IAASB ISA 330, 500 and 520 Revisions: What Australian Businesses Must Know About the 2026 Audit Standards Consultation

Australian businesses that rely on external auditors are facing a significant shift in how audit work is planned, executed, and documented. The International Auditing and Assurance Standards Board (IAASB) released a landmark package of exposure drafts in August 2026, proposing revisions to three foundational audit standards — ISA 330, ISA 500, and ISA 520. The Australian Auditing and Assurance Standards Board (AUASB) is actively consulting on these proposals, and the changes will ultimately reshape what a quality audit looks like in Australia.

Understanding the IAASB Audit Evidence and Risk Response Project

The IAASB's "Audit Evidence and Risk Response" project is a decade-long effort to modernise the risk-based audit framework and ensure that international auditing standards remain effective in a technologically evolving environment. The August 2026 exposure drafts represent the most significant proposed changes to the core audit evidence and risk response standards in many years.

The three standards under revision are closely interconnected. ISA 315 (Revised 2019) governs how auditors identify and assess risks of material misstatement. The proposed revisions to ISA 330, ISA 500, and ISA 520 are designed to strengthen the link between that risk assessment and the actual audit procedures performed — a gap that regulators and audit quality reviewers have identified as a persistent weakness in practice.

ISA 330 (Revised) — The Auditor's Responses to Assessed Risks

The proposed revision to ISA 330 focuses on clarifying the relationship between risk assessment and audit response. Key changes include refined definitions for "substantive procedures" and "tests of controls" that are designed to be "future-proof" — accommodating innovative technological tools that may combine multiple audit techniques in ways that do not fit neatly into existing categories.

The revision also introduces clearer requirements for documenting the rationale for the auditor's chosen responses to assessed risks, making it easier for quality reviewers and regulators to evaluate whether the audit approach was appropriate given the identified risks.

ISA 500 (Revised) — Audit Evidence

The proposed revision to ISA 500 requires auditors to explicitly evaluate the reliability and relevance of information used as audit evidence. New guidance addresses attributes such as accuracy, authenticity, and lack of bias — qualities that are particularly important when evidence is obtained through automated data extraction, AI-assisted analysis, or third-party data providers.

A new appendix provides specific guidance on using technological tools to obtain audit evidence, acknowledging that modern audit practice increasingly relies on data analytics, robotic process automation, and AI-assisted procedures. The appendix does not prescribe specific technologies but establishes principles for evaluating the reliability of evidence obtained through any technological means.

ISA 520 (Revised) — Analytical Procedures

The proposed revision to ISA 520 aims to clearly distinguish between substantive analytical procedures — which are used as audit evidence — and non-substantive analytical procedures used during risk assessment or conclusion phases. This distinction has practical implications for how auditors document their work and how quality reviewers assess whether sufficient appropriate evidence was obtained.

The AUASB Consultation Process

The AUASB released a consultation paper on 18 August 2026, seeking feedback from Australian stakeholders on the IAASB's exposure drafts. The AUASB's consultation deadline was 16 November 2026, while the IAASB's own comment period closes on 15 December 2026.

The AUASB scheduled virtual roundtables in October 2026 to facilitate stakeholder engagement. Feedback from Australian practitioners, preparers, and users of financial statements will directly influence the AUASB's decision-making process regarding the adoption and any local modifications of the final international standards.

Australian businesses should be aware that the AUASB typically adopts IAASB standards with minimal modification, meaning that the final revised standards — once issued by the IAASB and adopted by the AUASB — will apply to audits of Australian entities. The timeline for finalisation and adoption is not yet confirmed, but businesses should expect the revised standards to take effect within the next two to three years.

Key Considerations for Australian Businesses

The proposed changes have practical implications for Australian businesses that are subject to audit, including listed companies, large proprietary companies, not-for-profits, and SMSF trustees. Key considerations include:

• More rigorous risk-response documentation — Auditors will be required to more explicitly document the link between identified risks and the procedures performed. Businesses should expect more detailed audit planning discussions and may be asked to provide more granular information about their risk management processes
• Greater scrutiny of data quality — The revised ISA 500 places greater emphasis on the reliability and authenticity of audit evidence. Businesses that provide data to auditors through automated extracts or third-party systems should ensure that data integrity controls are robust and well-documented
• Technology-enabled audit procedures — The revised standards are designed to accommodate AI-assisted and data analytics-driven audit procedures. Businesses should expect their auditors to increasingly use these tools, and should be prepared to facilitate access to structured data in formats that support automated analysis
• Clearer distinction between risk assessment and substantive work — The revised ISA 520 will require auditors to be more explicit about which analytical procedures constitute substantive evidence and which are used for risk assessment only. This may affect the scope and cost of audit engagements
• Alignment with ASQM 1 quality management requirements — The IAASB has updated application material in ISQM 1 (the international equivalent of ASQM 1) regarding technological resources and the approval of audit tools. Australian audit firms are already subject to ASQM 1, and the revised standards will need to be read in conjunction with these quality management requirements

Common Mistakes and Red Flags When Choosing an Auditor

Against the backdrop of these evolving standards, Australian businesses should be alert to the following warning signs when selecting or evaluating an auditor:

• Lack of awareness of the IAASB exposure drafts — A quality auditor should be actively monitoring proposed changes to auditing standards and be able to explain how their practice is preparing for the transition
• Over-reliance on traditional procedures — Auditors who have not invested in data analytics and technology-enabled audit tools may struggle to meet the expectations of the revised standards, particularly the new guidance on technological evidence in ISA 500
• Inadequate documentation practices — The revised ISA 330 places greater emphasis on documenting the rationale for audit responses. Auditors with weak documentation practices are more likely to attract adverse findings from ASIC's audit quality surveillance program
• Failure to engage with AUASB consultation — Auditors who are not participating in the AUASB's consultation process may be less well-positioned to implement the revised standards effectively when they take effect
• Independence concerns — ASIC's ongoing audit quality surveillance program continues to identify independence as a key area of concern. Businesses should verify that their auditor has robust independence policies and that any non-audit services are properly assessed for independence implications

Australian Regulatory Context

The IAASB exposure drafts sit within a broader Australian regulatory environment that is placing increasing demands on audit quality:

• ASIC audit quality surveillance — ASIC conducts regular inspections of registered company auditors and publishes findings on audit quality. Recent surveillance has focused on risk assessment, going concern assessments, and the use of technology in audits — all areas addressed by the proposed standard revisions
• ASIC Registered Company Auditor (RCA) requirements — Only RCAs registered with ASIC may audit the financial statements of Australian companies. The ASIC Auditing Competency Standard 2026 sets out the competency requirements for RCA registration and renewal
• APES 110 independence requirements — The Accounting Professional and Ethical Standards Board's APES 110 Code of Ethics for Professional Accountants sets out independence requirements for auditors. These requirements apply in addition to the auditing standards
• Sustainability reporting assurance — From 2026-27, Group 2 entities subject to mandatory climate reporting under AASB S2 must obtain limited assurance over their sustainability disclosures. The AUASB's ASSA 5000 and ASSA 5010 standards govern this assurance work, and the revised ISA 500 principles regarding evidence reliability will be relevant to sustainability assurance engagements

Questions to Ask Your Auditor

Australian businesses should use the following questions to assess whether their auditor is well-positioned to deliver quality audit services in the evolving standards environment:

1. How is your firm preparing for the proposed revisions to ISA 330, ISA 500, and ISA 520?
2. What data analytics and technology-enabled audit tools does your firm use, and how do you evaluate the reliability of evidence obtained through these tools?
3. How do you document the link between your risk assessment and the audit procedures you perform?
4. Has your firm participated in the AUASB's consultation on the IAASB exposure drafts?
5. What were the findings of your firm's most recent ASIC audit quality inspection, and how have you addressed any identified issues?
6. How do you manage independence when providing non-audit services to audit clients?
7. Are you registered with ASIC as a Registered Company Auditor, and is your registration current?

How MyMoney® Can Help

Selecting the right auditor is one of the most important governance decisions an Australian business can make. As auditing standards evolve to address technological change and heightened quality expectations, the gap between high-quality and mediocre audit services is widening. Businesses that engage auditors who are ahead of the curve on standards development will be better positioned to receive audit opinions that are credible, defensible, and valued by investors, lenders, and regulators.

MyMoney® connects Australian businesses with qualified, ASIC-registered auditors who are actively engaged with the evolving standards landscape. Whether you need a statutory audit, an SMSF audit, a sustainability assurance engagement, or a specialist forensic audit, our marketplace makes it straightforward to find and compare qualified professionals.

Post a Brief to outline your audit requirements and receive proposals from qualified auditors, or Browse Auditors on the MyMoney® Marketplace to find professionals with the expertise your business needs.