Once you've assessed the risks of material misstatement (that's SA 315's job), you can't just stop there — you have to do something about them. SA 330 is that 'doing something' standard. Think of it this way: SA 315 is the doctor's diagnosis, SA 330 is writing the prescription.
SA 330 requires the auditor to design and perform audit procedures whose nature, timing, and extent are directly linked to the assessed risk level. This works at two levels. First, overall responses — these are broad changes to how the audit is conducted regardless of any specific area. For example, if you assess the entity's control environment as weak (say, Mr. Kapoor's family-run firm where the owner signs everything himself), you might assign more experienced staff, increase unpredictability in your procedures, or apply more professional skepticism across the board. Second, specific responses — these are targeted at individual risk assessments for particular assertions.
For specific responses, the auditor chooses between two types of procedures. Tests of controls check whether the client's internal controls are actually working. You use these when you plan to rely on those controls to reduce your substantive work. But — and this is exam gold — SA 330 says you must always perform substantive procedures for each material class of transactions, account balance, and disclosure. You cannot skip substantive procedures even if controls look perfect. Substantive procedures themselves split into two: substantive analytical procedures (comparing numbers, ratios, trends) and tests of details (vouching individual transactions, confirming balances). For higher-risk areas, you lean harder on tests of details.
The standard also stresses timing — doing procedures closer to year-end gives more relevant evidence for higher-risk areas. If you test inventory in October for a December year-end entity, you'll need to cover the gap period too. Finally, after all procedures are done, SA 330 requires the auditor to evaluate whether sufficient appropriate evidence has been obtained. If a gap remains, you must perform additional procedures or modify your opinion. This evaluation links directly to SA 700 (forming the audit opinion).