AAA Advanced Audit and Assurance (International)

A. Regulatory environment and professional ethics

International regulatory frameworks affect audit and assurance through the standards issued by the IAASB and the ethics code issued by the IESBA, which are applied by national bodies and regulators, sometimes with additions. Regulators supervise audit firms, inspect audit quality and discipline those who fall short. The framework covers the audit of listed entities (public interest entities) with stricter requirements, such as the rotation of partners and limits on non-audit services.

Money laundering. Offences include concealing, transferring or acquiring criminal property and, in some jurisdictions, failing to report knowledge or suspicion and tipping off. Auditors and firms are required to have policies for customer due diligence, to monitor, to report suspicions to the authority through a nominated person, and to train staff. The duty to report may override the duty of confidentiality, and the auditor should be careful not to alert the client.

Laws and regulations. Management is responsible for compliance. The auditor obtains an understanding of the legal framework, performs procedures to identify non-compliance that may have a material effect on the financial statements, responds to any suspected non-compliance, and communicates it to management and those charged with governance. Where the non-compliance is not resolved, the auditor considers a duty to report to an authority, the effect on the report and withdrawal.

Ethics. The fundamental principles are integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. The conceptual framework requires the identification, evaluation and addressing of threats (self-interest, self-review, advocacy, familiarity and intimidation). Typical situations are gifts and hospitality, fee dependency, long association, non-audit services, loans and financial interests, and conflicts between clients. Safeguards include separate teams, review by a partner not involved, and in some cases declining or ending the work. Fraud and error are the responsibility of management, but the auditor must plan to detect material misstatement from fraud, remain sceptical, discuss fraud risk in the team and respond to the risks. Professional liability arises in negligence if there is a duty of care, a breach of that duty and loss caused by it, and it can be limited by contract (where allowed), by insurance, by quality control and by clear engagement letters.

Key terms

• Public interest entity: An entity, such as a listed company, for which there is wide public interest, with stricter audit rules.
• Tipping off: Informing a person that they are suspected of money laundering.
• Duty of care: A legal duty to take reasonable care towards a person who relies on your work.

Study tip: For ethical issues, identify the threat, assess its significance, and propose a specific safeguard. If no safeguard works, say what you would do.

Practice questions for section A

B. Quality management, acceptance and appointments

A firm must have a system of quality management that deals with governance and leadership, ethical requirements, acceptance and continuance of clients, engagement performance, resources, information and communication, the risk assessment process, and monitoring and remediation. At engagement level, the engagement partner takes responsibility for quality, and the team has the right skills and enough time. Supervision, review, consultation on difficult matters and an engagement quality review for higher-risk audits are used. Differences of opinion are resolved by following the firm's procedure.

Acceptance and continuance. The firm considers its integrity and independence, the integrity of the client's management, the competence and resources to do the work, the risk and the fee. Customer due diligence is part of it. When there is a change of auditor, the incoming auditor must communicate with the outgoing one (with the client's permission) and obtain a letter of engagement.

Obtaining work and fees. The rules on advertising and tendering aim to prevent misleading claims and unprofessional behaviour. Fees must be fair, and risks arise if fees are very low (the quality of the audit may suffer), contingent (which creates a self-interest threat) or overdue (which is like a loan to the client). A high proportion of fees from one client creates a dependency threat. Professional appointments: an auditor can be removed or can resign, and there are procedures for the statement of circumstances and for informing the new auditor.

Key terms

• Engagement quality review: An objective evaluation of significant judgements before the report is issued.
• Fee dependency: A threat to independence caused by a high share of a firm's fees coming from one client.

Study tip: When there is a quality management issue, say what is wrong, what risk it creates for audit quality and how to fix it.

Practice questions for section B

C. Planning and conducting an audit

Planning, materiality and risk. The auditor sets an overall strategy and an audit plan using an understanding of the entity, its environment, controls and financial reporting framework. Materiality is set for the financial statements as a whole, using a benchmark and professional judgement, with performance materiality below it and a clearly trivial threshold. Risks of material misstatement are assessed at the financial statement and assertion levels, including significant risks (such as fraud, related parties and complex estimates), and responded to with the nature, timing and extent of procedures. Analytical procedures at planning identify unusual relationships. Business risk is linked to audit risk, for example going concern risk, new systems, regulatory changes and reliance on a few customers.

Evidence and testing. Evidence must be sufficient and appropriate. The auditor decides the mix of tests of controls and substantive procedures depending on the assessed risk, and uses sampling, analytical procedures and automated tools. Specific areas include accounting estimates (testing management's process, using an independent estimate, and reviewing later events), fair value measurements, related parties, inventory held by third parties and the use of a service organisation. Data analytics lets the auditor test entire populations and identify exceptions.

Using the work of others. The auditor decides whether to use the work of internal audit, experts and other auditors by assessing competence, capabilities, objectivity and the quality of the work, and still takes responsibility for the opinion. Group audits. The group engagement team sets group materiality and component materiality (so that the aggregate of component amounts does not exceed what would allow an unacceptable level of misstatement in total), decides the work needed at significant components, communicates its requirements to component auditors, evaluates their competence and independence, and reviews their work. Consolidation adjustments and group-wide controls are also audited.

Key terms

• Component auditor: An auditor who performs work on the financial information of a group component for the group audit.
• Significant risk: An identified risk that needs special audit consideration.
• Clearly trivial: An amount below which misstatements need not be accumulated.

Study tip: Link every risk to a response that says what the auditor will do, why, and on which assertion.

Practice questions for section C

D. Completion, review and reporting

Subsequent events and going concern. The auditor performs procedures for events between the period end and the date of the report and for facts known after it. For going concern, the auditor evaluates management's assessment, covers at least 12 months from the period end, considers indicators and mitigating plans, and checks the disclosure. A material uncertainty that is adequately disclosed is reported in a separate section, and an inadequate disclosure gives a qualified or adverse opinion, and a wrong use of the going concern basis gives an adverse opinion.

Completion and final review. The auditor evaluates the sufficiency and appropriateness of evidence, uncorrected misstatements (individually and in total), the overall presentation, and obtains written representations. An engagement quality reviewer, for those audits that require it, reviews significant judgements and the draft report, and the review is documented before the report is released.

Auditor's report. An unmodified opinion says that the financial statements give a true and fair view or present fairly. A modified opinion is qualified (material but not pervasive misstatement or limit on scope), adverse (material and pervasive misstatement) or a disclaimer (limit on scope that is material and pervasive). Key audit matters are communicated for listed entities, an emphasis of matter paragraph refers to a matter fundamental to understanding, and an other matter paragraph refers to another matter relevant to the audit. Other information is read and any material inconsistency is reported. Reports to those charged with governance and management cover the audit scope, significant findings, uncorrected misstatements, control deficiencies, and the auditor's independence.

Key terms

• Pervasive: Effects that are not confined to specific items or that represent a substantial proportion of the financial statements.
• Key audit matter: A matter of most significance in the audit, reported for listed entities.
• Modified opinion: A qualified opinion, an adverse opinion or a disclaimer of opinion.

Study tip: Decide whether a problem is a misstatement or a limit on scope, and whether its effect is material or also pervasive.

Practice questions for section D

E. Other assignments and sustainability assurance

Audit-related and assurance services. These include reviews of historical financial information (limited assurance), agreed-upon procedures (no assurance, the practitioner reports findings), compilation, and assurance on non-financial subject matter. An assurance engagement has a three-party relationship, an appropriate subject matter, suitable criteria, sufficient appropriate evidence and a written report. Reports are tailored to the assignment and should state clearly what level of assurance is given and for whom.

Specific assignments. Prospective financial information (such as forecasts and projections) is examined for the reasonableness of assumptions and for proper preparation and presentation, but no assurance can be given on whether the results will be achieved. Due diligence investigates a target, often for an acquisition, in areas such as finance, commercial matters, legal issues, operations, tax and IT, and the report goes to the client, who uses it to value and negotiate. Forensic investigations look into suspected fraud or misconduct, collect and preserve evidence, and may support legal proceedings. The audit of performance information in the public sector examines whether reported results against pre-determined objectives are reliable, relevant and presented well.

Sustainability assurance. Assurance on sustainability information (such as emissions, energy use or social data) may be limited or reasonable, and depends on suitable criteria (for example recognised standards), reliable data systems and competent practitioners, including specialists. The risks are weak data collection, estimates, definitions that differ, bias and greenwashing. Procedures include testing the data and controls, analytical procedures, site visits, and checking that the report is balanced and complete. Developments include the new IFRS and European sustainability reporting standards and the standards on assurance of sustainability reporting.

Key terms

• Agreed-upon procedures: An engagement in which the practitioner reports factual findings and gives no assurance.
• Due diligence: An investigation of a target's affairs before a transaction.
• Prospective financial information: Forecasts or projections of future financial results.

Study tip: For each assignment, say who the client is, what assurance (if any) is given and what the report is used for.

Practice questions for section E

F. Current issues and professional skills

Current issues include developments in professional ethics (for example the treatment of non-compliance with laws and regulations, and technology-related threats), the effect of artificial intelligence and automation on the audit, the growth of sustainability reporting and assurance, cyber security and fraud, and the expectations of regulators and users on audit quality. Answers should show an understanding of the issue, its effect on the auditor and the entity, and a practical response.

Professional skills are tested in all of the case study and the Section B questions: communication, analysis and evaluation, professional scepticism and judgement, and commercial acumen. Ten of the 50 marks in Section A are for professional skills, and five of the 25 marks in each Section B question. Scepticism and judgement means challenging management's explanations, considering bias and corroborating evidence. Commercial acumen means linking the audit to the client's business, risks and sector.

Key terms

• Professional judgement: The application of knowledge and experience to decisions in the context of standards and ethics.
• Corroborating evidence: Evidence that supports other evidence from a different source.

Study tip: When you are given management's explanation for an unusual figure, ask what evidence would confirm it.