SA 330 requires the auditor to design and perform audit procedures whose nature, timing and extent respond directly to the risks of material misstatement identified under SA 315 — at both the overall financial-statement level and the specific assertion level. The core discipline the standard enforces is traceability: every significant risk identified during planning has to have a procedure in the file that actually addresses it, and every substantive procedure performed should be explainable by reference to a specific risk, not simply a standard checklist item carried forward from last year.
Two kinds of response, and when each applies
| Test of controls | Substantive procedure | |
|---|---|---|
| What it evaluates | Whether a control operates effectively to prevent or detect a misstatement | Whether the balance or transaction itself is free of material misstatement, directly |
| When it's required | Whenever the auditor plans to rely on the control's operation to reduce substantive testing, or when substantive procedures alone cannot provide sufficient evidence | Always — SA 330 requires substantive procedures for every material class of transaction, balance and disclosure, regardless of how effective controls appear |
| Example | Observing that a payment above a threshold actually required a second approver's sign-off before release | Vouching a sample of payments directly to supporting invoices and evidence of receipt |
Regulatory requirement
Substantive procedures are never optional, no matter how strong the controls appear. SA 330 explicitly requires substantive procedures for every material account balance, transaction class and disclosure — a controls-reliance strategy reduces the extent of substantive testing, it never eliminates it entirely.
What "more persuasive evidence" actually means
For a higher-assessed-risk item, SA 330 doesn't just call for a bigger sample — it calls for evidence that is individually more persuasive. That can mean obtaining evidence from an independent source rather than the client's own records (an external confirmation rather than an internal schedule), performing a procedure closer to or after the year end rather than at an interim date, or using more experienced team members to perform or review the work. A larger sample of weak evidence is not an adequate substitute for better evidence, even where the two notionally cost the same effort.
- 01Match the procedure's nature to the risk's specific assertionA completeness risk needs a test that starts outside the client's own recorded population (a reverse-direction test); an occurrence risk needs a test that starts from what's recorded and traces outward.
- 02Match the timing to the riskA higher-risk balance is more often tested at or after year end rather than at an interim date, to avoid relying on an assumption that nothing material changed in the roll-forward period.
- 03Match the extent — sample size or population coverage — to both risk and materialityHigher risk and lower performance materiality both independently push toward a larger sample, or toward full-population testing where that's practical.
Why a stale, carried-forward procedure fails this standard
A procedure copied from last year's file without being re-linked to this year's actual risk assessment is exactly what SA 330 is designed to prevent. If the risk assessment changed — a new vendor relationship, a changed revenue model, a control that was replaced — the procedures have to change with it. A reviewer checking SA 330 compliance should be able to point at any risk in the SA 315 assessment and find the specific procedure in the file that responds to it, not infer that "testing happened somewhere."
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit workflow & automationSA 315: identifying and assessing the risks of material misstatementA risk assessment that doesn't name a specific assertion isn't a risk assessment under SA 315 — it's a general impression written down.
- Audit workflow & automationSA 320: materiality in planning and performing an auditOverall materiality and performance materiality are not the same number with a safety margin added — they answer two different questions.
- Audit workflow & automationAudit sampling methods for Indian CA firmsStatistical vs judgmental sampling, when full-population testing removes the need to sample, when sampling still applies, and what drives sample size.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.