Most CPA candidates study significant risks by memorizing a list of factors like "complex transactions" or "management estimates." This is a failing strategy. The AUD exam doesn't reward you for listing the factors; it tests whether you can pinpoint precisely why a specific fact pattern elevates a routine risk into one that requires special audit consideration under AU-C 315.
Quick answer
A significant risk is an identified and assessed risk of material misstatement that, in the auditor's professional judgment, requires special audit consideration. These risks demand a tailored audit response, including substantive procedures, and are often driven by complexity, subjectivity, or the potential for fraud.
Key facts
- Definition: An identified and assessed risk of material misstatement requiring special audit consideration (AU-C 315).
- Official guidance: AU-C 315, AU-C 240, AU-C 330, and AU-C 260.
- Revenue recognition: A presumptive fraud risk under AU-C 240, making it a default significant risk unless rebutted.
- Auditor response: Must include substantive procedures tailored to the specific risk (AU-C 330).
- Communication: Significant risks must be communicated to those charged with governance (AU-C 260).
- Exam weighting: Integrated into Risk Assessment and Planning (Area I), which is 25-35% of the AUD exam.
What Are Significant Risks and Why Do They Matter on the AUD Exam?
A significant risk is an identified and assessed risk of material misstatement that, in the auditor's judgment, is so critical it demands special audit consideration. This isn't just a slightly higher risk; it's a designation that fundamentally changes the audit plan. As defined in AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, these are the areas where things are most likely to go wrong in a big way.On the AUD exam, this concept is central. Examiners use it to separate candidates who can merely recall definitions from those who can think like an auditor. You won't just be asked to define a significant risk. You'll be given a complex client scenario and be expected to identify the significant risk, explain why it's significant by citing the underlying factors, and then design a specific audit response.
The table below clarifies the distinction. Many candidates lose points by treating a significant risk like any other high risk of material misstatement (RMM).
Free 5-Min Diagnostic
Studying for CPA AUD? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
| Feature | Standard Risk of Material Misstatement (RMM) | Significant Risk |
|---|---|---|
| Definition | A risk that the financial statements are materially misstated prior to the audit. | An RMM that requires special audit consideration due to its nature. |
| Response | Auditor designs overall responses and further audit procedures (tests of controls, substantive tests). | Must include substantive procedures. May also include tests of controls from the prior year. |
| Controls Reliance | If controls are effective, auditor may rely on them to reduce substantive testing. | Auditor cannot rely on controls testing alone to address the risk. |
| Documentation | Document the assessed RMM at the assertion level. | Document the risk and the specific, tailored audit procedures performed in response. |
| Communication | Discussed with management as needed. | Must be communicated to those charged with governance (e.g., the audit committee). |
What Are the Core Rules for Significant Risks Under AU-C Standards?
To master this topic, you need to understand how several auditing standards work together. It's not just one rule; it's a framework for applying professional skepticism.Identifying a Significant Risk (AU-C 315)
AU-C 315, paragraph .28, provides the specific factors an auditor must consider. A risk is more likely to be significant if it involves:- Risk of fraud. While not all fraud risks are automatically significant, they are a primary indicator.
- Significant recent economic, accounting, or other developments. Think about a company adopting a major new standard like ASC 842 for leases.
- The complexity of transactions.
- Significant transactions with related parties.
- A high degree of subjectivity in measurement. This is a huge one. Think fair value estimates, goodwill impairment, or valuation allowances for deferred tax assets.
- Significant transactions outside the normal course of business.
Your job on the exam is to spot these characteristics in a given fact pattern.
The Presumptive Fraud Risk in Revenue Recognition (AU-C 240)
This is one of the most important rules in auditing. AU-C Section 240, Consideration of Fraud in a Financial Statement Audit, establishes a presumption that risks of material misstatement due to fraud exist in revenue recognition.This means you, as the auditor, must start every audit assuming revenue recognition is a significant risk. You are required to perform procedures to address it.
Can the Revenue Recognition Presumption Be Rebutted?
Yes, but it's rare and requires strong justification. An auditor can rebut the presumption only if they conclude that the risk is not applicable to the specific engagement. For example, a simple entity with a single revenue stream from fixed-price cash sales (like a small coffee shop) might not have a significant fraud risk in revenue. If you rebut the presumption, you must document your reasons thoroughly. On the exam, assume the presumption applies unless you are given overwhelming evidence to the contrary.Designing the Audit Response (AU-C 330)
Once you identify a significant risk, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks, dictates your next move. The key requirement is that your response must include substantive procedures. You cannot simply test the client's internal controls and call it a day. You need to perform direct tests of the account balance or transaction class.Communicating with Those Charged with Governance (AU-C 260)
This is a critical, often-tested step. Under AU-C Section 260, The Auditor's Communication With Those Charged With Governance, the auditor is required to communicate all identified significant risks to the audit committee or equivalent body. This ensures that those overseeing the company are aware of the most critical financial reporting risks the auditor has identified. If a question asks about required communications, significant risks should be at the top of your list.How Do You Apply These Rules? A Worked Example
Let's walk through an exam-style scenario to connect the theory to practice. Scenario: AeroLease Corp., a non-issuer, leases aircraft to airlines. On January 1, 2026, they entered into a 10-year lease for a new jet with a struggling airline, SkyHigh Airways. Due to SkyHigh's poor credit rating, the lease includes variable lease payments tied to SkyHigh's passenger revenue. AeroLease management has determined the lease is a sales-type lease and recognized a large day-one profit. The calculation of the net investment in the lease involves significant estimates of future variable payments, using a complex probability-weighted model developed internally. Step-by-step walkthrough:- Identify Potential Risk Areas:
- Lease Classification (ASC 842): Is it truly a sales-type lease? The classification can be complex.
- Estimation Uncertainty: The measurement of the net investment relies heavily on a subjective, internally developed model for future variable payments. This is a massive red flag.
- Credit Risk: The lessee, SkyHigh, is financially unstable, increasing the risk of non-payment and impacting the valuation of the lease receivable.
- Determine if a Significant Risk Exists (Applying AU-C 315):
- High Degree of Subjectivity: The probability-weighted model for variable payments is the key issue. This fits squarely within AU-C 315's criteria for a significant risk. The range of possible outcomes could be wide, and management's judgment is central.
- Complexity of Transaction: Applying ASC 842 to a lease with significant variable payments is inherently complex.
- Conclusion: Yes, a significant risk of material misstatement exists related to the valuation and classification of the new lease.
- Link to Financial Statement Assertions:
- Net Investment in Lease (Balance Sheet): Valuation is the primary assertion at risk due to the subjective estimates.
- Lease Revenue & Profit (Income Statement): Accuracy and Cutoff are at risk if the initial profit recognition is based on flawed estimates.
- Plan Specific Audit Responses (Applying AU-C 330):
- Evaluate Management's Model: Scrutinize the assumptions used in the probability-weighted model for variable payments. Are they reasonable? Are they supported by external data (e.g., industry forecasts for airline travel)?
- Involve a Specialist: Given the complexity of the model, the audit team should consider engaging an internal or external valuation specialist to assess the reasonableness of the assumptions and methodology.
- Test Underlying Data: Inspect historical data from SkyHigh or comparable airlines to see if the projections are grounded in reality.
- Review the Lease Agreement: Read the contract to ensure management's interpretation of the terms (especially variable payments) aligns with the agreement.
- Assess Credit Risk: Evaluate the collectability of the lease payments by reviewing SkyHigh's financial condition and considering the need for a credit loss allowance.
Can You Spot the Significant Risk? Test Yourself
VoraPrep offers over 9,500 practice questions, including many scenarios designed to test your judgment on significant risks. Here are a few to get you started.---
✨ Free Interactive Tool
Check State Requirements →Check Your State’s Exact CPA Exam Requirements
Every state has different credit hour, ethics, and residency rules. Use our 55-jurisdiction checker to verify your eligibility before applying.
A. Inquire of management about the assumptions used in the valuation allowance assessment and obtain supporting documentation.
B. Confirm the deferred tax asset balance directly with the relevant tax authority.
C. Perform analytical procedures comparing the current year's deferred tax asset balance to prior periods.
D. Review the company's tax returns for the past five years to identify recurring tax credits.
- B is incorrect because tax authorities do not confirm deferred tax assets; these are internal company estimates.
- C is incorrect because analytical procedures are too high-level to address a specific, significant estimation risk. They might flag a change but won't validate the underlying assumptions.
- D is incorrect because historical tax returns don't address the core risk, which is the future profitability needed to realize the asset.
---
Sample Q2: Maria, an audit senior, is assessing risks for her client, Innovatech Inc. Which of the following conditions would most likely indicate a significant risk of material misstatement due to fraud?A. Innovatech's internal controls over cash disbursements are robust and regularly monitored.
B. The company has a diverse customer base and stable, recurring revenue streams.
C. Management's compensation is heavily tied to achieving aggressive, short-term earnings targets.
D. Innovatech recently implemented a new, complex revenue recognition standard (ASC 606) requiring significant management judgment for contract allocation.
- A is incorrect because strong controls reduce risk.
- B is incorrect because stable, diverse revenue streams generally reduce risk.
- C is a valid fraud risk factor (incentive/pressure), but D presents a specific opportunity within the financial reporting process itself, making it a more direct indicator of a significant risk of material misstatement due to fraud.
---
Sample Q3: An audit team is planning the audit of CloudStream Analytics, a nonissuer SaaS company. Which of the following factors would most likely lead the auditor to classify a risk as significant due to estimation uncertainty?A. CloudStream has a history of consistently meeting or exceeding analyst earnings forecasts.
B. A substantial portion of CloudStream's revenue is derived from long-term contracts requiring subjective estimates for contract modifications and variable consideration.
C. The company's accounts payable balance has significantly decreased from the prior year.
D. CloudStream's internal audit function reports directly to the audit committee.
- A is incorrect because meeting forecasts is an indicator of potential management bias, but not directly of estimation uncertainty in a specific account.
- C is incorrect as a change in payables is an operational matter, not an estimation risk.
- D is incorrect because a strong internal audit function is a positive governance factor that reduces risk.
Ready to test your judgment further? Practice hundreds of AUD questions in VoraPrep and let our adaptive learning engine find and fix your weak areas.
How Can I Master Significant Risks in 7 Days?
Use this intensive sprint to move from memorization to true understanding.- Day 1: The Foundation. Read AU-C 315 (paragraphs .27-.29) and AU-C 240 (paragraphs .26-.27). Create a one-page summary in your own words defining "significant risk" and the "presumptive fraud risk in revenue."
- Day 2: Risk Factors. Do 20 practice MCQs focused solely on identifying significant risks from a list of factors. For each wrong answer, write down which AU-C 315 factor you missed (e.g., subjectivity, complexity, related party).
- Day 3: Revenue Deep Dive. Focus entirely on the revenue recognition fraud presumption. Work through three different scenarios involving ASC 606. For each, list the specific audit procedures you would perform to address the risk.
- Day 4: Link to Assertions. Take 10 different significant risks (e.g., goodwill impairment, contingent liability valuation) and map each one to the primary financial statement assertion it affects (e.g., Goodwill Impairment -> Valuation).
- Day 5: Design Audit Responses. Review AU-C 330 (paragraphs .21-.22). For the 10 risks from Day 4, design one specific, powerful substantive audit procedure for each. Think beyond simple confirmations.
- Day 6: Communication is Key. Read AU-C 260 (paragraphs .15 and Appendix 2). Write a short paragraph, as if for an audit file, documenting a significant risk and another paragraph for an audit committee communication. This is vital for simulations. Our guide to required auditor communications can help.
- Day 7: Full-Spectrum Practice. Do a 30-question mixed quiz from VoraPrep that covers identification, response, and documentation. Spend as much time reviewing the explanations as you did answering the questions.
On exam day, when you see a scenario, slow down. Ask yourself: "What here is complex, subjective, non-routine, or smells like fraud?" Isolate that factor, name the significant risk, and then choose the audit procedure that directly attacks that specific risk.
Frequently asked questions
How many questions on significant risks appear on the CPA exam?
Significant risks are integrated into the "Risk Assessment and Planning" blueprint area (25-35% of AUD). Expect to see the concept tested in multiple MCQs and at least one Task-Based Simulation per exam.What is the best way to study significant risks?
Focus on application, not memorization. Use practice questions to see how the rules from AU-C 315 and AU-C 240 apply to different client scenarios. For every risk, force yourself to articulate why it's significant and what specific assertion is threatened.Are significant risks tested in simulations?
Yes, heavily. A common TBS will provide client documents (e.g., memos, financial data) and require you to identify significant risks, select appropriate audit procedures from a list, or draft documentation.How is a significant risk different from a material weakness?
A significant risk is a risk of material misstatement in the financial statements themselves. A material weakness is a deficiency in internal control over financial reporting such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.--- Ready to Pass Your CPA Exam? VoraPrep’s adaptive learning platform, with 9,500+ questions and our 24/7 Vory tutor, is built to develop the professional judgment you need for tough topics like significant risks. Stop memorizing and start thinking like an examiner. Visit voraprep.com to get started.
Start Your Free 14-Day Trial at voraprep.com →