ISA 330 – The Auditor’s Responses to Assessed Risks

What is ISA 330?

ISA 330, titled “The Auditor’s Responses to Assessed Risks,” is one of the cornerstone standards in the International Standards on Auditing (ISAs) framework issued by the International Auditing and Assurance Standards Board (IAASB). It forms a critical bridge between risk assessment governed by ISA 315 and the execution of audit procedures designed to address those risks.

In essence, ISA 330 answers the central question every auditor faces after completing risk assessment: What should I do about it? The standard mandates that auditors design and perform audit procedures whose nature, timing, and extent are directly responsive to the assessed risks of material misstatement at both the financial statement level and the assertion level.

Understanding ISA 330 is essential for audit professionals, finance students, and anyone involved in external or internal auditing. It governs the practical day-to-day decisions auditors make when gathering evidence, testing controls, and drawing conclusions about financial statements.

Objective of ISA 330

The stated objective of ISA 330 is straightforward but profound in its implications: the auditor’s goal is to obtain sufficient appropriate audit evidence regarding the assessed risks of material misstatement through the design and implementation of appropriate responses to those risks.

ISA 330 operates at two distinct levels. At the financial statement level, auditors must design overall responses that address pervasive risks, those affecting many assertions across the financial statements. At the assertion level, auditors must design further audit procedures tailored to each specific assessed risk.

Key Requirements of ISA 330

ISA 330 imposes a set of specific, non-negotiable requirements that govern how every auditor must approach the design and performance of audit procedures. These requirements are not optional enhancements, they are the minimum standard every engagement must meet to achieve compliance with the ISAs.

1. Overall Responses Must Be Designed

The auditor must design and implement overall responses to address assessed risks of material misstatement at the financial statement level. These are pervasive in nature and shape the general conduct of the entire engagement, including staffing decisions, the degree of professional scepticism applied, and the predictability of procedures selected.

2. Further Audit Procedures Must Be Risk-Linked

For each assessed risk at the assertion level, the auditor must design and perform further audit procedures, comprising tests of controls and/or substantive procedures whose nature, timing, and extent directly respond to the nature and magnitude of the risk. Generic programmes that are not tied to specific assessed risks do not satisfy ISA 330.

3. Substantive Procedures Are Always Required

Regardless of the assessed level of control risk, even where controls are considered highly effective, ISA 330 mandates that substantive procedures be performed for all material classes of transactions, account balances, and disclosures. This is one of the most commonly tested requirements in professional examinations and one of the most frequently misunderstood in practice.

4. Controls Over Significant Risks Must Be Tested in the Current Period

Where the auditor intends to rely on controls that address a significant risk, those controls must be tested in the current audit period. There is no provision under ISA 330 to carry forward reliance on prior-period evidence for significant risk controls, the risk environment may have changed, and reliance must be freshly established each year.

5. Inquiry Alone Is Insufficient for Tests of Controls

ISA 330 is explicit that inquiry, on its own, does not provide sufficient audit evidence about the operating effectiveness of a control. The auditor must supplement inquiry with at least one of the following: inspection of documents, observation of the control in operation, or reperformance of the control by the auditor.

6. Comprehensive Documentation Is Mandatory

ISA 330 requires the auditor to document the overall responses to assessed risks, the nature, timing, and extent of further audit procedures, the results obtained, and where prior-period control evidence is relied upon, the basis for that reliance. The documentation standard is that an experienced auditor with no prior connection to the engagement must be able to understand exactly what was done and why.

Overall Responses to Assessed Risks

ISA 330 requires auditors to design overall responses to address risks at the financial statement level. These responses reflect the auditor’s professional judgment about the overall risk profile of the engagement and are not tied to specific assertions.

Common overall responses include modifying the nature, timing, and extent of further audit procedures; increasing the unpredictability of selected procedures; assigning more experienced staff or those with specialized skills to higher-risk areas; and paying enhanced attention to the selection of accounting policies or adequacy of disclosures.

Further Audit Procedures under ISA 330

At the heart of ISA 330 is the concept of further audit procedures, the specific work the auditor performs to respond to assessed risks at the assertion level. These procedures are distinct from risk assessment procedures (which merely gather information about risks) in that they are designed to obtain audit evidence about whether material misstatements exist.

ISA 330 specifies that further audit procedures consist of tests of controls and substantive procedures. The nature, timing, and extent of these procedures are determined by the auditor’s judgment, considering the assessed risk level, the characteristics of the area being tested, and the intended purpose of the procedure.

Nature, Timing, and Extent – The Three Dimensions of Audit Procedure Design

Tests of Controls under ISA 330

Tests of controls are audit procedures designed to evaluate the operating effectiveness of controls in preventing or detecting and correcting material misstatements at the assertion level. Under ISA 330, the auditor is required to perform tests of controls when the risk assessment assumes the controls are operating effectively, or when substantive procedures alone cannot provide sufficient appropriate audit evidence.

It is important to distinguish between two aspects of internal controls: design and implementation (addressed by ISA 315 during risk assessment) and operating effectiveness (addressed by ISA 330 through tests of controls). A well-designed control that is not consistently applied offers little audit assurance.

Designing Tests of Controls

When designing tests of controls, the auditor must consider the nature of the control, the frequency of its operation, the consistency of its application, the personnel involved, and the period of intended reliance. A control that operates monthly will generally require fewer tests than one that operates daily, though the auditor must still gather enough evidence to support reliance across the entire audit period.

Using Audit Evidence from Prior Periods

ISA 330 permits auditors to use evidence about controls obtained in prior audits, subject to important constraints. The auditor must evaluate whether there have been any changes to the control or the environment in which it operates. In any event, ISA 330 requires the auditor to test controls at least once every third audit, and more frequently when there are significant changes or high-risk situations.

Substantive Procedures under ISA 330

Substantive procedures are audit procedures designed to detect material misstatements at the assertion level. ISA 330 mandates that the auditor design and perform substantive procedures for all material classes of transactions, account balances, and disclosures regardless of the assessed risk. This is a non-negotiable requirement: even where controls are assessed as highly effective, substantive procedures must still be performed.

Two Types of Substantive Procedures

Substantive Procedures at Period End vs. Interim

While ISA 330 permits substantive procedures to be performed at an interim date, doing so increases the risk that misstatements existing at period end will not be detected. When interim substantive testing is chosen, the auditor must perform additional procedures to cover the “rollforward period” — the time between interim testing and the period end.

Addressing Significant Risks under ISA 330

ISA 330 imposes special requirements for significant risks, those identified under ISA 315 as requiring special audit consideration. For significant risks, the auditor must perform substantive procedures that are specifically responsive to the risk. In many cases, this means tests of details rather than relying solely on analytical procedures.

Where the auditor plans to rely on controls over a significant risk, the auditor must test those controls in the current period. There is no option to rely on evidence from prior periods for controls over significant risks.

Common significant risks include revenue recognition, management estimates, related party transactions, complex accounting treatments, and areas with significant management judgment. The audit response in each case must be directly tailored to the specific nature of the risk identified.

Practical Example of ISA 330

To understand how ISA 330 works in practice, consider a real-world audit scenario involving a manufacturing company with a significant inventory balance. This example walks through how an auditor applies ISA 330’s requirements from risk assessment response through to evidence evaluation.

The Scenario

During risk assessment under ISA 315, the auditor identifies a high risk of material misstatement in inventory valuation. The company holds a large volume of slow-moving raw materials, and management applies significant judgment in determining net realisable value (NRV) write-downs. This risk is classified as a significant risk due to the subjectivity involved and the magnitude of the balance.

Step 1 – Overall Response (Financial Statement Level)

In response to the pervasive risk environment, the engagement partner assigns a senior manager with manufacturing sector experience to lead the inventory work. The team also decides to increase the unpredictability of procedures by performing an unannounced inventory count observation, rather than the previously scheduled date to reduce the risk of management manipulation.

Step 2 – Tests of Controls

The auditor identifies that management operates a monthly NRV review control, where the Finance Director signs off on a slow-moving inventory report prepared by the inventory controller. The auditor designs a test of controls to evaluate whether this control operated effectively throughout the year. The test involves: (a) inquiry of the inventory controller and Finance Director about the review process; (b) inspection of 12 signed-off monthly reports to confirm the sign-off occurred; and (c) reperformance of the NRV calculation for a sample of items to confirm the review was substantive and not merely perfunctory. Inquiry alone would not have been sufficient under ISA 330.

Step 3 – Substantive Procedures

Because this is a significant risk, the auditor cannot rely solely on the controls test, substantive procedures specifically responsive to the NRV risk are mandatory. The auditor designs the following:

• Substantive analytical procedure: Comparing the current year write-down percentage against prior years and industry benchmarks to assess whether management’s estimate appears reasonable.
• Test of details: Selecting a sample of slow-moving inventory lines and independently recalculating the NRV by reference to post-year-end sales invoices, current purchase costs, and scrap quotes obtained directly from third-party suppliers.
• External confirmation: Obtaining direct confirmation of consignment inventory balances held at third-party warehouses to address the existence and completeness assertions.

Because the risk is assessed as high, procedures are performed at period end rather than at an interim date, consistent with ISA 330’s guidance that higher risk warrants period-end substantive testing.

Step 4 – Evaluating Results and Documenting

The test of details reveals that management’s NRV write-down is understated by a material amount for three product lines where post-year-end sales prices fell significantly below carrying value. The auditor documents the finding, discusses it with management, and obtains an adjusting journal entry before the financial statements are finalised. The entire audit response, from the risk assessment linkage to the procedures performed, results obtained, and conclusion reached is documented in the audit file in sufficient detail to satisfy ISA 330’s documentation requirements.

Evaluating Sufficiency and Appropriateness of Audit Evidence

After performing audit procedures, ISA 330 requires the auditor to evaluate whether the audit evidence obtained is sufficient and appropriate to support the conclusions reached and the auditor’s report. This evaluation requires professional judgment that integrates findings from all procedures performed.

Where audit evidence suggests that a material misstatement may exist, the auditor must perform additional procedures to determine whether a misstatement actually exists. If the auditor concludes that procedures have not provided sufficient appropriate evidence, they must modify the audit approach; extending procedures, performing alternative tests, or reconsidering the ability to issue an unmodified audit opinion.

Documentation Requirements Under ISA 330

ISA 330 sets clear documentation requirements that form an essential part of audit quality. The auditor must document all of the following elements:

Relationship with Other ISAs

ISA 330 does not operate in isolation. It sits within a framework of related standards that together govern the complete audit response process. Understanding these relationships is critical for applying ISA 330 effectively.

Relationship between ISA 315 and ISA 330

Of all the relationships within the ISA framework, none is more operationally important than the link between ISA 315 (Identifying and Assessing the Risks of Material Misstatement) and ISA 330 (The Auditor’s Responses to Assessed Risks). These two standards function as a sequential, inseparable pair and understanding how they interact is fundamental to understanding how a modern risk-based audit works.

ISA 315: The Diagnostic Standard

ISA 315 governs the first half of the audit process: understanding the entity, its environment, and its internal controls, and using that understanding to identify and assess where material misstatements could exist. The output of ISA 315 work is a set of assessed risks of material misstatement at both the financial statement level and the assertion level for each material class of transactions, account balance, and disclosure.

Critically, ISA 315 (Revised 2019) introduced the concept of the spectrum of inherent risk, requiring auditors to assess not merely whether a risk exists, but how far along the spectrum from lower to higher it sits. This more granular assessment feeds directly into the calibration of ISA 330 responses.

ISA 330: The Response Standard

ISA 330 picks up exactly where ISA 315 ends. It requires the auditor to take each assessed risk produced by ISA 315 and design a procedure or combination of procedures, specifically calibrated to address it. The higher the inherent risk assessed under ISA 315, the more persuasive and extensive the ISA 330 response must be.

This linkage is not merely conceptual, it must be explicitly documented. The auditor’s working papers must demonstrate a clear, traceable connection between each ISA 315 assessed risk and the ISA 330 procedures designed to respond to it. A procedure performed without a documented risk linkage does not satisfy ISA 330, regardless of its quality.

The Sequential Workflow

Frequently Asked Questions