What is SAS 145, and how can AI support it?
SAS No. 145 is the AICPA's risk-assessment standard for US audits of nonissuers. It rewrote AU-C section 315 to strengthen how auditors understand the entity and its internal control, identify and assess risks of material misstatement, and use that assessment to design the audit response.
The underlying risk model did not fundamentally change, but the standard made several important requirements more explicit. These include separately assessing inherent risk and control risk, evaluating the design and implementation of certain controls—including relevant general IT controls—applying a revised definition of significant risk, using a new stand-back requirement, and documenting the risk assessment more clearly. It also includes scalability guidance for less complex entities. SAS 145 has applied to audits of financial statements for periods ending on or after 15 December 2023.
AI can support the legwork behind SAS 145 by structuring information about the entity and its systems, preparing process documentation, identifying potential risks and relevant controls, and linking conclusions back to client evidence. It can also help firms apply a consistent starting workflow across engagements without treating a less complex entity like a complex one.
Platformed capability: Platformed can collect walkthrough and system evidence, assess IT complexity, prepare risks and controls, support design-and-implementation work and generate evidence-linked documentation for auditor review. It supports the work required by SAS 145; the auditor remains responsible for the risk assessment and audit response.
References: AICPA risk-assessment guide and SAS 145 summary · AICPA SAS 145 resources · Platformed risk assessment engine