Linking assessed risks to audit procedures
How each assessed risk should lead to specific further audit procedures under ISA 330, and how a reviewer can see that link in the working papers.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Inspection findings on small audits often read the same way. The risk assessment identified a significant risk over inventory valuation. The inventory working papers contain a count attendance, a cost test on a sample and a lead schedule. None of those procedures addresses valuation in the sense the risk described: obsolete stock carried above what it will sell for. The risk assessment and the audit work were both done, but they were never connected.
ISA 330 exists to make that connection. The auditor designs and performs further audit procedures whose nature, timing and extent are based on, and responsive to, the assessed risks of material misstatement at the assertion level. And the file has to show the link.
Assertion-level risks and their responses
A risk stated at assertion level already points at its response. "Inventory may be overstated because slow-moving spares are carried at cost when their net realisable value is lower" is a risk about valuation, for a specific reason. The response follows naturally: analyse inventory by age and movement, compare cost with selling prices after year end for slow lines, inspect slow lines for condition at the count, and challenge management's write-down policy.
A risk stated vaguely, such as "inventory is a significant risk", gives the team nothing to respond to, which is how files end up with procedures that do not fit.
ISA 330 also requires overall responses to risks at the financial statement level: emphasising professional scepticism, assigning more experienced staff, increasing supervision, and building unpredictability into the procedures. Those belong in the strategy, not in individual working papers.
Nature, timing and extent
Each response has three dimensions, and the assessed risk should drive all of them.
| Dimension | Question | Effect of a higher assessed risk |
|---|---|---|
| Nature | Which kind of procedure: tests of controls, tests of details, substantive analytics? | More persuasive evidence, often from external sources or direct inspection |
| Timing | When: interim, year end, after year end? | Work closer to, or after, the period end |
| Extent | How much: sample sizes, thresholds, coverage? | Larger samples, lower thresholds |
Some rules are fixed regardless of the assessment. ISA 330 requires substantive procedures for each material class of transactions, account balance and disclosure. For a significant risk, the auditor performs substantive procedures specifically responsive to it, and if the response is substantive only, it must include tests of details. If the team intends to rely on controls, it tests their operating effectiveness.
Procedures listed on each work item
In Achekam, each work item lists the procedures to perform and the documents required. A step is marked done only with a written response and its documents, or set aside with a reason, and steps are never deleted. That makes the work item the natural place for the link: the procedures on the inventory valuation item should be recognisably the response to the inventory valuation risk.
The procedures usually come from the methodology. Staff can generate an engagement's working papers from it: Achekam reads the engagement's facts, a person confirms what it cannot read, another person approves the profile, and a dry run shows which papers will be created before any are. A firm's partners keep their own methodology and working-paper templates beside Achekam's platform methodology, and a template version is published only by someone other than its author.
Generated procedures are a starting point, not a response. Read them against the specific risk. If the risk is about obsolete spares and the template's procedures test cost, add the procedures that address net realisable value, and set aside, with a reason, any that do not respond to anything assessed. The reason stays on the file.
Viewing the file by risk
The Working Paper Control Centre shows the engagement's file as an index with progress by status, and can group the same papers by preparer, reviewer, risk or statement line. Grouped by risk, the index becomes a quick test of the link: each assessed risk, with the papers that answer it underneath.
Two things to look for in that view:
- a risk with no papers beneath it, which means no response was designed;
- papers that sit under no risk at all, which may be routine substantive work on material balances (required regardless) or procedures nobody can explain.
How to structure the index so this view stays readable is covered in the working paper index structure.
Evidence that each response was performed
ISA 330 requires documentation of the overall responses, the nature, timing and extent of the further procedures, the linkage of those procedures with the assessed risks at assertion level, and the results, including conclusions where they are not otherwise clear.
The review stages provide the check. Each working paper moves through preparation, manager review, partner review, an optional engagement quality review, completion and lock. The preparer cannot also review the paper, and Achekam refuses any sign-off made by an AI. Sending a paper back, reopening it or locking it needs a written reason.
A worked example in words: the manager reviewing the revenue paper sees a significant risk of fictitious sales near year end. The procedures performed are an analytical review of monthly revenue and a test of a random sample of invoices across the year. Neither targets the risk. The manager sends the paper back with the reason "procedures do not address cut-off or occurrence near year end", and the preparer adds a test of sales either side of the year end to delivery evidence and of credit notes raised after it. The written reason and the added procedures show the link that was missing.
The ACCA's article on responses to assessed risks explains how auditors respond under ISA 330 using tests of controls and substantive procedures. The risk assessment that feeds all of this is covered in understanding the entity and assessing risk.
A reviewer's check
- Is each significant risk stated at assertion level, with its reason?
- Does each have at least one procedure specifically responsive to it, including tests of details where the response is substantive only?
- Do timing and extent reflect the assessment?
- Has every generated procedure that does not fit been set aside with a reason?
- Does the conclusion on each paper refer back to the risk it answers?
For the next planning meeting
Write each significant risk on the planning paper in a single sentence that begins "The statements could be misstated because...". If the team cannot finish the sentence, the response cannot be designed.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
