PCAOB Risk Assessment: AS 1101 Through AS 2301 Explained
A Practical Guide to Planning, Identifying, Assessing, and Responding to Risks of Material Misstatement
Risk assessment is the foundation of an effective financial statement audit performed under Public Company Accounting Oversight Board (PCAOB) standards.
Before auditors select transactions, test controls, confirm balances, or evaluate accounting estimates, they must understand the risks that could cause the financial statements to be materially misstated.
This is more than a preliminary planning exercise.
Risk assessment determines what the auditor examines, why those procedures are necessary, how much evidence must be obtained, and whether the audit provides reasonable assurance.
The PCAOB establishes a connected framework of auditing standards addressing audit risk, audit evidence, supervision, documentation, communications, planning, materiality, internal control, and responses to identified risks.
Several particularly important standards are found between AS 1101 and AS 2301.
Understanding how these standards work together is essential for engagement partners, audit managers, senior auditors, and staff auditors performing issuer and other engagements subject to PCAOB standards.
1. PCAOB Risk Assessment Is a Continuous Audit Process
An effective PCAOB audit begins with understanding the company and identifying potential risks of material misstatement.
The auditor then evaluates those risks and designs appropriate responses.
However, the process does not end when planning is completed.
New information may emerge during control testing, substantive procedures, management inquiries, or the evaluation of audit evidence.
The auditor must reconsider risk assessments when contradictory evidence or changing circumstances indicate that the original assessments are no longer appropriate.
The overall process can be summarized as:
Understand the Company → Identify Risks → Assess Risks → Design Audit Responses → Obtain Evidence → Reevaluate Risks → Reach Audit Conclusions
This relationship is especially important when the auditor discovers unexpected transactions, control deficiencies, unusual accounting estimates, or evidence suggesting possible fraud.
2. The PCAOB Standards That Work Together
The following standards form an important part of the PCAOB's audit risk assessment and response framework.
Standard | Subject | Relationship to risk assessment |
AS 1101 | Audit Risk | Establishes the audit risk framework |
AS 1105 | Audit Evidence | Establishes requirements for sufficient appropriate evidence |
AS 1201 | Supervision of the Audit Engagement | Connects supervision to engagement risk |
AS 1215 | Audit Documentation | Requires documentation supporting audit work and conclusions |
AS 1220 | Engagement Quality Review | Provides an independent review of significant engagement judgments |
AS 1301 | Communications with Audit Committees | Addresses required communications, including significant risks |
AS 2101 | Audit Planning | Establishes requirements for planning the engagement |
AS 2105 | Consideration of Materiality | Connects materiality to audit planning and evaluation |
AS 2110 | Identifying and Assessing Risks of Material Misstatement | Establishes the principal risk assessment requirements |
AS 2201 | Integrated Audit of Internal Control Over Financial Reporting | Addresses ICFR audit requirements when applicable |
AS 2301 | Auditor's Responses to Risks of Material Misstatement | Establishes requirements for responding to assessed risks |
These standards are interconnected, but each has its own objective and requirements.
Other PCAOB standards, including AS 1000, AS 1015, AS 2305, AS 2315, AS 2401, AS 2501, and AS 2810, are also relevant to planning, performing, and evaluating audit work.
3. AS 1101 — Understanding Audit Risk
AS 1101, Audit Risk, establishes the fundamental objective of reducing audit risk to an appropriately low level.
Audit risk is the risk that an auditor expresses an inappropriate opinion when the financial statements are materially misstated.
Audit risk is a function of two broad elements:
Risk of Material Misstatement (RMM): The risk that the financial statements contain a material misstatement before the audit.
Detection Risk (DR): The risk that audit procedures will fail to detect an existing material misstatement.
A common conceptual representation is:
Audit Risk = Risk of Material Misstatement × Detection Risk
Risk of material misstatement encompasses inherent risk and control risk.
This model is useful for understanding the relationship among risks, but it should not be treated as requiring a numerical calculation for every engagement.
The most important relationship
When the auditor assesses a higher risk of material misstatement, the acceptable level of detection risk must be lower.
That generally requires more persuasive audit evidence and appropriately designed substantive procedures.
For example, an issuer experiencing severe financial difficulties may present elevated risks involving revenue recognition, asset valuation, debt covenant compliance, and going concern considerations.
The audit response should reflect those risks.
Higher audit risk cannot be addressed merely by completing the same audit program used in the previous year.
4. AS 1105 — Obtaining Sufficient Appropriate Audit Evidence
AS 1105, Audit Evidence, addresses the evidence needed to support the auditor's opinion.
Two concepts are central:
Sufficiency: The quantity of audit evidence.
Appropriateness: The relevance and reliability of that evidence.
Risk assessment influences both.
Higher-risk areas generally require more persuasive evidence.
For example, an auditor examining a significant receivable balance may obtain evidence from external confirmations, subsequent cash receipts, contracts, and other relevant records.
The auditor must also evaluate the reliability of company-produced information used in audit procedures.
An internally generated report should not automatically be accepted as complete and accurate simply because it was produced by the company's accounting system.
Technology-assisted analysis
PCAOB amendments addressing technology-assisted analysis have strengthened the requirements concerning the use of electronic information and the investigation of certain items identified through tests of details.
Auditors should understand the applicable effective dates and current requirements when using data analytics, electronic reports, and other technology-assisted procedures.
The key principle remains unchanged:
Audit evidence must support the assertion being tested, and the auditor must evaluate its relevance and reliability.
5. AS 1201 — Supervision Must Reflect Audit Risk
AS 1201, Supervision of the Audit Engagement, establishes requirements for supervising the engagement team.
Supervision should reflect the nature of the work and the risks involved.
A complex revenue recognition issue involving significant management judgment may require greater partner and manager involvement than a routine low-risk transaction cycle.
Important supervisory responsibilities include:
Assigning work to personnel with appropriate competencies.
Communicating engagement responsibilities.
Reviewing significant audit judgments.
Evaluating the work performed.
Addressing important findings and exceptions.
Ensuring that audit conclusions are adequately supported.
The engagement partner cannot assume that audit quality exists simply because staff completed the assigned workpapers.
Effective supervision includes challenging whether the procedures actually address the identified risks.
6. AS 1215 — Documenting the Risk Assessment
AS 1215, Audit Documentation, requires auditors to prepare documentation supporting the work performed and conclusions reached.
Risk assessment documentation should allow an experienced auditor, having no previous connection with the engagement, to understand the relevant procedures, evidence, and conclusions.
Important documentation may include:
Understanding of the company and its environment.
Significant accounts and disclosures.
Relevant assertions.
Identified fraud risks.
Significant risks.
Materiality judgments.
Understanding of internal controls.
Planned audit responses.
Changes in risk assessments.
Results of procedures performed.
A risk assessment conclusion should not consist merely of a checkbox stating that an account is low, moderate, or high risk.
The workpaper should explain the reasoning supporting the conclusion.
If the auditor cannot explain why a risk was assessed at a particular level, the assessment may not provide a sound basis for audit planning.
7. AS 1220 — Engagement Quality Review
AS 1220, Engagement Quality Review, establishes requirements for the engagement quality review when applicable.
The engagement quality reviewer evaluates significant judgments made by the engagement team and the related conclusions.
This includes considering significant risks identified by the team and the responses to those risks.
The reviewer should evaluate whether significant judgments and conclusions are supported.
For example, the reviewer may challenge:
The identification of significant risks.
Important materiality judgments.
The evaluation of significant accounting estimates.
Significant fraud-related conclusions.
Important audit adjustments.
Significant deficiencies in audit evidence.
The engagement quality review is not a substitute for engagement partner supervision or the audit team's responsibility to perform the audit properly.
It provides an additional quality safeguard.
8. AS 1301 — Communicating Significant Risks to the Audit Committee
AS 1301, Communications with Audit Committees, establishes important communication requirements.
Among other matters, the auditor must communicate significant risks identified during the risk assessment process.
These communications help the Audit Committee understand the areas requiring particular audit attention.
Examples may include:
Revenue recognition.
Management override.
Complex accounting estimates.
Related-party transactions.
Significant unusual transactions.
Liquidity and going concern risks.
Significant financial reporting changes.
The auditor should also communicate other matters required by AS 1301, including relevant aspects of the audit strategy and significant accounting matters.
Effective communication is not simply a presentation at the end of the engagement.
The Audit Committee should receive timely information that allows it to fulfill its oversight responsibilities.
9. AS 2101 — Planning the Audit
AS 2101, Audit Planning, establishes requirements for planning the engagement.
Planning involves developing an overall audit strategy and an audit plan.
The strategy addresses the scope, timing, and direction of the audit.
The audit plan addresses the nature, timing, and extent of procedures to be performed.
Planning considerations may include:
The company's business and industry.
Significant business changes.
Financial reporting complexity.
Preliminary risk assessments.
Materiality.
Engagement staffing.
Specialist involvement.
Multi-location operations.
Coordination with other auditors.
Timing of audit procedures.
An effective plan connects the company's risks to the audit work that will be performed.
For example, a company implementing a new enterprise resource planning system may present increased risks involving data conversion, access controls, transaction processing, and financial reporting.
Those risks should influence the audit strategy.
10. AS 2105 — Materiality and Risk Assessment
AS 2105, Consideration of Materiality in Planning and Performing an Audit, addresses materiality judgments.
Materiality influences the auditor's evaluation of the significance of potential misstatements and the nature, timing, and extent of audit procedures.
Materiality is not determined solely by applying a fixed percentage to revenue, assets, or income.
The auditor must consider the circumstances of the company and relevant qualitative factors.
For example, a relatively small misstatement could be significant if it:
Changes a reported loss into income.
Affects compliance with debt covenants.
Conceals an unlawful transaction.
Changes an important financial trend.
Affects significant management compensation arrangements.
The auditor should consider both quantitative and qualitative factors.
Risk assessment and materiality are related, but they are not interchangeable.
A small account can present a significant fraud risk, while a large account may have relatively straightforward accounting characteristics.
11. AS 2110 — The Foundation of PCAOB Risk Assessment
AS 2110, Identifying and Assessing Risks of Material Misstatement, is the central PCAOB standard governing the risk assessment process.
Its objective is to identify and appropriately assess risks of material misstatement, providing the basis for designing audit responses.
The standard requires risk assessment procedures sufficient to support the auditor's identification and assessment of risks.
These procedures include:
Understanding the company and its environment.
Understanding internal control over financial reporting.
Considering information from engagement acceptance, planning, prior audits, and other engagements.
Performing analytical procedures.
Conducting engagement team discussions.
Making inquiries of the Audit Committee, management, Internal Audit, and other relevant personnel.
The auditor uses the information obtained to identify and assess risks at both the financial statement level and the assertion level.
Financial statement-level risks
These risks may affect the financial statements broadly.
Examples include:
Weak control environment.
Significant management integrity concerns.
Financial distress.
Ineffective financial reporting oversight.
Pervasive information technology weaknesses.
Assertion-level risks
These risks relate to specific accounts, disclosures, and assertions.
For example:
Account or disclosure | Potential risk | Relevant assertion |
Revenue | Fictitious sales | Occurrence |
Accounts receivable | Uncollectible balances | Valuation |
Inventory | Unrecorded inventory shrinkage | Existence or completeness, depending on the risk |
Accounts payable | Unrecorded liabilities | Completeness |
Fixed assets | Improper capitalization | Valuation or classification |
Related-party disclosures | Omitted relationships or transactions | Presentation and disclosure |
The auditor must identify significant accounts and disclosures and their relevant assertions using the applicable inherent-risk considerations.
The auditor must also determine which assessed risks are significant risks requiring special audit consideration.
12. Fraud Risk Assessment Under AS 2110
Fraud must be considered throughout the risk assessment process.
The engagement team should discuss the susceptibility of the financial statements to material misstatement due to fraud.
The auditor should consider:
Incentives and pressures: Circumstances that may motivate individuals to commit fraud.
Opportunities: Weaknesses that may permit fraudulent activity.
Attitudes and rationalizations: Conditions that may enable individuals to justify misconduct.
Management override is particularly important because senior management may have the ability to bypass otherwise effective controls.
Fraud risk assessment also requires considering information obtained through inquiries and other audit procedures.
Auditors should not rely exclusively on management's statements that no fraud has occurred.
Management may be in a position to commit or conceal fraud.
Relevant information should be corroborated when necessary.
AS 2401, Consideration of Fraud in a Financial Statement Audit, provides additional requirements that must be considered alongside AS 2110.
13. Understanding Internal Control Over Financial Reporting
AS 2110 requires the auditor to obtain an understanding of internal control over financial reporting relevant to the audit.
This includes understanding the company's:
Risk assessment process.
Control environment.
Information system and communication.
Control activities.
Monitoring activities.
The COSO Internal Control—Integrated Framework provides a useful conceptual model.
Auditors should understand how transactions are initiated, authorized, processed, recorded, and reported.
For example, in the revenue process, the auditor may examine:
Customer order acceptance.
Credit approval.
Shipment or service delivery.
Invoice generation.
Revenue recognition.
Accounts receivable recording.
Financial statement reporting.
The auditor should identify where material misstatements could occur and which controls are relevant to those risks.
Understanding a control is not the same as establishing that it operated effectively throughout the audit period.
When control reliance is planned, the auditor must obtain appropriate evidence supporting that reliance.
14. AS 2201 — Integrated Audits of Internal Control
AS 2201 applies when the auditor performs an integrated audit of financial statements and internal control over financial reporting.
The auditor evaluates whether the company's internal control over financial reporting is effective.
The standard uses a top-down, risk-based approach.
The auditor begins at the financial statement level, evaluates entity-level controls, and then focuses on significant accounts, disclosures, and relevant assertions.
Important considerations include:
Control environment.
Audit Committee oversight.
Management's risk assessment process.
Period-end financial reporting controls.
Information technology controls.
Controls addressing fraud risks.
Process-level controls.
The auditor evaluates control design and operating effectiveness.
A control may be well designed but fail because it is not performed consistently.
Alternatively, a control may operate exactly as designed but still be inadequate to prevent or detect the relevant misstatement.
Both dimensions matter.
An integrated audit requires evidence supporting the auditor's opinion on internal control over financial reporting, not merely an understanding of the control framework.
15. AS 2301 — Responding to Assessed Risks
AS 2301, The Auditor's Responses to the Risks of Material Misstatement, establishes requirements for designing and implementing audit responses.
The auditor must connect procedures to risks identified and assessed under AS 2110.
The responses include two broad categories.
Overall audit responses
These may involve:
Assigning more experienced personnel.
Increasing supervision.
Incorporating unpredictability.
Applying greater professional skepticism.
Modifying the overall audit strategy.
Assertion-level procedures
These involve designing the nature, timing, and extent of procedures addressing particular risks.
For example, if the auditor identifies a significant risk that revenue has been recognized before delivery, responsive procedures may include:
Examining sales agreements.
Testing shipping documentation.
Evaluating year-end cutoff.
Reviewing subsequent credit memos.
Testing relevant controls.
Investigating unusual transactions.
The procedures should address the specific risk, not simply the account balance.
16. Significant Risks Require Specific Responses
Under AS 2301, significant risks require substantive procedures, including tests of details, specifically responsive to those risks.
For example, a significant risk involving complex revenue arrangements may require detailed examination of contracts and the related accounting treatment.
A significant risk involving a material accounting estimate may require testing management's assumptions, evaluating underlying data, and considering alternative evidence.
A significant risk involving fraud may require procedures designed to address the particular fraud scenario.
The auditor cannot satisfy the requirement simply by performing generic analytical procedures unrelated to the identified risk.
A significant risk should have a clearly identifiable response in the audit program and supporting workpapers.
17. Risk Assessment and the Nature, Timing, and Extent of Audit Procedures
The auditor's response to risk affects three important dimensions.
Dimension | Audit planning question | Example |
Nature | What procedure should be performed? | External confirmation instead of inquiry alone |
Timing | When should the procedure be performed? | Year-end testing instead of interim testing |
Extent | How much testing is necessary? | Larger sample or expanded transaction coverage |
Higher assessed risk generally requires more persuasive evidence.
However, simply increasing sample size may not address a poorly designed audit procedure.
If the risk involves fictitious revenue, testing only the mathematical accuracy of invoices may provide little relevant evidence concerning whether the sales actually occurred.
The auditor must select procedures responsive to the assertion and the underlying risk.
18. Example: Applying AS 1101 Through AS 2301 to Revenue Recognition
Consider a hypothetical public company reporting $150 million in annual revenue.
During planning, the auditor identifies:
Revenue growth substantially exceeding industry trends.
Significant fourth-quarter sales.
Increased customer returns after year-end.
Management compensation tied to revenue targets.
Complex contractual arrangements.
The audit team develops the following approach.
Audit stage | Relevant standard | Audit activity |
Understand audit risk | AS 1101 | Evaluate the possibility of material revenue misstatement |
Plan the engagement | AS 2101 | Allocate experienced personnel and determine audit strategy |
Establish materiality | AS 2105 | Evaluate materiality for the financial statements |
Identify risks | AS 2110 | Assess revenue fraud risks and relevant assertions |
Understand controls | AS 2110 | Examine revenue processing and recognition controls |
Evaluate ICFR, if integrated | AS 2201 | Test relevant control design and operating effectiveness |
Design responses | AS 2301 | Perform responsive cutoff, contract, and transaction testing |
Evaluate evidence | AS 1105 | Determine whether evidence is sufficient and appropriate |
Supervise work | AS 1201 | Review significant judgments and exceptions |
Document conclusions | AS 1215 | Link risks, procedures, evidence, and conclusions |
Communicate | AS 1301 | Discuss significant risks with the Audit Committee |
This example demonstrates that risk assessment is not confined to AS 2110.
It influences the entire engagement.
19. A Practical PCAOB Risk Assessment Matrix
A risk assessment matrix can help demonstrate the connection between risks and audit responses.
Risk | Assertion | Assessment | Planned response |
Premature revenue recognition | Occurrence and cutoff | Significant | Contract examination and cutoff testing |
Inventory overstatement | Existence and valuation | High | Observation and valuation procedures |
Unrecorded liabilities | Completeness | High | Search for unrecorded liabilities |
Management override | Multiple assertions | Fraud risk | Journal entry testing and other required fraud procedures |
Complex accounting estimate | Valuation | Significant | Test methods, data, and significant assumptions |
Related-party transactions | Presentation and disclosure | High | Evaluate relationships, transactions, and disclosures |
The ratings are illustrative.
Actual risk assessments must be based on the company's circumstances and the evidence obtained.
The workpapers should explain why the identified risks affect the relevant assertions and how the planned procedures respond.
20. Common PCAOB Risk Assessment Deficiencies
Audit teams should be alert to recurring weaknesses.
Generic risk assessments: Using identical risk descriptions for companies with substantially different operations.
Insufficient understanding of the company: Failing to evaluate business models, financing arrangements, industry conditions, or significant changes.
Weak fraud assessment: Treating fraud risk as a checklist rather than analyzing plausible fraud scenarios.
Unsupported low-risk conclusions: Assigning low risk without documenting the supporting rationale.
Poor linkage: Identifying significant risks without designing responsive audit procedures.
Inadequate control understanding: Documenting policies without understanding how controls operate.
Insufficient evidence: Relying on inquiry or management explanations without appropriate corroboration.
Inadequate supervision: Failing to challenge important judgments or investigate exceptions.
Failure to revise risk assessments: Ignoring evidence that contradicts the original planning conclusions.
Weak documentation: Providing conclusions without showing how they were reached.
These deficiencies can undermine the effectiveness of the entire audit.
21. Using AI and Data Analytics in PCAOB Risk Assessment
Artificial intelligence and advanced analytics can support risk assessment by helping auditors identify unusual relationships and potential misstatements.
Potential applications include:
Financial trend analysis: Comparing financial performance with historical results, budgets, and industry expectations.
Journal entry analytics: Identifying unusual posting times, users, amounts, and account combinations.
Revenue analytics: Detecting unusual cutoff patterns, credit memos, and sales concentrations.
Related-party analysis: Identifying potential relationships across vendors, customers, employees, and ownership records.
Contract analysis: Assisting with the identification of unusual provisions or accounting terms.
Risk documentation: Organizing information obtained from financial reports, contracts, and management inquiries.
However, AI-generated information must be validated.
Auditors should understand data sources, evaluate completeness and accuracy where relevant, and investigate significant exceptions.
The use of AI does not reduce the auditor's responsibility to obtain sufficient appropriate evidence.
Nor does it eliminate the need for professional skepticism.
22. A PCAOB Risk Assessment Checklist
Before completing the planning and risk assessment phase, the engagement team should consider the following questions:
Have we obtained an adequate understanding of the company and its environment?
Have we identified significant changes in operations, financing, and financial reporting?
Have we established appropriate materiality judgments?
Have we evaluated risks at the financial statement and assertion levels?
Have we identified significant accounts and disclosures?
Have we determined the relevant assertions?
Have we evaluated fraud risks, including management override?
Have we considered significant unusual transactions?
Have we obtained an appropriate understanding of internal control?
Have we considered information technology dependencies?
Have we identified significant risks?
Are our audit responses specifically linked to the assessed risks?
Have we assigned personnel with appropriate expertise?
Have we planned adequate supervision?
Have we communicated significant risks to the Audit Committee?
Have we documented the basis for important judgments?
Have we established a process for revising risk assessments as new evidence emerges?
The Bottom Line: PCAOB Risk Assessment Must Drive the Audit
PCAOB risk assessment is not a preliminary administrative exercise.
It is the process that determines the direction and effectiveness of the audit.
AS 1101 establishes the audit risk framework.
AS 2101 and AS 2105 address planning and materiality.
AS 2110 establishes the central requirements for identifying and assessing risks of material misstatement.
AS 2201 addresses internal control testing in integrated audits.
AS 2301 requires the auditor to design and implement responses to the assessed risks.
Other standards establish important requirements concerning evidence, supervision, documentation, quality review, and Audit Committee communications.
Together, these requirements establish a disciplined approach to obtaining reasonable assurance.
The quality of a PCAOB audit depends not on how many workpapers the auditor completes, but on whether the auditor identifies the important risks, designs procedures that address those risks, obtains persuasive evidence, and reaches conclusions supported by that evidence.
An audit program that is not connected to a documented risk assessment is unlikely to provide a sound foundation for an effective risk-based audit.
For PCAOB auditors, mastering the relationship among these standards is essential professional audit tradecraft.
Strengthen Your PCAOB Audit Tradecraft with Corporate Compliance Seminars
Corporate Compliance Seminars provides continuing professional education covering PCAOB auditing standards, audit planning, risk assessment, audit evidence, internal control testing, fraud risks, and audit documentation.
Our programs help engagement partners, audit managers, senior auditors, and staff auditors strengthen the professional skills needed to plan and perform effective risk-based audits.
Explore PCAOB and auditing CPE programs at Corporate Compliance Seminars.
Comments