SA 315 requires the auditor to identify and assess the risks of material misstatement, at both the financial statement level and the assertion level, by obtaining an understanding of the entity and its environment, its financial reporting framework, and its system of internal control. The output that actually matters is not a general narrative about the business — it's a list of specific risks, each tied to a specific assertion (occurrence, completeness, accuracy and so on) for a specific account balance or class of transactions, because that link is what SA 330 then uses to design the procedures that respond to each risk.
What "understanding the entity" actually covers
| Area | Why it drives risk |
|---|---|
| Industry, regulatory and other external factors | A business in a declining industry or a newly regulated sector carries different risk than one in a stable, familiar one |
| Nature of the entity — operations, ownership, governance, financing structure | Complex ownership or financing structures create risk in areas (related parties, covenant compliance) a simpler entity wouldn't have |
| Accounting policies and why they were selected | A policy choice that's aggressive relative to industry norms is itself a risk signal |
| Objectives, strategies and related business risks | A business risk (losing a key customer, a covenant breach) often becomes a financial reporting risk — the two are connected, not separate |
| Measurement and review of financial performance | How management itself measures performance reveals what it's incentivised to manage, which is where bias tends to show up |
Why a risk needs an assertion to actually be useful
"Revenue is risky because the client is under pressure to hit targets" is an observation, not yet a risk assessment SA 330 can act on. "Revenue may be overstated through premature recognition near year end (occurrence/cut-off assertion)" is specific enough that a reviewer can check whether the planned procedures — in this case, cut-off testing around the year end — actually respond to it. The gap between those two sentences is the single most common reason a risk assessment reads as thorough but doesn't actually drive the audit plan underneath it.
A risk assessment section that lists risks without naming the specific assertion each one affects cannot be traced forward to SA 330's required response — which means, on review, it functions as narrative rather than as the planning document the standard requires.
Understanding internal control — what's actually required
- 01Understand the control environmentManagement's attitude toward integrity and control, not whether every individual control works — this is assessed at the entity level.
- 02Understand the entity's risk assessment processDoes the entity itself identify and respond to risks relevant to financial reporting? An entity with no risk assessment process of its own is a different risk profile than one with a mature one.
- 03Understand the information system relevant to financial reportingHow transactions are initiated, recorded, processed and reported — including IT general controls where systems are involved.
- 04Understand control activities relevant to the auditNot every control in the business — specifically the ones relevant to the risks already identified.
- 05Understand monitoring of controlsHow the entity assesses whether its own controls are operating, including its internal audit function if one exists.
Common practice, not a requirement
Understanding internal control under SA 315 does not, by itself, mean testing whether controls operate effectively — that's a separate decision (test of controls vs. a fully substantive approach), made after the understanding is obtained, based on whether relying on controls is an efficient and appropriate response.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit workflow & automationStatutory audit planning checklistUnderstanding the entity, setting materiality, risk assessment at planning, and briefing the team against a realistic timeline — a rounded planning reference.
- Audit workflow & automationSA 320: materiality in planning and performing an auditOverall materiality and performance materiality are not the same number with a safety margin added — they answer two different questions.
- Audit workflow & automationSA 330: the auditor's responses to assessed risksA higher-risk item doesn't just need more testing. It needs more persuasive evidence — those are two different design decisions.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.