AA Audit and Assurance

A. Audit framework and regulation

An assurance engagement is one in which a practitioner gives a conclusion that increases the confidence of intended users in the outcome of measuring a subject matter against criteria. A reasonable assurance engagement, such as an audit of financial statements, gives a positive opinion, with a high but not absolute level of assurance. A limited assurance engagement, such as a review, gives a negative form of conclusion with a lower level of assurance. The objective of an external audit is to give an opinion on whether the financial statements give a true and fair view (or are presented fairly) in all material respects in accordance with the applicable financial reporting framework. The directors are responsible for preparing the financial statements and for internal control, and the auditor is responsible for the opinion. An audit is needed because of the separation between owners and managers, and because users need independent assurance.

The International Standards on Auditing (ISAs) are issued by the International Auditing and Assurance Standards Board (IAASB). Their status depends on the country: in some they are adopted in full and in others, national standards are based on them. Quality management standards require firms to have a system of quality management and require engagement partners to take responsibility for the quality of each audit, with policies over ethical requirements, acceptance of engagements, resources, performance and monitoring.

Corporate governance is the system by which companies are directed and controlled. Good governance includes a board with a balance of executive and non-executive directors, separation of the roles of chair and chief executive, and board committees such as audit, remuneration and nomination committees. The audit committee reviews financial reporting, internal control and the work of internal and external audit, and it recommends the appointment of the auditor and agrees the fees. It helps to protect the independence of the auditor.

Professional ethics. ACCA's Code of Ethics and Conduct sets out five fundamental principles: integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. The threats to compliance are self-interest, self-review, advocacy, familiarity and intimidation. Safeguards include those created by the profession and law, those within the firm (such as rotation of partners and second partner reviews) and those within the client (such as strong governance). Examples of independence issues are financial interests in a client, loans, family and personal relationships, long association with a client, non-audit services, fee dependency on one client, gifts and hospitality, and fee disputes or threatened litigation. Auditors must also consider money laundering law and the duty to report suspected non-compliance.

Key terms

• Reasonable assurance: A high but not absolute level of assurance, given in an audit.
• Fundamental principles: Integrity, objectivity, professional competence and due care, confidentiality and professional behaviour.
• Self-review threat: The risk that an auditor will not evaluate properly the results of earlier work by the firm.

Study tip: For ethics scenarios, name the threat, say why it arises here, and then propose a safeguard.

Practice questions for section A

B. Planning and risk assessment

Before accepting an engagement, the auditor considers ethical requirements, the firm's competence and resources, the integrity of the management, and whether there are any conflicts or independence issues. The auditor communicates with the outgoing auditor and agrees the terms in an engagement letter, which sets out the objective and scope of the audit, the responsibilities of directors and auditor, and the reporting framework. The general principles of an audit are professional scepticism (a questioning mind and a critical assessment of evidence), professional judgement, and compliance with ethical requirements.

Audit risk is the risk of giving an inappropriate opinion when the financial statements are materially misstated. It is made up of the risk of material misstatement (inherent risk, which is the susceptibility of an item to misstatement before considering controls, and control risk, which is the risk that the entity's controls will not prevent or detect a misstatement) and detection risk (the risk that the auditor's procedures will not detect it). Audit risk = inherent risk x control risk x detection risk. The auditor assesses the first two and sets the audit procedures so that detection risk is low enough to keep audit risk at an acceptable level. Higher assessed risks need more extensive procedures.

Materiality is the size or nature of a misstatement that could influence the decisions of users. It is a matter of judgement and is based on a benchmark such as profit before tax, revenue or total assets, depending on the entity. Performance materiality is set at a lower level to reduce the risk that the total of uncorrected and undetected misstatements exceeds materiality.

Understanding the entity and its environment includes its industry, regulation, nature, objectives and strategies, performance measures and internal controls. Analytical procedures at the planning stage compare financial and non-financial information, such as ratios and trends, with expectations to find unusual relationships and areas of risk. They are also used as substantive procedures and at the end of the audit.

Fraud and error. Fraud is intentional, either fraudulent financial reporting or misappropriation of assets. The factors that make fraud more likely are incentive or pressure, opportunity and a rationalisation, and the auditor must maintain professional scepticism and discuss the risk of fraud in the engagement team. Management, not the auditor, is responsible for preventing and detecting fraud. The auditor also considers laws and regulations, and non-compliance, and reports on it as required.

Planning. The auditor sets an overall audit strategy (scope, timing and direction) and then an audit plan with the nature, timing and extent of procedures, taking account of risks, materiality, the use of experts and the work of others, and the need for a team with the right skills. Audit documentation records the work done, the evidence obtained and the conclusions, so that an experienced auditor with no connection to the audit can understand it, and so that the file can be reviewed.

Worked figures

Audit risk model: if the target audit risk is 5 percent, inherent risk is 80 percent and control risk is 50 percent, the detection risk is 0.05 / (0.8 x 0.5) = 12.5%.

Materiality: an auditor uses 5 percent of profit before tax as a benchmark. For profit before tax of $4,000,000, materiality is $200,000. The percentage used is a matter of judgement and depends on the circumstances.

Key terms

• Inherent risk: The susceptibility of an item to misstatement before considering controls.
• Detection risk: The risk that the auditor's procedures will not detect a material misstatement.
• Performance materiality: An amount set below materiality to reduce the risk of undetected misstatements.
• Engagement letter: A document that sets out the terms of the engagement.

Study tip: Audit risk questions are usually about the link: higher risk of misstatement means lower detection risk, so more work.

Practice questions for section B

C. Internal control

A system of internal control is the process designed and run by those charged with governance, management and others to provide reasonable assurance about the achievement of the entity's objectives, including reliable financial reporting, effective operations and compliance with law. The main components are the control environment (management's attitude and the culture), the entity's risk assessment process, the information system and communication, control activities (such as authorisation, segregation of duties, physical controls, reconciliations and performance reviews), and monitoring. Controls have limitations: human error, collusion, management override, cost and the fact that they are designed for routine transactions.

The auditor obtains an understanding of the controls that are relevant to the audit and records it with narrative notes, flowcharts or questionnaires, and confirms it with walkthrough tests. Controls are evaluated for design and for whether they have been put in place. If the auditor intends to rely on controls, tests of controls check that they operated effectively during the period, using inquiry, observation, inspection of evidence of performance, and re-performance. If controls are found to be effective, the substantive work can be reduced, and if not, more substantive procedures are needed.

Deficiencies in internal control are communicated in writing to those charged with governance and to management, as soon as practicable. The communication describes each deficiency, its potential effects and gives recommendations, and the management response is invited. Significant deficiencies are the ones that, in the auditor's judgement, merit the attention of those charged with governance.

Internal audit is an appraisal activity within an entity that evaluates and improves the effectiveness of risk management, control and governance processes. It differs from external audit: internal audit is employed by the entity, reports to management or the audit committee, covers any area decided by the entity, is concerned with the effectiveness of controls and operations, and has no statutory requirement for most entities. External audit is independent of the entity, reports to the members on the financial statements, and is required by law for many entities. The scope of internal audit includes operational audits, value for money audits, compliance audits, financial audits, IT audits and fraud investigations. An entity can outsource internal audit, which can give access to specialist skills and flexibility, but may reduce knowledge of the business and is subject to the need to protect the independence of the external auditor if the same firm provides both services.

Key terms

• Control environment: The attitudes, awareness and actions of management and those charged with governance about internal control.
• Walkthrough test: Following one transaction through the system to confirm the auditor's understanding.
• Tests of controls: Procedures to check that a control operated effectively during the period.
• Significant deficiency: A deficiency in control that merits the attention of those charged with governance.

Study tip: When recommending improvements, give the deficiency, the risk it creates and a specific recommended control. All three earn marks.

Practice questions for section C

D. Audit evidence

Auditors obtain sufficient appropriate audit evidence to support the opinion. Sufficiency is about the quantity and appropriateness is about the quality, which means relevance and reliability. Evidence is more reliable if it is obtained from outside the entity, from a source with effective controls, directly by the auditor, in documentary form and as originals. Assertions are the representations by management that are implicit in the financial statements. For classes of transactions they are occurrence, completeness, accuracy, cut-off and classification. For account balances they are existence, rights and obligations, completeness and valuation and allocation. For presentation and disclosure they are occurrence, rights and obligations, completeness, classification and understandability, and accuracy and valuation.

Audit procedures include inspection (of records, documents and tangible assets), observation, external confirmation, recalculation, re-performance, analytical procedures and inquiry. Procedures are used as risk assessment procedures, as tests of controls and as substantive procedures. Sampling means applying procedures to fewer than 100 percent of items, so that the conclusions about the population can be drawn. Statistical sampling uses probability theory to select and evaluate, and non-statistical sampling uses judgement. The auditor must consider the sampling risk, the tolerable misstatement and the expected misstatement, and the selection methods such as random, systematic and monetary unit sampling.

Specific items. For inventory, the auditor attends the count, tests count procedures, tests cut-off, checks valuation at the lower of cost and net realisable value, and confirms inventory held by third parties. For receivables, the main procedures are direct confirmation, review of after-date receipts, and checking for cut-off and the allowance for irrecoverable debts. For payables, the main risk is understatement, and procedures include supplier statement reconciliations and search for unrecorded liabilities. Other items include bank (bank confirmation and reconciliations), non-current assets (verification of existence, ownership and depreciation), payroll, and accounting estimates and related parties.

Automated tools and techniques, including computer-assisted audit techniques and data analytics, allow the auditor to test whole populations, find unusual transactions and analyse trends. Their use brings benefits (coverage, speed and insight) and challenges (cost, data quality, skills and security). The auditor may use the work of others. The auditor decides whether to rely on the work of internal audit, an expert, or a service organisation's auditor by assessing their competence, objectivity and the quality of the work, and remains responsible for the opinion. Not-for-profit organisations have audit issues such as grants and restricted funds, voluntary income that is hard to verify, and value-for-money objectives.

Key terms

• Assertion: A representation by management, explicit or implicit, in the financial statements.
• Substantive procedure: A test of details or an analytical procedure to detect material misstatements.
• Cut-off: Recording transactions in the correct period.
• Sampling risk: The risk that the conclusion from a sample differs from the conclusion for the whole population.

Study tip: Link every procedure to an assertion. 'Inspect the title deed' tests rights and obligations, for example.

Practice questions for section D

E. Review and reporting

Subsequent events are events between the period end and the date of the auditor's report (adjusting and non-adjusting), and facts that become known after the report is issued. Before the report is signed, the auditor carries out procedures to identify events, such as reading minutes and the latest management accounts and making inquiries. If a fact becomes known after issue, the auditor discusses it with management and takes action, which may include withdrawing the report.

Going concern. The financial statements are prepared on the going concern basis unless management intends to liquidate the entity or cease to trade. The auditor evaluates management's assessment, covering at least 12 months from the period end, considering indicators such as recurring losses, net current liability position, loan repayments due that cannot be met, loss of key customers, and legal or regulatory problems. If there is a material uncertainty that is properly disclosed, the opinion is unmodified, with a separate section headed material uncertainty related to going concern. If the disclosure is inadequate, a qualified or adverse opinion is given. If the going concern basis is inappropriate, an adverse opinion is given.

Written representations are statements from management to the auditor, which confirm that management has fulfilled its responsibilities and other matters, such as completeness of information, and which support other evidence, but they are not a substitute for it. If management refuses to provide them, the auditor may issue a modified opinion or withdraw. At the end of the audit, the final review checks that the work is complete, that conclusions are supported, and that the financial statements are consistent with the auditor's understanding. Uncorrected misstatements are evaluated against materiality.

The independent auditor's report has a title, an addressee, the opinion, the basis for opinion, a going concern section where needed, key audit matters (for listed entities), other information, the responsibilities of management and those charged with governance, the auditor's responsibilities, and other reporting responsibilities, together with the signature, the date and the address. An unmodified opinion says that the financial statements give a true and fair view or are presented fairly. A modified opinion is given when there is a material misstatement or the auditor cannot obtain sufficient appropriate evidence. If the effect is material but not pervasive, the opinion is qualified ('except for'). If a misstatement is material and pervasive, an adverse opinion is given. If a limit on the scope of work has effects that are material and pervasive, the auditor disclaims an opinion. An emphasis of matter paragraph draws attention to a matter that is properly presented but is fundamental to users' understanding, and an other matter paragraph refers to a matter that is not presented in the financial statements but is relevant to users' understanding of the audit.

Key terms

• Material uncertainty: An uncertainty about going concern that is significant enough to require disclosure.
• Qualified opinion: An opinion given when a matter is material but not pervasive.
• Adverse opinion: An opinion that the financial statements do not give a true and fair view.
• Disclaimer of opinion: A statement that the auditor cannot give an opinion.

Study tip: Decide two things for every modification: is it a misstatement or a limit on scope, and is the effect material or material and pervasive?

Practice questions for section E