Significant risks require a specific audit response and generally relate to non-routine transactions and complex or judgmental matters. When you identify risks, your audit program will include extended, substantive procedures for the assertions affected by the risk.