E3 Audit, Risk and Control

A. Assurance engagements and the audit ecosystem

An assurance engagement has five elements. There is a three-party relationship (the practitioner, the responsible party and the intended users). There is an appropriate subject matter, which is identifiable and can be measured or evaluated. There are suitable criteria used to measure it, which are relevant, complete, reliable, neutral and understandable. The practitioner obtains sufficient appropriate evidence. And the practitioner issues a written assurance report. The same five elements apply to financial statements, to sustainability information, and to prospective financial information such as forecasts and budgets.

The level of assurance differs. An audit gives reasonable assurance, expressed positively. A review gives limited assurance, expressed negatively (nothing has come to our attention), and its procedures are mainly inquiry and analytical procedures, so it is less costly and less thorough. Sustainability information can be assured at either level, and the criteria used, such as an international standard or the entity's own definitions, must be suitable. For prospective financial information, the practitioner can give a conclusion on whether the assumptions provide a reasonable basis for the forecast and whether it is properly prepared, but cannot give assurance that the forecast will be achieved, because it relates to the future.

An audit has benefits: it increases the credibility of the financial statements, helps to find errors and fraud, and encourages good controls and governance. It also has limitations: it is based on sampling and judgement, uses persuasive and not conclusive evidence, is limited by the inherent limitations of controls, and is subject to cost and time constraints. The expectation gap is the difference between what users think an auditor does and what the auditor is required to do. For example, users may think that the audit guarantees the accuracy of the statements or that it will find all fraud, or that it confirms that the company is a good investment.

Key terms

• Five elements of assurance: Three parties, subject matter, criteria, evidence and an assurance report.
• Limited assurance: A lower level of assurance expressed as a negative conclusion.
• Expectation gap: The difference between what users expect of an audit and what an audit gives.

Study tip: For any assurance question, go through the five elements in order. It structures the answer and picks up marks.

Practice questions for section A

B. Quality, ethics and the responsibilities of the auditor

A firm's system of quality management is designed to give reasonable assurance that the firm and its people meet their responsibilities and that the reports issued are appropriate. The main components are governance and leadership, relevant ethical requirements, acceptance and continuance of client relationships and engagements, engagement performance, resources, information and communication, the firm's risk assessment process, and monitoring and remediation. For an individual audit, the quality procedures cover engagement resources (the right skills and enough time), engagement performance (supervision, review, consultation on difficult matters and sometimes an engagement quality review), monitoring and remediation, and compliance with ethical requirements. If a deficiency is found, the firm assesses its severity and causes, and takes action to fix it and stop it happening again.

The ACCA Code of Ethics and Conduct uses a conceptual framework: identify threats to compliance with the fundamental principles, evaluate them, and address them by eliminating them, applying safeguards or ending the activity. The threats are self-interest, self-review, advocacy, familiarity and intimidation. The auditor must also consider independence, conflicts of interest and confidentiality. When there is a breach of the Code, the auditor should end the activity that caused it, assess its consequences, communicate with those charged with governance and take action to address the consequences, and consider whether it is possible to remain as auditor.

Management is responsible for preventing and detecting fraud and error through good controls and a culture of honesty, and the auditor is responsible for obtaining reasonable assurance that the financial statements are free from material misstatement, whether due to fraud or error. The auditor will not necessarily have failed if fraud is not detected, as long as the audit was properly planned and performed in line with auditing standards. The auditor assesses whether the audit should have detected a fraud by looking at what procedures were done, the evidence, and whether there were warning signs. The same applies to compliance with laws and regulations, including money laundering: management is responsible for compliance, and the auditor considers non-compliance that could affect the financial statements, and reports as the law and the Code require, which may include reporting suspicions to the authorities.

Key terms

• Engagement quality review: An objective review of significant judgements and conclusions before the report is issued.
• Remediation: Action to correct a deficiency in the quality management system.
• Conceptual framework: The approach of identifying, evaluating and addressing threats to ethical principles.

Study tip: In ethics scenarios, describe the threat, its significance, and a specific safeguard. Do not simply name the threat.

Practice questions for section B

C. Planning, risk and sustainability

Acceptance. Before accepting an engagement, the auditor checks the preconditions for an audit (an acceptable financial reporting framework and management's agreement to its responsibilities), considers whether the firm has the competence, resources and independence, and carries out customer due diligence, which means identifying and verifying the client and its owners and understanding the nature of the business, in order to manage the risks of money laundering and of dealing with someone whose integrity is in doubt. The terms are recorded in an engagement letter.

Risks. The auditor assesses the risk of material misstatement at the financial statement and assertion levels and designs the response. Business risks, including those related to sustainability, can lead to misstatements: for example climate regulation that makes an asset impaired, penalties for failing to comply with environmental laws, supply chain problems, or greenwashing in the annual report. Sustainability matters can also be indicators of going concern problems. Professional scepticism can be reduced by conscious and unconscious biases, such as confirmation bias (looking for evidence that supports a belief), anchoring (relying too much on first information) and availability bias (judging by what is easy to recall), and by time pressure and trust in management. The auditor should reduce these by challenging assumptions and seeking contradictory evidence.

Analytical procedures and materiality. At planning, key ratios and trends are compared with expectations to find unusual items, using data analytics where available. Materiality is calculated from a benchmark, with performance materiality set lower. Planning produces an overall audit strategy and a more detailed audit plan, and the extent of the work depends on the assessed risks. Interim audits are carried out before the year end, and look at systems and controls and some early testing. The final audit is carried out after the year end, and covers the balances, the financial statements and the completion procedures. Working papers record the work and the conclusions, with permanent files (information of continuing relevance, such as the constitution) and current files (information for the current year). Documentation is kept safely, with the retention period set by law and standards.

Worked figures

Detection risk: with a target audit risk of 5 percent, inherent risk of 60 percent and control risk of 70 percent, detection risk is 0.05 / (0.6 x 0.7) = 11.9%.

Analytical review: the gross profit margin fell from 36 percent to 30 percent while revenue grew by 10 percent. This unexpected change points to a possible overstatement of cost of sales or understatement of revenue, so the auditor would investigate cut-off, pricing and inventory valuation.

Key terms

• Customer due diligence: Identifying and verifying a client and understanding its business before acceptance.
• Confirmation bias: The tendency to look for evidence that supports an existing belief.
• Permanent file: Audit information of continuing relevance from year to year.

Study tip: When asked about audit risk, give the risk, the assertion affected and the specific audit response.

Practice questions for section C

D. Control, evidence, automated tools and reporting

Internal control. The five components of internal control are the control environment, the risk assessment process, the information system and communication, control activities and monitoring. The auditor considers general IT controls (for example access, change management and back-up) and information processing controls (for example input, processing and output checks). For each cycle (sales, purchases, payroll, inventory, bank and cash and non-current assets) the auditor identifies the control objectives, the direct controls and the deficiencies, designs tests of controls, and recommends improvements. Systems are documented using narrative notes (simple but hard to follow when complex), flowcharts (clear and show the whole system but take time to prepare) and questionnaires (comprehensive and quick but may not suit the entity). Deficiencies are communicated to management and those charged with governance with a covering letter that explains the deficiency, its effect and the recommendation.

Audit evidence and procedures. The auditor designs procedures for the assertions in each class of transactions and balance, for example for inventories, receivables, payables, bank and cash, non-current assets, leases, provisions, revenue and payroll. Tests of controls and substantive procedures are compared: tests of controls check the operation of controls, and substantive procedures (tests of details and analytical procedures) detect misstatements. Sufficiency is about the quantity and appropriateness about the quality of the evidence. Special procedures apply on an initial audit engagement (for example opening balances) and in not-for-profit organisations (for example completeness of donations).

Automated tools and techniques include test data (processing dummy transactions to see if controls work), audit software (to select samples, recalculate, compare files and find duplicates) and data analytics (to analyse whole populations and find anomalies). They improve coverage and efficiency, but need skills, can be costly, depend on the quality and security of the data, and can produce many exceptions that need judgement. The auditor considers the work of others, such as experts, internal audit and the auditors of a service organisation, by assessing their competence, objectivity and the quality of their work, and the auditor remains responsible for the opinion.

Reporting. After the subsequent events review, the going concern assessment (including sustainability indicators), the overall review with final analytical procedures, the evaluation of uncorrected misstatements and written representations, the auditor decides the opinion. A modified opinion is qualified (material but not pervasive), adverse (material and pervasive misstatement) or a disclaimer (a limit on scope that is material and pervasive). Additional communication in the report can be in a key audit matters section (for listed entities), an emphasis of matter paragraph, an other matter paragraph or a material uncertainty relating to going concern section. If the other information in the annual report, including sustainability information, is inconsistent with what the auditor knows, the auditor discusses it with management and, if it is not corrected, reports it in the other information section. The report does not refer to the work of others unless the law requires it, because the auditor is solely responsible for the opinion.

Key terms

• Test data: Dummy transactions used to test whether a system processes data correctly.
• General IT controls: Controls over the IT environment, such as access, change and back-up.
• Key audit matters: The matters of most significance in the audit, reported for listed entities.

Study tip: Link a recommended control to the deficiency it fixes. 'Introduce a review' scores less than 'a supervisor reviews and signs the reconciliation monthly'.

Practice questions for section D