Before you can audit anything, you need to figure out where things can go wrong — and how badly. That's exactly what SA 315 is about. Think of it as the auditor's detective work before the real testing begins. Without this, you're just randomly checking vouchers and hoping for the best.
SA 315 requires you to identify and assess the Risks of Material Misstatement (RMM) — at two levels: the financial statement level (something broad, like weak management integrity that could affect everything) and the assertion level (specific claims like 'all debtors actually exist'). RMM = Inherent Risk × Control Risk in concept — the higher both are, the more audit work you must do.
To assess these risks, you perform Risk Assessment Procedures (RAPs) — these are NOT substantive tests, they're just information-gathering: (1) Inquiries of management and staff (ask the warehouse manager if inventory counts were done properly), (2) Analytical Procedures (compare Rajesh & Co.'s gross margin this year vs. last — a sudden jump raises a flag), and (3) Observation & Inspection (walk through the factory floor, glance at board minutes, read the loan agreements). You also need to understand the entity's internal control — broken into five components: Control Environment, Entity's Risk Assessment process, Information & Communication system, Control Activities, and Monitoring (remember the mnemonic CEIAM or CRIME variants).
The golden rule: if you identify a Significant Risk — a risk that requires special audit consideration (e.g., fraud risk, non-routine transactions, high estimation uncertainty) — you cannot rely on controls alone. You must do substantive procedures, period. Management override of controls is always treated as a significant risk in every audit, no exceptions. This is a favourite exam trap.
Also note: SA 315 was revised (SA 315 Revised) and the ICAI curriculum for May 2026 reflects this revision — key additions include Spectrum of Inherent Risk, the distinction between Inherent Risk Factors (complexity, subjectivity, change, uncertainty, susceptibility to fraud/bias), and the concept of Preliminary IT understanding. Don't ignore the IT-related internal control paragraphs — they appear in MCQs.