What makes a risk a 'significant risk', and how does that classification change your audit response?

A significant risk is an identified risk of material misstatement for which the assessed inherent risk is close to the upper end of the spectrum — driven by complexity, subjectivity/estimation uncertainty, fraud potential, significant unusual or related-party transactions, or rapid change. Classifying a risk as significant triggers heightened responses: you must obtain an understanding of the relevant controls (whether or not you test them), you generally can't rely on prior-period evidence alone, you design substantive procedures specifically responsive to that risk, and substantive procedures must be performed for each significant risk (controls testing alone isn't sufficient). It also drives more senior involvement, more skepticism, and often becomes a candidate Key Audit Matter. The point is that significant risks get dedicated, tailored, evidence-heavy attention rather than standard coverage.