An auditor takes on a software company with a new CEO, founder-controlled equity, $80 million in venture debt, and a new AI revenue forecasting tool. Each fact is an internal factor that shifts the risk of material misstatement before the auditor opens a single ledger.
External factors are pressures from outside. Internal factors are how the entity is built to respond, and where it is vulnerable. AU-C 315 frames the understanding as a sequence: what the entity does, who controls it, how it finances itself, what it measures, and how it accounts for transactions.
KEY: Internal factors are not a checklist. They are inputs to assertion-level risk. A factor that does not connect to an assertion is information without consequence.
Operations covers revenue sources, products, geographic markets, customers, suppliers, and the delivery model. Subscription software recognizes revenue ratably (cutoff and deferred revenue elevated). Long-term construction uses percentage-of-completion (estimation risk dominates). High-turnover distribution faces existence and valuation risk on inventory. One customer above 10 percent of revenue triggers collectibility and going concern risk.
Common mistakes
- Treating internal factors as a checklist. Listing operations, ownership, financing, and policies without mapping each to an assertion-level risk is procedure without consequence. The trap answer says "all of the above."
- Confusing SOX §404(a) and §404(b). §404(a) is management's ICFR report (every issuer). §404(b) is the auditor's ICFR opinion (accelerated and large accelerated filers only). The trap says "every issuer requires an auditor ICFR opinion."
- Assuming AI estimates require less audit work. The auditor evaluates AI-driven estimates under AU-C 540 the same as any other estimate. The trap says "AI provides objective evidence and reduces required substantive procedures."
Bottom line
- AU-C 315 requires you to understand the entity's operations, ownership and governance, financing, business model, accounting policies, KPIs, objectives and strategies, and internal control.
- Sarbanes-Oxley sets governance requirements for issuers: §301 independent audit committee, §302 CEO/CFO certifications, §404(a) management ICFR report, §404(b) auditor ICFR opinion for accelerated and large accelerated filers only.
- A factor becomes a risk of material misstatement only when it creates incentive, opportunity, or complexity that touches a specific assertion.
- Technology and AI adoption are explicit internal factors under the 2024 AICPA blueprint; AI does not reduce auditor responsibility under AU-C 540.
Exam shortcut
When a question describes an internal factor, ask "what assertion does this touch?" If the answer is none, the factor is information without consequence. SOX: §301 = audit committee independence, §302 = certifications, §404(a) = management ICFR report, §404(b) = auditor ICFR opinion (accelerated filers only). For technology and AI questions, the right answer always preserves auditor responsibility: any choice that says "the model reduces required procedures" is the trap.
The full lesson (about 2,027 words, 14 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- II.B2
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.