Notes
Notes
The objective of an external audit is to express an opinion (in terms of truth and fairness) on
whether the financial statements are prepared, in all material respects, in accordance with an
identified reporting framework (e.g. International Financial Reporting Standards) and the relevant
law.
Internal Audit
an independent, objective assurance and consulting activity designed to add value and improve an
organisation’s operations.
As an assurance service, an external audit must include the five elements of an assurance
engagement:
1. The subject matter is the financial statements prepared under the applicable financial
reporting framework (e.g. IFRS Accounting Standards).
3. The criteria (benchmarks against which the subject matter can be assessed) used to evaluate
the financial statements include the financial reporting framework.
4. The external auditor plans and performs the audit engagement to obtain sufficient
appropriate evidence to support the expression of an opinion on the financial statements.
The essential attributes of the relationship between the directors, shareholders and auditors are
stewardship, agency and accountability.
Professional judgment (ISA 200) – the application of relevant training, knowledge and
experience, within the context provided by auditing, accounting and ethical standards, in making
informed decisions about the courses of action that are appropriate in the circumstances of the audit
engagement.
The audit process is often depicted as a continuous annual cycle of broad stages:
Stage Description
Engagement letter
The auditor must send all clients an engagement letter setting
out the auditor's duties and responsibilities and managements.
To determine audit strategy and the nature, timing and extent of audit
Assess risk
procedures (the audit plan), auditors must identify and assess the risks of
material misstatement.
Internal controls
Regardless of the audit approach, the auditor must evaluate the design of the
system of internal control.
Control effectiveness
If the auditor decides to rely on the system of internal control, the operating
effectiveness of internal controls must be tested.
Substantive
All material assertions relating to balances, transactions and related
procedures
disclosures must be verified. For example, that transactions occurred, assets
exist and disclosures are complete.
Review and
finalisation
Audit working papers must be reviewed to ensure that audit evidence
procedures
supports the audit opinion. Procedures typically include an analytical review
of the financial statements, subsequent events and going concern reviews.
Stage Description
After the directors have approved the financial statements, the auditor signs
Sign auditor's report
the auditor's report. The audit opinion will usually be unmodified but may
need to be modified.
Corporate Governance
The system by which business corporations are directed and controlled. The corporate governance
structure specifies the distribution of rights and responsibilities among different participants in the
corporation and spells out the rules and procedures for making decisions on corporate affairs. By
doing this, it also provides the structure through which the company objectives are set, and the
means of attaining those objectives and monitoring performance.
– ISA 260
Management – individuals with executive responsibility for the conduct of the entity's
operations.
– ISA 260
Applicability:
Main Principles
1. Board Leadership and Company Purpose
Effective Board: Drives long-term success and shareholder value.
Key Responsibilities:
2. Division of Responsibilities
Chair Independence: Must not be an employee(during last 5 yrs), have material
relationships, or be a significant shareholder.
Chair Role:
Board Composition:
NED Responsibilities:
Re-election:
Diversity:
Annual Evaluation:
Audit Committee:
5. Remuneration
Policies:
Committee:
Judgment:
Audit Committee
Purpose: Establishes formal and transparent arrangements for corporate reporting, risk
management, and internal control.
Composition:
1. integrity;
2. objectivity;
4. confidentiality; and
5. professional behaviour.
Self-interest threat;
Self-review threat;
Advocacy threat;
Intimidation threat.
Auditor Appointment
There are three main stages in the auditor appointment process:
1. Client screening and acceptance;
1. Is the audit firm able to audit the potential client?
2. Does the audit firm want to be associated with the potential client?
2. Engagement acceptance;
The prospective auditor should do the following to determine whether the client can be
properly served:
2. Assess the specific requirements of the engagement and the purpose, nature, and
scope of the work to be performed (e.g. laws and regulations, use of experts, assurance
from controls, reliance on internal audit).
3. Assess the logistics (e.g. locations, competent audit staff, time frame).
3. Professional appointment.
The significance of any threat to the fundamental principles should be evaluated (e.g. threats
to professional competence if an engagement is accepted without understanding all the relevant
facts).
An essential safeguard is communicating with the existing auditor to determine whether there are
any professional or other reasons not to accept the engagement.
3. Engagement Acceptance: Following proper procedures for accepting or continuing the audit.
4. Resource Management: Appropriately using assigned resources.
5. Engagement Performance:
6. Monitoring and Remediation: Staying vigilant for quality management deficiencies and
addressing them.
Documentation Techniques
Narrative Notes: Commonly used for recording business history, processes, controls,
interviews, and results.
Graphics: Includes flowcharts, organization charts, and various types of graphs to visualize
information.
Checklists: Used to document procedures and ensure critical tasks are completed.
Electronic Media: Utilized for audit tools and documentation production.
o There is one CAF for each audit stage (interim, year-end, final) for each year.
Client name
Schedule reference
Date of preparation
Date of review
Retention period
Working papers should be retained for a period sufficient to meet the needs of the audit practice and
in accordance with legal and professional requirements. The IAASB requires at least five years.
Audit Procedure
Auditors must adhere to all RELEVANT ISAs and cannot report compliance unless all have been
followed.
o ISA 620: Only relevant if the auditor employs their own expert.
Deviations: Auditors may deviate from ISA requirements only in exceptional circumstances,
using alternative procedures to meet the requirement's intent.
The relevant standard for audit planning is ISA 300 Planning an Audit of Financial Statements.
Planning Cycle
Planning starts after the previous audit and continues through the current one(interim stage).
Planning activities
The auditor should develop an audit plan for the audit to reduce audit risk to an acceptably low level.
The plan will include a description of:
The nature, timing and extent of risk assessment procedures, as determined under ISA 315.
The nature, timing and extent of audit procedures at the assertion level to address identified
risks, as determined under ISA 330.
Other audit procedures that must be carried out so that the engagement complies with ISAs
Time Table
Stages of an Audit
Interim Audit Final Audit
Required No Yes
Direction
Purpose: Inform engagement team members about:
o Their responsibilities
o Risk-related issues
o Potential problems
Communication Tools:
o Audit programme
Supervision
Monitoring Progress: Ensure:
Review
Responsibilities of Review Personnel:
Audit Strategy
Captures key decisions for planning and communication, summarized in a “planning
memorandum” detailing the scope, timing, and conduct of the audit.
Audit Plan
Must demonstrate the planned:
o Planning procedures
The auditor must identify and assess the risks of material misstatement, whether due to fraud or
error, at the financial statement and assertion levels, thereby providing a basis for designing and
implementing responses to the assessed risks of material misstatement.
Key Steps
1. Risk Assessment Procedures:
4. Identify Risks:
5. Assess Risks:
Conclusion
Auditors must understand the entity to assess the risk of material misstatement
(RoMM) and create a work programme to test for misstatements, following ISA 330 and ISA
500.
Key Procedures
Audit risk
the risk that the auditor expresses an inappropriate audit opinion when the financial statements are
materially misstated. It is a function of the risks of material misstatement and detection risk. (ISA
200)
the financial statement level (i.e. affecting the financial statements overall or as a whole); or
the assertion level for classes of transactions, account balances and disclosures (i.e.
existence, completeness, occurrence, valuation, presentation, etc of line items in the
financial statements).
By definition, risks at the financial statement level affect many assertions, which is termed
“pervasive”.
IR and CR are assessed separately, but their combined effect indicates the risk of material
misstatement—the likelihood that controls fail to detect misstatements arising from inherent risk.
Audit firms typically set an acceptable level of audit risk (e.g., 5%), indicating a 5% chance of
undetected material misstatements or a 95% assurance that none exist.
IR and CR can be qualitatively categorized as high, medium, or low, with DR inversely related. For
instance, if both IR and CR are high, DR should be minimized through rigorous audit procedures.
Inherent risk – the susceptibility of an assertion about a class of transaction, account balance
or disclosure to a misstatement that could be material (either individually or when aggregated with
other misstatements) before considering any related controls.
-ISA 315
Control risk – the risk that a misstatement that could occur in an assertion (about a class of
transaction, account balance or disclosure) and that could be material (either individually or in
aggregate with other misstatements) will not be:
prevented; or
-ISA 315
Detection risk – the risk that audit procedures performed to reduce audit risk to an acceptably
low level will not detect a misstatement that exists and that could be material (either individually or
in aggregate).
-ISA 200
the attitudes, awareness and actions of TCWG and management concerning internal
control.
2. Entity’s Risk Assessment Process
The auditor must obtain an understanding of the entity’s risk assessment process including
how the entity:
Assesses the significance (including the likelihood of occurrence) of those risks; and
3. Information System
An information system consists of:
people;
procedures; and
data.
4. Control Activities
policies or procedures to achieve the control objectives of management or those charged
with governance.
5. Monitoring Process
Monitoring is a process that evaluates the effectiveness of controls and identifies and
rectifies control deficiencies.
Performance materiality
the amounts set by the auditor at less than materiality for the financial statements as a
whole to reduce to an appropriately low level the probability that the aggregate of
uncorrected and undetected misstatements exceeds materiality for the financial statements
as a whole.
To obtain sufficient appropriate audit evidence regarding compliance with provisions of laws
and regulations that have a direct effect on material amounts and disclosures in financial
statements;
To perform specified audit procedures to help identify instances of non-compliance that may
have a material effect on the financial statements; and
IT environment
The IT applications and supporting IT infrastructure, and the IT processes and personnel
involved in those processes, that are used to support business operations and achieve
business strategies.
General IT controls – controls over the IT processes that support the continued proper
operation of the IT environment, including the continued effective functioning of information
processing controls and the integrity of information (i.e. the completeness, accuracy and validity of
information) in the informationmm,,,,0
4
Information processing controls
Controls relating to the processing of information in IT applications or manual information processes
that directly address risks to the integrity of information (i.e. the completeness, accuracy and
validity of transactions and other information).
5 key skills
communicate clearly with TCWG the auditor's responsibilities for the financial statement
audit, and an overview of the planned scope and timing of the audit;
provide TCWG with timely observations arising from the audit that are significant and
relevant to the auditor's responsibility to oversee the financial reporting process; and
Internal Audit
*has been defined at the start*
Add Value: Organizations create value for stakeholders. Internal auditors identify operational
improvements through risk assessment.
Control: Actions by management and the board enhance risk management and goal
achievement.
Adequate Control: Management ensures risks are managed and objectives are achieved
effectively and economically.
Local taxpayers, service users, partners and the wider business community in setting new performance
targets.
Consult
Compar
Benchmark against the performance of others across a range of relevant indicators to aim to improve.
e
Compet
Consider fair competition as a means of securing efficient and effective services.
e
Value for money auditing – the evaluation of management's achievements in terms of the
economy, efficiency and effectiveness (the "3 Es") of operations.
Best value – a duty to deliver services to clear standards – covering both cost and quality – by
the most effective, economical and efficient means available.
The best value audit has evolved from VFM auditing in the public sector and local and central
government. It seeks to secure continuous improvement in how its functions are exercised regarding
economy, efficiency and effectiveness. It incorporates the "4 Cs":
Audit evidence
All the information used by the auditor in arriving at the conclusions on which the audit opinion is
based. It includes information contained in the accounting records underlying the financial
statements and information from other sources.
To remember the list of all of the assertions, use the mnemonic ACCA COVER OP:
ACCA COVER OP
Cut-off Existence
Allocation Rights
Assertions by Category
Completeness Completeness
Existence Cut-Off
Presentation Accuracy
Classification Presentation
Analytical procedures
Evaluations of financial information through analysis of plausible relationships between both
financial and non-financial data, identified fluctuations or relationships that are inconsistent with
other relevant information or that differ from expected values by a significant amount.
Balance Assertions: Test completeness, allocation and valuation, and existence (not
rights and obligations).
Auditor Steps
1. Assess Suitability and Sufficiency: Determine if analytical procedures are
appropriate for specific assertions.
2. Evaluate Data Reliability: Check the source, comparability, nature, relevance, and
preparation controls of the data.
2. Information Disaggregation:
More effective with individual operational sections than overall financial statements.
3. Information Availability:
Assess if relevant financial and non-financial data (e.g., budgets, forecasts, units
produced/sold) is available and reliable.
AFTER CHAPTER 19
Written representations in this context do not include financial statements, the assertions therein, or
supporting books and records.
AFTER CHAPTER 21
o Unrecorded disposals.
3. Rights (Control)
Considerations:
4. Existence
Risks:
3. Rights (Control)
Evidence:
4. Existence
Verification:
AFTER CHAPTER 25
3. Existence
Verification: Use direct confirmation from banks to confirm balances; physical cash in registers can be
inspected.
4. Presentation
Guideline: Loans and overdrafts should not offset bank deposits unless legally allowed by the bank
contract.
5. Classification
Classification: Ensure cash, bank accounts, and loans are classified as current or non-current in
the financial statement.