I hope you have a better understanding on ISA 315, 320 & 250 (Not sure). First try to identify the audit risk (misstatement) at the design phase. Financial statement level comes when some pervasive events risk financial statements for ex: Management usually override the internal controls (like taking cash without vouchers etc..) will lead to may assertions. There are assertions categories (3/4 not clearly remember) we used a term "ACCA COVER U" for classifying transactions