Sources for every AUD topic
• Free AUD sample questions
• The CPA exam glossary