Audit and Assurance · Assessing audit risks

Risk Assessment Procedures and Understanding the Entity (ISA 315)

Updated 11 October 2026 · Fact-checked

Risk assessment procedures are the audit steps you perform to understand the entity, its environment and its internal control, so you can identify and assess risks of material misstatement. They include inquiries, analytical procedures, and observation and inspection. Inquiry alone does not provide sufficient appropriate audit evidence for the risk assessment.

Understand Risk Assessment Procedures and Understanding the Entity

Every audit starts with risk. Before you test anything, you must know what could cause the financial statements to be materially wrong. ISA 315 (Revised 2019) says you get this knowledge by performing risk assessment procedures. They give you the basis to identify and assess the risks of material misstatement (RMM), at both the financial statement level and the assertion level.

Risk assessment procedures include three types. Inquiries of management, those charged with governance, internal audit, and others in the entity, such as sales staff or in-house legal counsel. Analytical procedures that compare data and look for unusual or unexpected relationships. Observation and inspection, such as watching a process, visiting premises, and reading business plans, minutes, policies and management reports. You select the mix of procedures needed for the entity. Inquiry alone does not provide sufficient appropriate evidence for risk assessment, so you must corroborate what you hear.

The things you must understand about the entity and its environment are: industry, regulatory and other external factors, including the applicable financial reporting framework; the nature of the entity (operations, ownership, governance, investments, structure and financing); how it selects and applies accounting policies; its objectives, strategies and related business risks; and how its financial performance is measured. You also need to understand the system of internal control.

Business risk is a risk to the entity achieving its objectives, caused by significant conditions, events or actions. Audit risk is the risk that you give an inappropriate opinion when the financial statements are materially misstated. Business risks matter to you because many can lead to misstatement. For example, a new competitor may cause falling sales, which may cause inventory to be overvalued. But not every business risk creates an RMM.

Other team members join in too. ISA 315 requires a discussion among the engagement team, including the engagement partner, about the susceptibility of the financial statements to material misstatement. You also consider information from client acceptance or continuance and from previous audits. Your findings must be documented, and the assessment is revisited if later evidence changes it.

Key rules to remember

Audit risk: Audit risk = Inherent risk × Control risk × Detection risk (= RMM × Detection risk); This is a conceptual model, not a numerical calculation. Audit risk is the risk of giving an inappropriate opinion. RMM = inherent risk × control risk. Risk assessment procedures help you assess RMM, which drives how low detection risk must be.
Risk of material misstatement: RMM = Inherent risk × Control risk; ISA 315 (Revised) requires you to assess inherent risk and control risk separately at assertion level. This is a model, not a calculation with numbers.
Risk assessment procedures: Inquiries + Analytical procedures + Observation and inspection; These are the types of procedure included. You select the mix needed. Inquiry alone is not sufficient.
Areas to understand: Industry/regulatory/external factors + Nature of entity + Accounting policies + Objectives, strategies and business risks + Performance measurement + Internal control; A useful checklist for any scenario question.

How to solve Risk Assessment Procedures and Understanding the Entity questions

Use this method for any question on risk assessment procedures or understanding the entity. It works for objective tests and for written answers.

1Read the requirement and note the verb. 'Identify' needs a list. 'Explain' needs a reason. 'Recommend procedures' needs specific actions.
2Decide the category: procedure type (inquiry, analytical, observation/inspection), area of understanding (industry, nature, policies, objectives, performance, control), or business risk versus audit risk.
3Pull facts from the scenario. Look for new products, growth, acquisitions, new systems, regulation, falling margins, financing pressure or staff changes.
4Link each fact to a risk. State the business risk, then the effect on the financial statements, then the assertion affected (for example, valuation of inventory).
5For procedures, make them specific to the client. Name who you ask, what you compare, or what document you inspect, and what you are looking for.
6Say what the procedure tells you and how it feeds the RMM assessment, and, where relevant, the audit response.
7Keep to the marks. Write one distinct point per mark, with a short explanation, and do not repeat similar points.

Quickest way: Fact – Risk – Assertion – Procedure

When to use it: Use this under time pressure in Section A and B scenario questions asking for risks or procedures.

Underline each scenario fact that signals change, pressure or complexity.
For each, write: fact, risk, assertion affected, in one or two lines.
For procedures, pick inquiry, analytical or observation/inspection and name the specific target.
For objective tests, remember inquiry alone is insufficient and business risk is not the same as audit risk.
Check you have one point per mark and stop.

Common mistakes in Risk Assessment Procedures and Understanding the Entity

Treating business risk and audit risk as the same thing.
Both use the word risk and both appear in planning.
Fix: Business risk relates to the entity's objectives. Audit risk is the risk of an inappropriate opinion on materially misstated statements. Say how a business risk could lead to misstatement.
Relying on inquiry alone as evidence about the entity.
Asking management feels quick and informative.
Fix: Corroborate answers by inspecting documents, observing operations or using analytical procedures. Inquiry alone does not provide sufficient appropriate evidence for risk assessment.
Listing generic procedures not tied to the scenario.
Students memorise lists and do not read the facts.
Fix: Name the client's facts. For example, 'inspect the new loan agreement for covenants' rather than 'inspect documents'.
Confusing risk assessment procedures with further audit procedures.
Both involve testing and analytics.
Fix: Risk assessment procedures identify and assess risk. Further procedures (tests of controls and substantive procedures) respond to assessed risks.
Stating a risk without the effect on the financial statements.
Students stop at the business issue.
Fix: Always finish with the misstatement and assertion, such as overstated receivables or unrecorded liabilities.
Forgetting the engagement team discussion and documentation.
These feel administrative.
Fix: Mention the team discussion led by the partner and the documentation of understanding and assessed risks when asked about the ISA 315 requirements.

Worked examples

Example 1

Kiran Ltd, a manufacturer of kitchen appliances, has recently opened an online sales channel and replaced its inventory system. Its main competitor has cut prices. You are planning the audit. Identify three business risks and explain how each could lead to a risk of material misstatement. (6 marks)

Show the solution

Fact 1: new online channel. Risk: orders, returns and revenue cut-off may not be processed correctly, especially if the channel is not integrated with the accounting system. Effect: revenue and receivables may be misstated (occurrence, cut-off).
Fact 2: new inventory system. Risk: errors in data migration or system set-up. Effect: inventory quantities and costs may be wrong (existence, valuation).
Fact 3: competitor price cuts. Risk: Kiran may have to reduce selling prices or hold unsold stock. Effect: inventory may be carried above net realisable value (valuation), and management may feel pressure to overstate results.

Answer: Three risks: (1) the online channel creates revenue and cut-off risk; (2) the new inventory system creates risk of errors in inventory existence and valuation from migration; (3) competitor price cuts create risk that inventory is valued above net realisable value and pressure on results. Each business risk is linked to a misstatement and an assertion.

Example 2

You are auditing Meera Foods Ltd. Describe the risk assessment procedures you would perform to understand the entity, and explain why inquiry of management alone is not sufficient. (6 marks)

Show the solution

Inquiries: ask management about changes in products, customers, financing and accounting policies. Ask internal audit about control concerns. Ask sales staff about unusual deals or discounts.
Analytical procedures: compare this year's revenue, gross margin and receivables days with last year, budget and industry figures. Investigate unusual movements, as they may indicate risk areas.
Observation and inspection: observe inventory handling and order processing. Inspect board minutes, business plans, management accounts, loan agreements and internal control manuals.
Why inquiry alone is insufficient: management may be biased or unaware of risks. Inquiry alone does not provide sufficient appropriate evidence for risk assessment, so you use other procedures to corroborate the answers.
Link: the results feed into the assessment of RMM and the design of further audit procedures.

Answer: Perform a mix of inquiries (management, internal audit, operational staff), analytical procedures (year-on-year, budget and industry comparisons) and observation and inspection (operations, minutes, plans, agreements). Inquiry alone is insufficient because management's answers may be biased or incomplete, and inquiry alone does not provide sufficient appropriate evidence for risk assessment. The answers must be corroborated by other evidence.

Exam tips

In Section A objective test cases, watch for options saying inquiry alone is enough. That is wrong.
In Section A or B, distinguish business risk from audit risk by asking whose risk it is: the entity's objectives or the auditor's opinion.
For written answers, tie every risk to a scenario fact and an assertion. Generic answers score few marks.
When asked for procedures, name the source (who, which document, which ratio) and what you are looking for.
Budget your time by the marks on each question (about 1.8 minutes per mark in a three-hour exam).

Risk Assessment Procedures and Understanding the Entity in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Assessment Procedures and Understanding the Entity: frequently asked questions

What are the risk assessment procedures in ISA 315?

They include inquiries, analytical procedures, and observation and inspection. You select the mix needed to understand the entity and its environment, including internal control, and to identify and assess risks of material misstatement. Inquiry alone is not sufficient.

What is the difference between business risk and audit risk?

Business risk threatens the entity's objectives, for example from competition or regulation. Audit risk is the risk you give an inappropriate opinion on materially misstated financial statements. Some business risks lead to misstatement, but not all do.

Are risk assessment procedures enough to give an audit opinion?

No. They provide a basis for identifying and assessing risks. You still need further audit procedures, tests of controls and substantive procedures, to respond to those risks and gather sufficient appropriate evidence.

What must I understand about the entity under ISA 315?

You must understand the industry, regulatory and external factors, the nature of the entity, its accounting policies, its objectives, strategies and business risks, how performance is measured, and its system of internal control.