A3 · Risk assessment & significant risks

Document the nature of the entity using information obtained. Do not invent a different entity type.

Document ownership and governance to the extent known from the file (including A1/A2).

Document principal operations and the business model, if known.

Document industry and regulatory environment considerations currently known.

Document external factors relevant to financial reporting, if identified.

Document sources of revenue to the extent known. Do not invent revenue streams.

Document financing, if known.

Document organizational structure and significant locations/components, if applicable.

Document known changes from the prior period, if a prior period exists and information is available.

Document the applicable financial reporting framework from the engagement record.

Document known significant accounting policies. Do not invent policies.

Document known changes in accounting policies, if any.

Identify significant estimates currently known, if any.

Identify unusual or complex accounting matters currently known, if any.

Document presentation and disclosure considerations currently known.

Document entity objectives relevant to financial reporting, if known.

Document strategies relevant to financial reporting, if known.

Identify business risks currently known. Do not invent business risks.

For each identified business risk, document whether it gives rise to a risk of material misstatement. Do not treat business risk as automatically an RoMM.

Document financing pressures, operational risks, technology changes, or regulatory changes if identified.

Link identified financial-statement implications to the risk register only when the auditor has identified a risk. Do not auto-create risks.

Document understanding of the control environment based on work performed.

Document observations, inquiries, or walkthrough references actually performed. Do not invent walkthroughs.

Identify controls relevant to risk assessment, if any. Existence of a control is not operating effectiveness.

Document identified deficiencies, if any. Leave blank if none have been identified.

Document monitoring of controls to the extent understood.

Document how management identifies business and financial-reporting risks, or that no formal process has been identified.

Document how management evaluates significance of identified risks, if a process exists.

Document how management determines responses, if a process exists.

Document how management monitors changes in risk, if a process exists.

If management has no formal risk-assessment process, document that fact and the implication for the audit. Do not invent a process.

Identify significant transaction flows currently known.

Document initiation, authorization, recording, and reporting for significant flows, to the extent understood.

Identify data sources, reports, spreadsheets, or manual processes relevant to financial reporting, if known.

Identify interfaces currently known, if any.

Document the journal-entry process to the extent understood.

Document information used in financial reporting, if identified.

Document communications to management/governance relevant to financial reporting, if identified.

Identify control activities relevant to identified risks, if any. Do not invent controls.

For identified controls, document owner, frequency, and manual/automated nature if determined.

Document IT applications, interfaces, or general IT-control considerations relevant to identified controls, if any.

Document design and implementation considerations based on work performed. Do not conclude operating effectiveness here.

Record planned testing/reliance status as Not determined, Plan to test, or No reliance. Do not force reliance.

Need for an IT specialist remains a planning determination; do not automatically conclude a specialist is required.

Identify significant classes of transactions currently expected, or document that identification has not yet been performed.

Identify significant account balances currently expected, linking to the trial balance when an account exists. Do not invent amounts.

Identify significant disclosures currently expected, linking to financial-statement areas when they exist.

Record relevant assertions at the area level only when determined. Do not auto-select all assertions.

Note materiality and audit-program linkage as status links only. Do not calculate materiality here.

For each identified risk or significant area addressed, record an inherent-risk assessment or document that it has not yet been assessed.

Document inherent-risk factors considered (complexity, subjectivity, change, uncertainty, susceptibility to bias or fraud) where relevant.

Do not treat High inherent risk as automatically a significant risk; record the separate significant-risk evaluation in A3.12.

Leave assessments as Not assessed rather than inventing a rating.

For each identified risk addressed, record a control-risk assessment or document that it has not yet been assessed.

Identify controls relevant to the risk, if any, and whether design/implementation has been considered sufficiently for any reliance decision.

Document rationale and limitations. Do not automatically set control risk to Low.

Record the planned response related to controls (no reliance, or plan to test) without performing tests of operating effectiveness here.

Identify risks of material misstatement based on work performed, or document that identification has not yet been performed. Do not invent risks.

For each identified risk, record financial-statement level or assertion level, description, and affected area if determined.

Link relevant assertions only when determined. Do not auto-check all assertions.

Record inherent-risk and control-risk assessments on the risk record separately.

Record planned audit response, evidence, and cross-references when determined. Leave blank rather than inventing a response.

Evaluate whether any identified risk is a significant risk, with rationale. If none is identified, document that evaluation. Do not auto-classify.

Document fraud-related considerations applicable to the engagement period. Do not invent fraud.

Document management-override considerations where applicable under the engagement’s fraud standard/version.

Document revenue-recognition fraud considerations based on information obtained. Do not automatically treat every revenue stream as a fraud risk.

Document communications or consultations related to significant risks or fraud, if any.

Record that SAS No. 151 is not mandatory for this 2025 period unless early implementation is expressly documented on the risk-assessment record.

Identify financial-statement-level risks based on work performed, or document that none have been identified / not yet evaluated.

Document affected areas and pervasive considerations, if a FS-level risk is identified.

Document potential effect on the overall audit approach, if determined.

Link planned responses and workpapers when determined.

Consider whether all significant classes of transactions have been identified, based on information obtained.

Consider whether all significant account balances have been identified.

Consider whether all significant disclosures have been identified.

Consider whether relevant assertions have been identified for significant areas addressed.

Consider whether assessed risks reasonably reflect the understanding obtained.

Consider whether significant risks have been appropriately identified (including documenting if none).

Document whether later planning information changed the risk assessment. If no change, record that no change has been identified.

Record overall risk-assessment status based on work actually performed.

Summarize significant risks identified, or document that none have been identified.

Summarize financial-statement-level and assertion-level risks recorded, if any.

Summarize control-risk conclusions actually reached, if any.

Document major changes from A2, unresolved matters, consultations, and planned audit-program linkage.

Document the overall conclusion only if one has been reached. Do not auto-complete this item.