SAS 145 risk assessment: How technology strengthens audit quality

SAS 145 reinforces risk-based auditing while technology helps auditors identify, evaluate, and respond to risks more effectively

Statement on Auditing Standards (SAS) No. 145, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, sharpened the audit profession’s focus on how auditors identify, assess, and respond to risks of material misstatement. Although SAS 145 did not change the fundamentals of audit risk, it clarified and strengthened key elements of the risk assessment process, including the separate assessment of inherent and control risk, the spectrum of inherent risk, the entity’s use of information technology, and the stand-back requirement.

The challenge is not simply documenting compliance with SAS 145. It is developing a risk assessment under SAS 145 that reflects how the entity operates, directs attention to the areas most susceptible to material misstatement, and supports audit procedures that respond to those risks.

Data analytics, artificial intelligence, and other emerging technologies can help auditors examine more information, identify unusual patterns, and focus attention on areas that warrant investigation. But technology does not make the risk assessment. Its value still depends on reliable data, appropriate analysis, professional skepticism, and auditor judgment.

Moving beyond the traditional: Embracing a risk-based mindset

SAS 145, codified in AU-C section 315, did not introduce risk-based auditing, but it made the relationship between identified risks and the audit response more explicit. Auditors must consider how the nature and circumstances of the entity could create risks of material misstatement at the financial statement and assertion levels, then design procedures that respond to those risks.

Internal controls remain an important part of that analysis. However, the existence of a documented control does not, by itself, establish that the control is appropriately designed, has been implemented, or is operating effectively.

Consider a manufacturing company with a history of significant inventory write-downs. Documented procedures for cycle counts are only part of the picture. The auditor also needs to consider factors such as inventory complexity, obsolescence, valuation methods, and dependence on third-party logistics providers. Those factors may influence the inherent risk assessment and the nature, timing, and extent of the resulting audit procedures.

The objective is a clearer connection between what the auditor learns about the entity, the risks identified, and the procedures performed.

A sharper focus on inherent risk

SAS 145 defines inherent risk as the susceptibility of an assertion about a class of transactions, account balance, or disclosure to a misstatement that could be material, before considering related controls.

The standard also requires auditors to assess inherent risk and control risk separately. In assessing inherent risk, auditors should consider the likelihood and magnitude of a possible misstatement, along with inherent risk factors such as complexity, subjectivity, change, uncertainty, and susceptibility to management bias or fraud.

For example, revenue recognition may carry greater inherent risk when contracts contain multiple performance obligations, variable consideration, unusual terms, or significant management judgment. That assessment should influence the nature, timing, and extent of the auditor’s revenue procedures.

The documentation should explain why the assessed risk is appropriate and how it affected the audit response. A risk rating should reflect the circumstances of the current engagement, not simply carry forward a conclusion from the prior year.

Leveraging technology and data analytics

Data analytics, AI, and other technologies can support a more informed risk assessment by helping auditors examine larger datasets, identify patterns and anomalies, and direct attention to transactions or balances that warrant further investigation.

For example, analyzing trends in sales returns, credit memos, customer complaints, or pricing overrides may reveal areas with a higher risk of misstatement. Data visualization tools can also make unusual relationships easier to recognize. A significant change in accounts receivable aging, for instance, may point to collectability concerns, changes in customer behavior, or broader pressure within the client’s industry.

Technology can make the pattern easier to see, but the auditor must still determine what it means. That includes evaluating the reliability of the underlying data, understanding why the pattern exists, and determining how the finding affects the risk assessment.

Maintaining professional skepticism

Professional skepticism has always been a cornerstone of auditing, and SAS 145 reinforces its importance. Auditors must critically evaluate management’s explanations, investigate unusual trends, and remain alert to evidence that contradicts other information obtained during the audit.

Technology may identify an anomaly, but it cannot determine whether management’s explanation is reasonable or whether contradictory evidence has been adequately addressed. An output that appears precise may still reflect incomplete data, inappropriate assumptions, or an analysis that does not fit the engagement.

An exception, risk score, or predicted outcome is a starting point for inquiry, not a substitute for audit evidence. Auditors must understand enough about the analysis to evaluate whether its results are relevant, reliable, and consistent with the other evidence obtained.

AI-powered research: Learn how technology supports auditor judgment

The “stand-back” requirement: A holistic view of risk

The stand-back requirement asks auditors to evaluate whether their identification of significant classes of transactions, account balances, and disclosures is complete.

It creates a deliberate pause in the risk assessment. Do the risks identified make sense when the financial statements are viewed as a whole? Are material classes, balances, or disclosures missing from the analysis? Does the planned work respond to what the engagement team has learned?

Data visualization and analytical tools may support this evaluation by helping auditors compare trends, relationships, and exceptions across the financial statements. However, the stand-back requirement is not simply another documentation step. It is an opportunity to reconsider whether the risk assessment is complete before relying on the audit approach built around it.

Collaboration and communication: Key to effective application

A risk assessment becomes more useful when engagement team members connect what they are seeing across the audit. Insights from walkthroughs, data analysis, prior-year findings, industry developments, and conversations with management may take on greater significance when considered together.

Clear communication with management and those charged with governance can also help the audit team understand changes in the business and explain why the nature, timing, or extent of audit procedures may change.

Technology can make information easier to gather and share, but the engagement team still needs to determine what that information means and how it affects the audit.

Connected audit technology:  See how integrated platforms improve engagement coordination

SAS 145 and advancing technology

Data analytics, artificial intelligence, and other emerging technologies can support auditors throughout the risk assessment and audit process. From identifying potential areas of higher risk to improving the efficiency of testing and analysis, these tools can help engagement teams focus their attention where it matters most. Their outputs, however, remain inputs to auditor judgment rather than substitutes for it.

Enhanced risk assessment

Data mining: Data analytics tools can help auditors examine historical information and identify patterns, relationships, or anomalies that may indicate areas of higher inherent risk.

Predictive analytics: More advanced models may help identify conditions associated with elevated risk based on current information and established patterns. The results are inputs to professional judgment, not risk conclusions on their own.

Streamlined audit procedures

More timely analysis: When reliable data is available, automated routines can help teams monitor changes in key financial metrics or transaction patterns. This may allow potential issues to be identified earlier than they would be through periodic, point-in-time analysis alone.

Automated testing: Automated tools can assist with repeatable activities such as matching records, recalculating amounts, identifying exceptions, and applying analytical procedures to large datasets. Auditors remain responsible for determining whether the procedure is appropriate and whether the resulting audit evidence is sufficient and reliable.

Deeper insights and improved efficiency

Data visualization: Visualization tools can present complex datasets in a format that makes trends, outliers, and relationships easier to recognize. They may also help engagement teams consider whether the risk assessment is consistent with the broader financial picture.

Natural language processing: Natural language processing tools may help auditors organize and review unstructured information such as contracts, meeting minutes, correspondence, and policy documents. Any items identified still require context, corroboration, and auditor evaluation.

Emerging AI capabilities: As AI evolves, some systems may coordinate multistep activities such as assembling data, identifying exceptions, connecting related information, and proposing follow-up questions. The important distinction is between delegating a task and delegating judgment. Regardless of how independently a system operates, the auditor remains responsible for the risk assessment, the evidence obtained, and the conclusions reached.

Explainability and transparency: If an AI model or analytical tool identifies an item as unusual, the engagement team needs enough information to understand and evaluate the basis for the result. Overreliance on opaque models Xshould be balanced with human judgment and professional skepticism.

Data quality and security: The effectiveness of these technologies depends on the quality, completeness, and security of the underlying data. An analysis performed correctly on unreliable data can still produce an unreliable result.

Auditor capabilities: Auditors need enough fluency in data, systems, and emerging technology to ask informed questions, understand a tool’s limitations, and recognize when specialist support may be appropriate.

Human oversight: As tools take on more complex work, firms need clear accountability and review points. The auditor remains responsible for understanding the work performed and reaching the audit conclusion.

SAS 145: A catalyst for enhanced audit quality

SAS 145 is not a wholesale overhaul of the auditing process. It clarifies and strengthens how auditors identify and assess risks of material misstatement, connect those risks to the audit response, and evaluate whether the resulting risk assessment is complete.

Technology can support that process by making patterns easier to see, exceptions easier to isolate, and large volumes of information easier to examine. It cannot determine which evidence is persuasive, whether management’s explanation is credible, or when the audit team needs to look again.

The opportunity is not simply to demonstrate compliance with SAS 145. It is to develop a more thoughtful risk assessment, focus audit work on the areas most susceptible to material misstatement, and support clear, evidence-based, and defensible audit judgments..

Understanding SAS 150:  What the new audit confirmation standard means for CPA firms