Audit and Assurance · Understanding the entity and its environment and the applicable financial reporting framework

Risk Assessment Procedures and Analytical Procedures in Audit

Updated 11 October 2026 · Fact-checked

Risk assessment procedures are the audit work you do at planning to understand the entity and identify risks of material misstatement. ISA 315 requires inquiries, analytical procedures, and observation and inspection. The team also discusses where the financial statements may be misstated. They do not by themselves give sufficient evidence for the opinion.

Understand Risk Assessment Procedures and Analytical Procedures

The auditor cannot test everything. So you first find out where the financial statements are most likely to be wrong. Risk assessment procedures are the procedures you perform to do this. They give you the basis to identify and assess the risks of material misstatement (RMM) at the financial statement and assertion levels.

ISA 315 requires these procedures to include:

Inquiries of management and others within the entity, such as those charged with governance, internal audit, and staff who deal with complex transactions.
Analytical procedures, which compare and review financial and non-financial information for trends and unusual relationships.
Observation and inspection, such as watching a process happen, or reading business plans, minutes, contracts, internal control manuals and management reports.

Inquiry alone is not enough. Management may be biased or may not know the answer, so you corroborate what you hear with the other procedures. Analytical procedures used at planning use data at a high level, often before the year-end figures are final, so they give only a broad first indication of risk.

ISA 315 also requires a discussion among the key members of the engagement team. They discuss the susceptibility of the financial statements to material misstatement, including through fraud, and how the applicable financial reporting framework applies to the entity. The engagement partner decides which matters to communicate to team members not at the meeting. The discussion shares knowledge, brings in professional scepticism and helps plan the work.

Do not confuse these with further audit procedures. Further audit procedures, which are tests of controls and substantive procedures, respond to the assessed risks. Risk assessment procedures come first and identify the risks. Analytical procedures can appear in both: as a risk assessment procedure at planning, as a substantive procedure during the audit, and as an overall review at the end.

Key rules to remember

Required risk assessment procedures (ISA 315): Inquiries + Analytical procedures + Observation and inspection; These three are the minimum set. Add the engagement team discussion as a separate requirement.
Gross profit margin: Gross profit ÷ Revenue × 100; Use it to spot unusual changes in margin between years.
Operating profit margin: Operating profit ÷ Revenue × 100; A fall may point to unrecorded costs or overstated revenue.
Current ratio: Current assets ÷ Current liabilities; Useful for going concern and liquidity risk.
Receivables days: Trade receivables ÷ Revenue × 365; A rise may signal recoverability or cut-off risk.
Payables days: Trade payables ÷ Cost of sales × 365; A rise may signal cash pressure or unrecorded liabilities.
Inventory days: Inventory ÷ Cost of sales × 365; A rise may signal obsolete or overvalued inventory.
Gearing: Debt ÷ Equity (or Debt ÷ (Debt + Equity)); State which version you use. Look for covenant and going concern risks.

How to solve Risk Assessment Procedures and Analytical Procedures questions

Use this method for any question that asks which procedures to perform, what the ratios show, or what risks you identify.

1Read the requirement. Decide if it asks for procedures, risks, or interpretation of figures.
2Identify the type of procedure: inquiry, analytical, observation or inspection, or the team discussion. Name it and say what it would involve in this scenario.
3For analytical work, calculate the key ratios and the year-on-year change. Compare with prior year, budget, industry or expectations.
4Do not just state the change. Say why it might have happened, and give both an innocent explanation and a misstatement possibility.
5Link each finding to a risk of material misstatement and name the financial statement area and assertion affected.
6State the audit response briefly, such as more senior staff, more substantive work or a specialist.
7Check that your points use scenario facts, not generic text.

Quickest way: Trend, Reason, Risk, Response

When to use it: Use it for Section C questions that give figures and ask for risks, or for OT questions that ask which procedure is a risk assessment procedure.

Calculate only the three or four most relevant changes, and write them down.
For each, write: what moved, a likely reason, the risk of misstatement, the response.
For OT questions, ask: is this identifying risk (risk assessment), or responding to risk (further procedure)?
Remember: inquiry on its own is never sufficient for audit evidence.
Tie each point to a scenario fact to earn the mark.

Common mistakes in Risk Assessment Procedures and Analytical Procedures

Treating risk assessment procedures as providing enough evidence for the opinion.
Students see that procedures are performed and assume evidence is gained.
Fix: Say that they identify risk. Evidence for the opinion comes from further audit procedures responding to the risks.
Listing ratio changes without explaining the audit risk.
Students are comfortable with calculations and stop there.
Fix: For each change give a reason, the misstatement risk, the assertion and the response.
Relying on inquiry alone.
Management is easy to ask, so it feels sufficient.
Fix: Corroborate management's answers with observation, inspection or analytical procedures.
Ignoring the engagement team discussion.
It seems administrative, not a procedure.
Fix: Remember it is required by ISA 315. It covers susceptibility to misstatement including fraud, and the application of the framework.
Confusing risk assessment procedures with tests of controls and substantive procedures.
Both sound like testing and both can include inspection.
Fix: Ask the purpose. If it is to identify and assess risk, it is risk assessment. If it responds to an assessed risk, it is a further audit procedure.
Giving only a bad-news explanation for a movement.
Students assume that unusual means error.
Fix: Offer genuine business reasons as well, and say you would inquire and corroborate before concluding.

Worked examples

Example 1

Wren Ltd has revenue of $4,000,000 (prior year $3,200,000) and cost of sales of $3,000,000 (prior year $2,240,000). Trade receivables are $900,000 (prior year $560,000). Calculate gross margin and receivables days for both years and explain the audit risks.

Show the solution

Current gross profit = 4,000,000 − 3,000,000 = 1,000,000. Margin = 1,000,000 ÷ 4,000,000 = 25%.
Prior gross profit = 3,200,000 − 2,240,000 = 960,000. Margin = 960,000 ÷ 3,200,000 = 30%.
Current receivables days = 900,000 ÷ 4,000,000 × 365 = 82.1 days.
Prior receivables days = 560,000 ÷ 3,200,000 × 365 = 63.9 days.
Revenue grew by 25% ((4,000,000 − 3,200,000) ÷ 3,200,000) while the margin fell five percentage points and receivables days rose by about 18 days.
Possible reasons: price cuts or discounts to win sales, higher costs, or generous credit terms to drive sales. Misstatement risks: revenue overstated through early recognition or fictitious sales, cost of sales understated, receivables overvalued and irrecoverable debts not provided for.
Response: assess revenue as a risk, perform cut-off testing, confirm receivables, review post year-end receipts and the allowance for credit losses, and inquire about the credit policy.

Answer: Gross margin fell from 30% to 25%. Receivables days rose from 63.9 to 82.1. The main risks are overstated revenue (occurrence and cut-off) and overvalued receivables (valuation), so plan cut-off, confirmation and receivables recoverability testing.

Example 2

You are planning the audit of Tarn Co, a retailer that has just opened an online store. State the risk assessment procedures you would perform and how the engagement team discussion helps.

Show the solution

Inquiries: ask management and finance staff about the online launch, new systems, returns policy and how online sales are recorded. Ask internal audit if any, and those charged with governance, about known problems.
Analytical procedures: compare monthly sales and margins by channel with prior year and budget. Look for unusual returns, and for changes in inventory days after the launch.
Observation: watch how online orders are processed, picked, dispatched and recorded.
Inspection: read the business plan, board minutes, system documentation, the website terms and the returns policy.
Corroborate inquiry answers using the other procedures, because inquiry alone is not sufficient.
Engagement team discussion: key team members, including the partner, discuss where the statements may be misstated, including fraud risk in online revenue, and how the reporting framework applies, for example revenue recognition and returns provisions.
The discussion shares knowledge of the new system, sets the tone of professional scepticism, and allows the team to allocate work to suitable staff.

Answer: Perform inquiries, analytical procedures, observation and inspection, corroborating inquiry responses. Hold a team discussion on susceptibility to misstatement, including fraud, and the application of the framework. Use the results to assess risks for the new online channel.

Exam tips

Name the procedure type each time. Markers look for inquiry, analytical, observation and inspection by name.
In ratio questions, show the calculation, then give a reason, a risk and a response. The calculation alone earns little.
In OT questions, check whether the procedure identifies risk or responds to risk.
Use the scenario facts, such as the new system or the rising receivables, in every point.
If a question asks about the team discussion, mention fraud susceptibility and the application of the framework.

Risk Assessment Procedures and Analytical Procedures in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Assessment Procedures and Analytical Procedures: frequently asked questions

What are the risk assessment procedures in ISA 315?

They are inquiries of management and others, analytical procedures, and observation and inspection. The engagement team discussion is a separate requirement alongside them. Together they help identify and assess risks of material misstatement.

What is the difference between risk assessment procedures and further audit procedures?

Risk assessment procedures identify and assess the risks of material misstatement. Further audit procedures, which are tests of controls and substantive procedures, respond to those assessed risks. Risk assessment alone does not give sufficient evidence for the opinion.

How do I perform a preliminary analytical review in AA?

Calculate key ratios and year-on-year changes, then compare them with prior year, budget, industry or expectations. For each unusual movement, give a possible reason, the misstatement risk and the audit response. Use scenario facts to support each point.

Who attends the engagement team discussion under ISA 315?

The key members of the engagement team, including the engagement partner, take part. They discuss how the financial statements may be materially misstated, including through fraud. The partner decides what to communicate to members who are not present.