Every audit plan rests on one question: where could the financial statements be materially wrong? ISA 315 (Revised 2019), Identifying and Assessing the Risks of Material Misstatement, is the standard that answers it. It applies to audits of financial statements for periods beginning on or after 15 December 2021, so most audit teams are now several cycles into using it. Yet file reviews still show generic risk assessments copied forward, thin IT understanding, and significant risks asserted rather than reasoned.
This guide covers what the standard requires, why it matters, common gaps in practice, and a checklist for your next engagement.
What ISA 315 (Revised 2019) requires
The objective of the standard (paragraph 11) is for the auditor to identify and assess the risks of material misstatement, whether due to fraud or error, at both the financial statement level and the assertion level. That assessment then drives the design of further audit procedures under ISA 330.
The requirements follow a logical flow:
- Risk assessment procedures (paragraphs 13–18). These must include inquiries of management and others (including internal audit where it exists), analytical procedures, and observation and inspection. They must not be biased towards corroborating evidence or away from contradictory evidence. The engagement team must also discuss how the financial statements could be misstated.
- Understanding the entity and its environment (paragraphs 19–20). This covers structure, governance, the business model and its use of IT, industry and regulatory factors, performance measures and accounting policies. The auditor must understand how the inherent risk factors affect the susceptibility of assertions to misstatement.
- Understanding the system of internal control (paragraphs 21–27). The auditor must understand all five components: the control environment, the entity’s risk assessment process, its process for monitoring internal control, the information system and communication, and control activities.
- Identifying and assessing risks (paragraphs 28–37). This includes determining relevant assertions and significant classes of transactions, balances and disclosures; assessing inherent and control risk separately; identifying significant risks; and a “stand-back” evaluation (paragraph 36) of material items not assessed as significant.
- Documentation (paragraph 38). The file must record the team discussion, key elements of the understanding, the evaluation of controls, and the assessed risks with the rationale for significant judgements.
The key concepts that changed how risk is assessed
Inherent risk factors and the spectrum of inherent risk
The revised standard introduced inherent risk factors as the lens for assessing risk. They are complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or other fraud risk factors. Inherent risk is assessed on a spectrum by considering both the likelihood and the magnitude of a possible misstatement (paragraph 31). A significant risk is one assessed close to the upper end of that spectrum.
In a Zimbabwean context, these factors are rarely abstract. Multi-currency records in ZiG and USD create complexity in translation and presentation. Exchange rate movements and changes in functional currency judgements create change and uncertainty. Expected credit loss models at banks and microfinance institutions are highly subjective. Donor-funded NGOs with restricted grant income face pressure to show spending against budget, a classic management bias factor.
Separate assessment of inherent and control risk
For risks at the assertion level, inherent risk and control risk must be assessed separately. Paragraph 34 is clear: if you do not plan to test the operating effectiveness of controls, control risk is assessed so that the risk of material misstatement equals inherent risk. You cannot reduce assessed risk on the strength of controls you have not tested.
IT and general IT controls
Paragraph 26 requires the auditor to identify IT applications and other aspects of the IT environment that are subject to risks arising from the use of IT, and the general IT controls that address those risks. From a parastatal running an ERP to a bank with a core banking system, access and change management controls often determine whether system reports can be relied on at all.
Why it matters
A weak risk assessment produces a weak audit. If the risk is misjudged, the response under ISA 330 is aimed at the wrong place: too much work on low-risk balances and not enough where misstatement is most likely. For firms and audit departments in Zimbabwe and across the region, where resources are tight, a sharp ISA 315 assessment is the best way to spend limited audit hours.
Internal auditors should pay attention too. ISA 315’s logic maps closely to good risk-based internal audit planning, and external auditors must understand the internal audit function as part of the monitoring component (paragraph 24).
Common gaps seen in practice
- Rolled-forward risk assessments. Last year’s risks copied without considering changes in the business, regulation, currency or systems. Paragraph 16 requires prior-period information to be re-evaluated.
- Risks not linked to assertions. Risks described as “revenue risk” without specifying whether the concern is occurrence, cut-off or accuracy.
- Inherent risk factors not documented. Ratings of high, medium or low with no explanation of which factors drive them.
- Control reliance without testing. Control risk assessed below maximum when no tests of operating effectiveness are planned.
- Superficial IT understanding. A one-line note that “the entity uses Sage” without identifying the applications, reports and general IT controls relevant to the audit.
- Analytical procedures done too late. Preliminary analytics are a required risk assessment procedure, not a box ticked after fieldwork. Running them over the full general ledger is far easier with a dedicated tool such as ProDataTool, which handles large datasets and supports summarisation and pivot analysis that Excel can struggle with.
Practical ISA 315 checklist
| Area | Question to ask | Reference |
|---|---|---|
| Risk assessment procedures | Have we performed inquiries, preliminary analytics, and observation and inspection? | Para 14 |
| Team discussion | Is the engagement team discussion documented, including fraud and framework matters? | Paras 17, 38(a) |
| Entity understanding | Have we documented the business model, regulation, IT use and accounting policies, including changes this year? | Paras 19–20 |
| Internal control | Have we understood all five components and evaluated each one? | Paras 21–25 |
| Control activities and IT | Have we identified relevant controls, IT applications and general IT controls, and evaluated design and implementation? | Para 26 |
| Inherent risk | Is each risk linked to an assertion with the inherent risk factors and likelihood/magnitude explained? | Para 31 |
| Control risk | Is control risk at maximum where no controls testing is planned? | Para 34 |
| Significant risks | Have significant risks been identified with a clear rationale? | Para 32 |
| Stand-back | Have we revisited material balances not assessed as significant? | Para 36 |
| Revision | Has the assessment been updated for new information found during the audit? | Para 37 |
Conclusion
ISA 315 (Revised 2019) asks auditors to think, not just fill in forms. Teams that apply it well start early, link every risk to an assertion and its inherent risk factors, are honest about control reliance and take IT seriously.
Bring structure to your risk assessments. Auditors Track GRC helps audit teams across Africa digitise their work, from risk assessments and audit reviews to findings, report writing and evidence attachments. Built-in libraries of controls, audits, working papers and risks give your team a consistent starting point, while dashboards by department and engagement type and multi-user department assignments keep everyone aligned. Book a free demo of Auditors Track GRC and see how it fits your audit methodology.