Skip to content

Corporate Accounting and Auditing · Brief Introduction to Auditing Standards

SA 315, SA 320 and SA 330: Risk Assessment and Response

Updated 10 October 2026 · Fact-checked

Under the SAs, the auditor plans the audit (SA 300), identifies and assesses risks of material misstatement (SA 315), sets materiality (SA 320), designs responses to assessed risks (SA 330), and reports significant control deficiencies to those charged with governance and management (SA 265). Higher assessed risk means more and stronger audit work.

Understand SA 300 to SA 499: Risk Assessment and Response

Auditing is risk-based. The auditor cannot test every transaction, so the work is aimed where a material error or fraud is most likely. The SAs in this block set out that flow: plan, assess, respond.

SA 300 (Planning an Audit of Financial Statements) says the auditor must plan so the audit is done effectively. Planning means establishing an overall audit strategy (scope, timing, direction) and developing an audit plan (detailed procedures). Planning is not a one-time step. You update it as the audit goes on. Involving the engagement partner and key team members, and discussing among the team, are part of good planning.

SA 315 (Revised) deals with identifying and assessing the risks of material misstatement (RMM), whether due to fraud or error, at the financial statement level and at the assertion level. The auditor gets an understanding of the entity and its environment, the applicable financial reporting framework, and the entity's system of internal control. The auditor then assesses RMM. RMM is a combination of two parts, not an arithmetic sum: inherent risk (susceptibility of an assertion to misstatement before considering controls) and control risk (the risk that controls will not prevent or detect it). Significant risks need special audit consideration.

The audit risk model comes from SA 200. It links audit risk to the risk of material misstatement and detection risk (the risk that the auditor's procedures will not detect a misstatement that exists and could be material).

SA 320 (Materiality in Planning and Performing an Audit): misstatements are material if they could reasonably be expected to influence the economic decisions of users. The auditor sets overall materiality for the financial statements as a whole, often using a benchmark such as profit before tax, revenue or total assets, with a percentage chosen by judgement. The auditor also sets performance materiality, an amount lower than overall materiality, to reduce the chance that uncorrected and undetected misstatements together exceed overall materiality. Qualitative factors matter too, so a small amount can be material. Separately, SA 450 deals with evaluating misstatements found. It uses a clearly trivial threshold, a separate judgement usually set well below materiality, below which misstatements need not be accumulated.

SA 330 (The Auditor's Responses to Assessed Risks) requires overall responses to financial statement level risks and further audit procedures (tests of controls and substantive procedures) whose nature, timing and extent respond to assertion level risks. SA 265 requires the auditor to communicate in writing significant deficiencies in internal control to those charged with governance on a timely basis, and other deficiencies to management at an appropriate level.

The key difference: SA 315 is about finding and assessing the risk. SA 330 is about what you do about it.

Key rules to remember

Audit risk model
Audit risk = Risk of material misstatement × Detection risk
This model is from SA 200. RMM = combination of inherent risk and control risk (not an arithmetic sum). Higher assessed RMM means detection risk must be set lower, so more substantive work.
Components of RMM
RMM = combination of inherent risk and control risk (not an arithmetic sum)
This is a conceptual combination. SA 315 (Revised) requires inherent and control risk to be assessed separately.
Materiality (SA 320)
Performance materiality < Overall materiality
Performance materiality is set below overall materiality under SA 320. The clearly trivial threshold is a separate SA 450 concept, usually set well below materiality, and is not a level in an SA 320 hierarchy. Clearly trivial misstatements need not be accumulated.
Benchmark-based materiality
Overall materiality = Chosen benchmark × Chosen percentage
Benchmark and percentage are matters of professional judgement. SA 320 does not fix a percentage.
SA 330 responses
Overall responses + Further audit procedures (tests of controls + substantive procedures)
Further procedures are designed for assertion level risks, with nature, timing and extent responsive to the assessed risk.
SA 265 communication
Significant deficiencies → in writing to those charged with governance; other deficiencies that merit management's attention → to management
Communicate on a timely basis. Absence of identified deficiencies does not mean controls are effective.

How to solve SA 300 to SA 499: Risk Assessment and Response questions

Use this order for any question on risk assessment and response. It follows the audit flow and keeps each standard in its place.

  1. 1Identify which standard the question tests: planning (SA 300), risk identification (SA 315), materiality (SA 320), response (SA 330) or control deficiencies (SA 265).
  2. 2Write the one-line rule or definition from that standard first. Examiners give marks for the correct term.
  3. 3Apply it to the facts in the case. Name the specific risk, assertion or amount from the question.
  4. 4For risk questions, classify as financial statement level or assertion level, and state whether it is inherent or control risk. Flag any significant risk or fraud risk.
  5. 5For response questions, link each risk to the nature, timing and extent of procedures, and say whether the response is a test of controls or a substantive procedure.
  6. 6For materiality, state the benchmark, the percentage and why, then performance materiality below overall materiality, and mention qualitative factors.
  7. 7For control deficiencies, decide significant or not, then name the recipient (those charged with governance or management) and say communication is in writing for significant ones.
  8. 8Close with a one-line conclusion that answers exactly what was asked.

Quickest way: Risk to response in four lines

When to use it: Use this for short-answer and case-based questions where time is limited and you need to cover the standards quickly.

  1. Line 1: Name the risk and the level (financial statement or assertion) and whether it is inherent or control.
  2. Line 2: State the SA 320 position: benchmark, percentage, performance materiality lower than overall.
  3. Line 3: State the SA 330 response: nature, timing, extent, with the type of procedure.
  4. Line 4: If controls failed, add the SA 265 communication in writing to the right party.

Common mistakes in SA 300 to SA 499: Risk Assessment and Response

  • Treating SA 315 and SA 330 as the same thing.

    Both deal with risk, so students blur them.

    Fix: SA 315 identifies and assesses risk. SA 330 designs and performs the response. Say this one-liner in any comparison answer.

  • Quoting a fixed percentage like 5% of profit as the rule in SA 320.

    Textbook illustrations use such figures.

    Fix: Say the benchmark and percentage are matters of professional judgement. Give percentages only as an example.

  • Setting performance materiality equal to or above overall materiality.

    Students confuse the two terms.

    Fix: Performance materiality is always set lower, to cover aggregation of uncorrected and undetected misstatements.

  • Saying planning is done once at the start and then closed.

    Planning is imagined as a first phase only.

    Fix: SA 300 treats planning as continual and iterative. The strategy and plan are updated as the audit proceeds.

  • Reporting all control deficiencies to the board in writing.

    Students overlook the split in SA 265.

    Fix: Significant deficiencies go in writing to those charged with governance. Other deficiencies that merit management's attention go to management, orally or in writing. The auditor need not report those that others have already communicated to management.

  • Ignoring qualitative factors when judging materiality.

    Students rely only on the amount.

    Fix: A small misstatement may be material if it hides a trend, affects covenants, or involves fraud or related parties.

Worked examples

Example 1

Distinguish between SA 315 and SA 330 and explain how a risk of overstated revenue at a manufacturing company, Sharma Industries Ltd, flows through both.

Show the solution
  1. SA 315 requires the auditor to understand the entity, its environment and internal control, and to identify and assess the risks of material misstatement at financial statement and assertion levels.
  2. SA 330 requires the auditor to design and perform overall responses and further audit procedures whose nature, timing and extent respond to those assessed risks.
  3. Under SA 315 the auditor notes that sales targets drive management bonuses, so revenue is exposed to pressure. Occurrence and cut-off assertions for revenue are assessed as a significant risk.
  4. Under SA 330 the auditor responds with substantive procedures: confirm balances with customers, test sales cut-off around year end, and examine dispatch records and credit notes after year end.
  5. The auditor may also assign more experienced team members and apply unpredictability in procedure selection as overall responses.

Answer: SA 315 identifies and assesses the risk (revenue occurrence and cut-off as a significant risk). SA 330 sets the response (confirmations, cut-off testing, post year-end review and stronger staffing). Assessment comes first and drives the response.

Example 2

During the audit of Rao Traders Pvt. Ltd., the auditor finds that cash receipts are not banked daily and the same person records and handles cash. Explain the auditor's obligations under SA 265 and the effect on audit procedures.

Show the solution
  1. The lack of segregation of duties and delayed banking are control deficiencies in cash handling.
  2. Judge whether they are significant: together they could allow cash misappropriation that is not prevented or detected, so the auditor would normally treat them as a significant deficiency, based on professional judgement.
  3. SA 265 requires the auditor to communicate significant deficiencies in writing to those charged with governance on a timely basis.
  4. Other, less serious deficiencies noted are communicated to management at an appropriate level if they merit management's attention.
  5. Under SA 330, the auditor does not rely on these controls. The auditor increases substantive procedures on cash, such as surprise cash counts, bank reconciliation review and testing of receipts against sales records.
  6. The written communication should describe the deficiencies and explain their potential effects.

Answer: The deficiencies are likely significant. The auditor must report them in writing to those charged with governance, and communicate other deficiencies that merit attention to management. The auditor will not rely on cash controls and will extend substantive testing of cash.

Exam tips

  • For comparison questions such as SA 315 versus SA 330, use two columns of points in written form: purpose, timing in the audit, output and examples.
  • In materiality questions, always show benchmark, percentage, and performance materiality lower than overall materiality. Write that percentages are judgemental.
  • In MCQs, watch the pairs: inherent risk versus control risk, overall materiality versus performance materiality, significant deficiency versus other deficiency.
  • For case-based answers, quote facts from the question in your risk statement so the examiner sees the application, not only the theory.
  • SA 265 questions usually test who receives the communication and in what form. Memorise: significant to those charged with governance in writing.

Practice questions from Brief Introduction to Auditing Standards

SA 300 to SA 499: Risk Assessment and Response in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

SA 300 to SA 499: Risk Assessment and Response: frequently asked questions

What is the difference between SA 315 and SA 330?

SA 315 deals with identifying and assessing the risks of material misstatement. SA 330 deals with the auditor's responses to those assessed risks through overall responses and further audit procedures. Assessment comes first and the response follows it.

Does SA 320 give a fixed percentage for materiality?

No. SA 320 leaves the benchmark and percentage to the auditor's professional judgement. Common benchmarks include profit before tax, revenue and total assets, but the standard does not fix a rate.

What is performance materiality?

It is an amount set lower than overall materiality for the financial statements as a whole. Its purpose is to reduce to an appropriately low level the chance that uncorrected and undetected misstatements together exceed overall materiality.

Who must the auditor tell about control deficiencies under SA 265?

The auditor communicates significant deficiencies in writing to those charged with governance on a timely basis. Other deficiencies that merit management's attention are communicated to management at an appropriate level.