ISA 330: A Proposed Shift towards a More Genuinely Risk-based Audit

Key takeaways

• The IAASB has proposed significant changes to ISA 330, including removing paragraph 18; these are proposals, not final requirements.
• Paragraph 18 currently requires substantive procedures for each material class of transactions, account balance and disclosure, even without an assessed assertion-level risk.
• The proposals rely on the stronger risk assessment requirements in ISA 315 (Revised 2019).
• Benefits include a more genuinely risk-based audit and fewer repetitive procedures; the main risk is insufficient work after a poor risk assessment.
• Firms should test their methodology and consider commenting on the proposals.

The International Auditing and Assurance Standards Board (IAASB) has proposed significant changes to ISA 330, The Auditor's Responses to Assessed Risks, as part of its broader project to modernise the audit evidence and risk response standards. The proposals aim to make the standards more responsive to changes in technology and encourage auditors to focus more specifically on the risks of material misstatement.

One of the most interesting proposals is the removal of paragraph 18 of the current ISA 330.

Why is paragraph 18 important?

Paragraph 18 currently requires auditors to design and perform substantive procedures for each material class of transactions, account balance, and disclosure, regardless of whether a relevant assertion-level risk has been identified.

In simple terms, even if the auditor has not identified a specific risk relating to a material balance or disclosure, some substantive audit work is still required.

This requirement has traditionally provided an important safety net. It reduces the risk that a material item might receive little or no audit attention simply because the auditor's risk assessment did not identify a specific risk.

The IAASB is now proposing to remove this requirement because of developments in the risk assessment requirements in ISA 315 (Revised 2019). The revised ISA 315 places much greater emphasis on identifying and assessing risks at the assertion level. The IAASB's view is that a properly performed risk assessment should provide the foundation for determining where audit work is necessary.

What would replace the safety net?

The removal of paragraph 18 does not mean that auditors can simply ignore material balances or disclosures.

The proposed changes place greater emphasis on the quality of the auditor's risk assessment. Where a material class of transactions, account balance or disclosure is not identified as significant, the auditor will need to document the basis for that conclusion.

The proposal, therefore, shifts some of the responsibility from a mandatory procedural requirement to professional judgment supported by a robust risk assessment.

This is potentially a significant change in audit methodology.

The benefits

There are several potential benefits.

Firstly, the audit could become more genuinely risk-based, with auditors focusing their resources on areas where there is a greater likelihood of material misstatement, rather than performing substantive procedures, simply because an account is material.

Secondly, it could reduce unnecessary or repetitive audit procedures. This may be particularly beneficial where sophisticated systems and controls provide reliable audit evidence.

The proposals also recognise the increasing role of technology. In highly automated environments, testing relevant controls may sometimes provide more persuasive evidence than testing large numbers of individual transactions.

The proposed standard would allow, in certain circumstances, a controls-only response to an assessed assertion-level risk. However, safeguards remain, including restrictions relating to significant risks and higher levels of inherent risk.

But there are risks

The proposed removal of paragraph 18 also creates a potential danger: a poor risk assessment could lead to insufficient audit work.

The current requirement provides a useful backstop. Removing it means that the auditor's risk assessment becomes even more important. If an auditor incorrectly concludes that a material balance is not significant, or that only a relevant assertion is scoped in, the balance could receive considerably less substantive attention than it would under the current standard.

This places greater responsibility on engagement teams to exercise professional scepticism and judgment, and properly understand the entity, its environment, internal controls and financial reporting processes.

It also means that file reviewers and engagement quality reviewers will need to pay particular attention to the logic linking risk assessment to audit response.

What should firms be doing now?

Although these are still proposed changes, audit firms should consider whether their current audit methodology is genuinely risk-based.

A useful question to ask during file reviews is: 'If paragraph 18 did not exist, would we still have performed the procedures we performed on this balance or disclosure — and can we clearly explain why?'

If the answer is 'no', the audit may be relying too heavily on standardised procedures, rather than risk assessment.

Additionally, audit firms are encouraged to comment on the proposed changes.

Conclusion

The proposed removal of paragraph 18 could make audits more efficient and better focused. However, the trade-off is clear: less mandatory substantive work requires better professional judgment.

For audit firms, the message is simple – if these proposals are adopted, a strong ISA 315 risk assessment will no longer just be the starting point of the audit. It will become an even more critical foundation for determining the audit work and evidence necessary to support a high-quality audit opinion.

References

1. ISA 330 (Revised), The auditor's responses to assessed risks
2. ISA 315 (Revised 2019), Identifying and assessing the risks of material misstatement
3. Proposed revisions to ISA 330, The auditor's responses to assessed risks

Frequently asked questions

What does paragraph 18 of ISA 330 currently require?

It requires the auditor to design and perform substantive procedures for each material class of transactions, account balance and disclosure, regardless of whether a relevant assertion-level risk has been identified.

Why is the IAASB proposing to remove paragraph 18?

The IAASB's view is that the greater emphasis on identifying and assessing risks at assertion level in ISA 315 (Revised 2019) means a properly performed risk assessment should determine where audit work is necessary.

Does removing paragraph 18 mean material balances can be ignored?

No. Where a material class, balance or disclosure is not identified as significant, the auditor would need to document the basis for that conclusion, and professional judgment supported by a robust risk assessment replaces the mandatory procedure.

What should audit firms do now?

Although these are proposed changes, firms should check whether their methodology is genuinely risk-based, for example by asking in file reviews whether the same procedures would have been performed if paragraph 18 did not exist, and consider commenting on the proposals.

This newsletter is also published on LEAF's LinkedIn newsletter. To receive future editions, subscribe using the newsletter sign-up on this page.

Upcoming Events