Audit & Assurance Summary by Shakhawat
Audit & Assurance Summary by Shakhawat
CA Professional Stage
Application Level
The elements
Any assurance engagement needs:
1. A responsible party
2. A practitioner
3. A user of the report
4. A subject matter
5. Criteria
6. Sufficient appropriate evidence to support the conclusion
7. A written report containing a conclusion
Levels of assurance
In accordance with the International Framework there are two types of assurance engagement. Engagements could
be either type, and this would need to be specified in the terms of engagement.
1. Reasonable assurance engagements, which result in a positive expression of opinion and where the level of
assurance given is deemed to be high. Example: Audit ('In our opinion management has operated an
effective system of internal control' a positive form of opinion deriving from a reasonable assurance
engagement.)
2. Limited assurance engagements, which result in negative assurance and where the level of assurance given
is deemed to be moderate. Example: Review of business plan ('Nothing has come to our attention that
indicates material internal control weakness a negative form of assurance deriving from a limited assurance
engagement.)
Benefits of assurance
A key feature of assurance services is that they are provided by independent professionals who therefore give an
objective, unbiased opinion. They give the following benefits to users:
Enhances the credibility of the information being reported on
Reduces the risk of management bias, error or even fraud in the information being reported on
Draws the attention of the user to any deficiencies in the information being reported on
Assurance services also give added credibility to the wider share market:
They ensure that high quality, reliable information circulates in the market
They give investors added faith in the market
They improve the reputation of organisations trading in the market
Worked Example: page 6 (How Audit is an assurance engagement) BSA 700 (Written Audit Report issued in prescriber form)
Many would argue (and the auditors of smaller companies have found this to be true) that, in many cases, the audit
is valued by management because:
They value having their business scrutinized by another set of professional eyes
It provides additional assurance to third parties such as taxation authorities concerning the reliability of the
financial statements
A growing business will one day require an audit
Audit may have subsidiary benefits, such as the auditors recommending improvements in company systems.
General
The requirements of any legislation or regulation under which the engagement is conducted, and/or
The terms of engagement will specify the services to be provided,
Ethical and professional standards
Quality control standards
Statutory audit
In the case of an audit of financial statements under the Companies Act 1994, it is the external auditor's
responsibility to:
The audit is planned properly
Sufficient appropriate audit evidence is gathered
The evidence is properly reviewed and valid conclusions drawn
Non-assurance services
Assisting the company with the maintenance of its accounting records
Assisting the company with preparing management information
Preparing the financial statements of the company
Preparing the corporation tax return of the company
Error
Auditors are responsible for detecting material misstatements in the financial statements, some of which
may be caused by error.
Management are responsible for designing and implementing a system of internal control which is capable of
preventing, or detecting and correcting, errors in the financial records.
Auditors are required to assess the system of internal control as part of their audit in order to determine
whether to rely on the system of controls or carry out extended tests of details.
Auditors are required to report to those charged with governance on material weaknesses in controls which
could adversely affect the entity's ability to record, process, summarize and report financial data potentially
causing material misstatements in the financial statements.
Auditors are responsible for giving an opinion whether the financial statements are free from material
misstatement caused by error. This means that they should design procedures that are capable of detecting
errors.
Internal control:
A process designed and effected by those charged with governance, management, and other personnel to provide
reasonable assurance about the achievement of the entity's objectives with regard to reliability of financial reporting,
effectiveness and efficiency of operations and compliance with applicable laws and regulations. It follows that
internal control is designed and implemented to address identified business risks that threaten the achievement of
any of these objectives. Internal controls are designed in part to prevent errors occurring in financial information, or
to detect errors and correct them.
Fraud
Definition of fraud
Fraud is a word we normally use to cover a wide range of illegal acts. For audit purposes
Misstatements arising from fraudulent financial reporting
Misstatements arising from misappropriation of assets
In order to have a reasonable expectation of detecting fraud or error, auditors should follow the procedures in BSA
240.
Regarding management, the BSA states that the primary responsibility for the prevention and detection of fraud
rests with both those charged with governance of the entity and with management. To fulfill this responsibility,
various actions can be taken including:
Demonstrating that management follow a culture of honesty and ethical behavior and communicating that
they expect all employees to adhere to this culture
Regarding the auditor, the BSA states that the auditor must obtain reasonable assurance that the financial
statements, taken as a whole, are free from material misstatement, whether caused by fraud or error. The auditor
does not therefore offer complete assurance that the financial statements are free from fraud and/or error as audit
testing is not designed to provide this assurance.
Risk assessment
Part of an auditor's work must include assessing the risk of a fraud existing.
Auditors should also carry out a discussion of the susceptibility of the entity's financial statements to fraud. This will
usually include a consideration of:
Where the company's system is weak and how management could perpetrate(commit) fraud
The circumstances that could indicate earnings management which could lead to fraudulent financial
reporting
The known internal and external factors that could be an incentive to fraud being carried out
Management's involvement in overseeing employees with access to cash or other assets which could be
misappropriated
Any unusual or unexplained changes in behavior/lifestyle of management or employees
The need for professional skepticism
The type of circumstances that could lead to suspicions(doubt) of fraud
Management representations
Auditors are required to obtain particular written representations from management that management
acknowledges its responsibility to design and implement internal controls to prevent and detect fraud and that
management has disclosed any known or suspected frauds by management, employees with a significant role in
internal control, or any other frauds which might have a material impact on the financial statements to the auditor.
In addition, management confirms in writing that it has disclosed the results of its own assessment of whether the
financial statements may be materially affected by fraud.
Concluding on fraud
Fraud is a major cost for business and the statutory audit is not designed to identify every fraud in an audit, merely
those with a material effect.
From time to time, the issue of whether auditors' duties should be extended in relation to fraud is discussed. It can
be argued that the auditors have closer contact with an organisation than any other external advisers and therefore
they are in a position to gain a detailed understanding of the organisation and its systems which should lead to an
ability to discover all frauds at an organisation.
Risk assessment
As part of their risk assessment procedures, auditors should assess the risk that the company is not complying with
any relevant law or regulation.
Non-compliance suspected
When the auditors suspect non-compliance, they should document findings and discuss them with management. If
the auditors cannot obtain sufficient appropriate evidence about the suspected non- compliance, this might
represent a limitation on the scope of the audit, which will result in the auditors not being able to give an unqualified
opinion.
Reporting of non-compliance
The BSA requires that the auditors should communicate discovered instances of non-compliance with laws and
Related parties
Accounting standards require that all transactions with related parties are disclosed.
Auditors need to consider the risk of there being undisclosed related party transactions.
The auditors should ask the directors for a list of related parties and watch out for transactions with those
parties during the course of testing.
Auditors need to carry out specific tests to seek to identify related parties.
The auditors need to ensure that appropriate disclosures have been made about related party transactions.
Written representations about related parties must be obtained from directors.
Money laundering
Money laundering is defined as a wide range of activities in relation to criminal property, including using, acquiring,
concealing and removing from the country.
Auditors responsibilities
If an auditor finds any transaction of source of fund, income and expenses which is not properly substantiated, the
auditor should report the item into the audit report and if necessary, into the letter of weaknesses to management.
Expectations gap
The expectations gap is the gap between the expectations of users of assurance reports and the firm's
responsibilities in respect of those reports.
The expectations gap has been narrowed by:
Improving the required audit report
Inserting paragraphs relating to directors'/auditors' responsibilities in the engagement letter
The role of audit committees, which liaise with auditors
Internal controls
The issue of providing assurance on internal control is important, particularly as little assurance is given on
the effectiveness of internal control by the audit.
Internal control is an important issue given prominence in Bangladesh through the Bangladesh Bank
guideline, and globally by enactment of the US Sarbanes-Oxley Act.
Assess risks that will threaten Design internal control to manage Operate the internal controls in
Identify business objectives
those objectives those risk accordance with their design
Providing assurance on the applicable risks and the design and operation of the system
The starting point for the practitioner would be the entity's business objectives. The key considerations will include:
The completeness of the applicable identified risks
The probability of a risk crystallizing
Inherent limitations
Internal control systems have inherent limitations, a key one of which is the chance of staff colluding in fraud to
override the system. Any assurance report on internal control systems should include a mention of these inherent
limitations, in order to prevent an unnecessary expectations gap.
Reports
The UKs APB makes the key point that it is difficult to issue a standard report for assurance services, which are
largely dependent on the scope and nature of the individual assignment, this has not been reproduced here.
Current issues
IAASB continue a clarity project in which they are updating and reissuing ISAs.
Clarity project
IAASB is in the middle of a clarity project, during which they are reissuing existing BSAs, redrafted so as to make the
requirements within them clearer. Under this project, each BSA will have:
A stated overall objective
Clarified obligations, by use of the word 'shall' where a requirement of the BSA is set out
Eliminating ambiguity in BSAs
Improving the overall readability of BSAs
The most recent exposure drafts under this project are:
BSA 320 Materiality in Planning and Performing an Audit
BSA 450 Evaluation of Misstatements Identified during the Audit
BSA 260 Communication with Those Charged with Governance
Financial Interests
If a member of the assurance team, or their immediate family member, has a direct financial interest, or a material
indirect financial interest, in the assurance client, the self-interest threat created would be so significant the only
safeguards available to eliminate the threat or reduce it to an acceptable level would be to:
Dispose of the direct financial interest prior to the individual becoming a member of the assurance team;
Dispose of the indirect financial interest in total or dispose of a sufficient amount of it so that the remaining
interest is no longer material prior to the individual becoming a member of the assurance team;
Remove the member of the assurance team from the assurance engagement.
1. Leadership
It is important that the culture of the firm is that quality is essential in performing assurance engagements.
This should be lead by the leaders of the firm, that is, the partners.
In practical terms, the people directing the firm and its resources should ensure that:
Commercial considerations do not override the quality of work performed.
The firms policies in relation to staff promotion, remuneration and performance review incorporate the
importance of quality work.
Sufficient resources are allocated to the development, documentation and support of quality control policies
and procedures.
2. Ethical requirements
The firm should have policies and procedures designed to ensure that ethical requirements are met.
3. Acceptance of Engagement
The firm should also have policies and procedures designed to ensure that only appropriate clients are accepted in
the first place and retained. The engagement partner should carry out similar considerations as he did when he
accepted the client every year when bearing in mind whether to retain the client.
4. Human resources
As part of the firms overall culture of quality control, it should have policies and procedures to ensure that it
employs and retains staff with the capabilities, competence and commitment to ethical principles necessary
to perform the engagements.
There should be policies on recruitment, career development, performance evaluation and promotion.
It is also important to allocate staff to assurance engagements appropriately.
As part of the firms overall culture of quality control, it should have policies and procedures to ensure that it
employs and retains staff with the capabilities, competence and commitment to ethical principles necessary to
perform the engagements. This means it should have policies on all aspects of employing professional staff. The
BSQC lists the following:
Recruitment
Performance evaluation
Another important matter in relation to human resources is the allocation of staff to assurance teams. Firms are
required to have policies to ensure that:
Clients are informed of the identity of the engagement partner.
The engagement partner has the capabilities, competence, authority and time to perform his role.
The responsibilities of the partner in respect of the assignment are clearly defined and communicated to
him.
The engagement partner should ensure that he allocates appropriate staff to the engagement team. Staff need:
Understanding of/practical experience with similar engagements
Understanding of relevant professional and legal requirements in relation to the client
Appropriate technical knowledge
Knowledge of the relevant industry
Ability to apply professional judgment
Understanding of the firms quality control procedures and policies
5. Engagement performance
Key issues are
Supervision
Direction
Review
Consultation and
Resolution of disputes
6. Monitoring
The firm must have policies in place to ensure that their quality control procedures are adequate and
relevant, that they are operating effectively and are complied with.
Management of the assurance firm (that is, the partners) should receive an annual report on the
outcome of monitoring activities.
The most important issues will be systematic or repetitive deficiencies.
Although the price of the proposed engagement can be very important, it is not the only consideration for the
company in a tender process. Other important considerations are:
The quality of the service the prospective auditors are likely to provide
The knowledge of the business they possess
The experience of the industry they have
The proposed personnel on the audit team
References obtained about the audit firm
Risk analysis
Firms carry out risk analysis prior to accepting engagements.
This is in order to ensure that the risk of giving an inappropriate opinion on the engagement is not too high.
Matters to consider are whether the directors appear to have integrity, the company has a good financial
record and prospects, the attitude to internal control and the nature of the clients transactions.
Ethical issues
The IFAC Code of Ethics sets out the following points in relation to changes in professional appointment.
Prospective auditors
A professional accountant in public practice should agree to provide only those services that the professional
accountant in public practice is competent to perform. Before accepting a specific client engagement, a professional
accountant in public practice should consider whether acceptance would create any threats to compliance with the
fundamental principles.
If identified threats are other than clearly insignificant, safeguards should be considered and applied as necessary to
eliminate them or reduce them to an acceptable level. Such safeguards may include:
Existing auditor
An existing accountant is bound by confidentiality. The extent to which the professional accountant in public practice
can and should discuss the affairs of a client with a proposed accountant will depend on the nature of the
engagement and on:
Whether the client's permission to do so has been obtained; or
The legal or ethical requirements relating to such communications and disclosure, which may vary by
jurisdiction.
Additional work
A professional accountant in public practice may be asked to undertake work that is complementary or additional to
the work of the existing accountant. Such circumstances may give rise to potential threats to professional
competence and due care resulting from, for example, a lack of or incomplete information. Safeguards against such
threats include notifying the existing accountant of the proposed work, which would give the existing accountant the
opportunity to provide any relevant information needed for the proper conduct of the work.
Legal issues
Companies Act 1994 covers the procedures of appointment, remuneration and removal of statutory auditors, which
is reproduced as under:
4. If an appointment of an auditor is not made at an annual general meeting, the Government may appoint a
person to fill the vacancy.
5. The company shall, within seven days of the Governments power under subsection (4) becoming exercisable,
Section 211
1. Special notice shall be required for a resolution at an annual general meeting appointing as auditor a person
other than a retiring auditor, or providing expressly that a retiring auditor shall not be re- appointed.
2. On receipt of such notice the company shall forthwith send a copy thereof to the retiring auditor,
3. Where such notice is given and the retiring auditor makes with respect thereto representation in writing to
the company and requests their notification to members of the company, the company shall, unless the
representations are received by it too late for it to do so-
a. in any notice of the resolution given to members of the company, state the fact of the representation
having been made; and
b. send a copy of the representation to every member of the company to whom notice of the meeting is
sent, whether before or after the receipt of the representation by the company, and if a copy of the
representation, is not sent as aforesaid because they were received too late or because of the company's
default, the auditor may, without prejudice to his right to be heard orally, require that the presentation
shall be read out at the meeting. Provided that copies of the representations need not be sent out and
the representations need not be read out at the meeting, if, on the application either of the company or
of any other person who claims to be aggrieved, the court is satisfied that the rights conferred by this
sub- section are being abused to secure needless publicity for defamatory matter; and the Court may
order the company's costs on such an application to be paid in whole or in part by the auditor,
notwithstanding that he is not a party to the application.
4. Sub-sections (2) and (3) shall apply to a resolution to remove the first auditors or any of them under sub-
Recurring audits
When the audit is a recurring audit, it is not necessary to issue a new letter each year. However, the auditors should
consider every year whether a new letter is required. The following factors may indicate a new letter is required:
Indications that the client misunderstands the terms of the engagement
Revised or special terms of the engagement
A recent change in senior management or directors
A significant change in ownership of the company
A significant change in the nature or size of the company
Legal or regulatory requirements
Changes in engagement
If the auditor is asked to change the engagement to one which provides a lower level of assurance then he should
consider the appropriateness of doing so. Obviously, if the audit is a statutory audit, the auditor must provide an
appropriate audit as required by law, that is one giving reasonable assurance on the truth and fairness of the
engagement. If the terms are changed, the auditor and the client must agree the terms. If the auditor and the client
cannot agree, the auditor should withdraw from the existing arrangement.
Materiality
Material: Information is material if its omission or misstatement could influence the economic decisions of users
taken on the basis of the financial statements. Materiality depends on the size of the item or error judged in the
particular circumstances of its omission or misstatement. Thus, materiality provides a threshold or cut-off point
rather than being a primary qualitative characteristic which information must have if it is to be useful.
Auditors should consider materiality when determining the nature, timing and extend of audit procedures. Items
might be material due to their:
Amount/value/quantity
Nature/quality
Some matters are automatically material, such as matters relating to directors, or related parties because these
matters have to be disclosed in financial statements regardless of the value of them.
Analytical procedures
Analytical procedures must be used in risk assessment.
The benefits of analytical procedures in planning is the 'overall' perspective, the use of information outside of
the accounting records and the comparison of different elements of the financial statements.
The limitations of analytical procedures in planning are:
Substantial knowledge of the business is required for results to be meaningful (therefore experienced
staff may be required to carry them out)
They can be performed mechanically
The relevant information may not be available
How?
Understanding of the client's business can be obtained from:
External sources of information (such as industry surveys/publications)
The firm (permanent files (including previous years' audited financial statements), correspondence files,
personnel associated with the engagement in previous years)
The client (personnel, correspondence/procedures manuals, watching procedures, current year
management accounts)
Auditors are required to carry out a combination of procedures to understand the business:
Inquiries of client personnel
Analytical procedures
Observation and inspection
Understanding
the Business
What?
The basics
If the following nine questions have been answered in sufficient depth, the audit file should contain sufficient
evidence that the auditors have satisfied the requirements of BSA 315.
1. What does the client do?
2. What are the characteristics of the industry/environment in which it operates?
3. Is it governed by specific laws and regulations, or is it at greater risk than other businesses from the incidence
of more general laws and regulations?
4. What are the characteristics of its relationships with external parties, shareholders, other stakeholders,
trading partners and providers of finance?
5. Is it under threat from takeover or lack of finance?
6. Are there any dealings with related parties?
7. How competent is its management?
8. Are suitable systems and controls in place?
9. What accounting policies has it adopted?
Md. Shakhawat Hossain (Howladar Yunus & Co.) Page 23
Audit & Assurance (CA-- Application Level)
Laws and regulations
The appendix to BSA 250 gives the following list of indicators of non-compliance:
Investigation by a government department
Payment of fines or penalties
Payments for unspecified services or loans to consultants, related parties, employees or government
employees
Sales commissions or agents' fees that appear excessive in relation to those normally paid by the entity or in
its industry or to the services actually received
Purchasing at prices significantly above or below market price
Unusual payments in cash, purchases in the form of cashiers' cheques payable to bearer or transfers to
numbered bank accounts
Complex corporate structures including offshore companies where ownership cannot be identified
Unusual transactions with companies registered in tax havens
Tax evasion such as the wider declaring of income and overclaiming of expenses
Payments for goods or services made other than to the country from which the goods or services
originated
Payments without proper exchange control documentation
Existence of an accounting system that fails, whether by design or by accident, to provide adequate audit
trail or sufficient evidence
Unauthorised transactions or improperly recorded transactions
Media comment
Transactions undertaken by the entity that have no apparent purpose or that make no obvious economic
sense
Where those charged with governance of the entity refuse to provide necessary information and
explanation to support transactions and other dealings of the company
Money laundering
According to BSA 310, para 2, the auditor should obtain a knowledge of the business sufficient to enable the auditor
to identify and understand the events, transactions and practices that, in auditors judgment, may have a significant
effect on the financial statements or on the examination or audit report. One of the key principles stressed by the
authorities dealing with Money Laundering in Bangladesh and worldwide is KYC - know your client.
The firm will need to have checked the client's identity, when they first became a client and will need to keep
the evidence on file for a sufficient period after they cease to be a client
Where does the money come from? Auditors should think about the real nature of the business's sales, but
also about the source of the start-up capital and any other equity and loans raised
Remember the money launderer wants to overstate income and loves paying tax on the excess, which goes
against the grain of the way most auditors think.
Fraud
The BSA makes a crucial distinction between two types of misstatements arising from fraud:
1. Misstatements arising from fraudulent financial reporting
2. Misstatements arising from misappropriation of assets
In understanding the client's business there are some key questions that need to be asked:
Can the figures be manipulated and if so how?
Which areas are most susceptible to manipulation?
Can assets be misappropriated and if so how?
Which areas are most at risk?
Directors are required to manage business risks. Business risk management is an area in which assurance can
be required.
However, it is not simply shareholders and lenders that will want assurance in this area. Management might
want assurance services to provide an indication of how well they are performing in controlling the risks to
the company, to ensure it continues in business, but also as evidence that it is operating efficiently and cost-
effectively.
Auditors are interested in business risk because issues which pose threats to the business may in some cases
also be a risk of the financial statements being misstated (which is a component of audit risk).
Audit risk
1. Inherent risk
Inherent risk is the susceptibility of an assertion to misstatement that could be material, individually or when
aggregated with other misstatements, assuming that there were no related internal controls.
In other words, how likely is it that, the account balance or transfer will be wrong? And how likely is it that, as a
result, the financial statements will be misstated by a material amount? Inherent risk can be analyzed on a number of
levels which are covered in turn below.
At industry or sector level: Different industries have different levels of inherent risk.
At entity level: At entity level there will also be different levels of inherent risk.
At balance level: Different balances can also carry different inherent risks.
2. Control risk
Control risk is the risk that a misstatement that could occur in an assertion and that could be material, individually or
when aggregated with other misstatements, will not be prevented or detected and corrected on a timely basis by the
entity's internal control.
Control risk will be lower where effective control measures are taken. However there will always be control risk due
to the limitations of internal controls:
Cost > benefit
3. Detection risk
Detection risk is the risk that an auditors procedures will not detect a misstatement that exists in an assertion that
could be material, individually or when aggregated with other misstatements.
It is up to the auditor to organize the way the engagement is handled, so that the risk of material misstatement is
reduced to acceptable levels.
This will include:
Ensuring the audit team (including the engagement partner) has the necessary mix and depth of experience
and skills
Devising an audit plan which tackles the audit risks
Significant risks
Significant risks are referred to in BSA 315.
Significant risks are items that are unusual or one-offs.
A significant risk is a risk which requires special audit consideration.
Documentation
BSAs 315 and 330 contain a number of requirements regarding documentation.
The following matters should be documented:
The discussion among the audit team concerning the susceptibility of the financial statements to material
misstatements, including any significant decisions reached
Key elements of the understanding gained of the entity including the elements of the entity and its control
specified in the BSA as mandatory, the sources of the information gained and the risk assessment procedures
carried out
The identified and assessed risks of material misstatement
Significant risks identified and related controls evaluated
The overall responses to address the risks of material misstatement
Nature, extent and timing of further audit procedures linked to the assessed risks at the assertion level
If the auditors have relied on evidence about the effectiveness of controls from previous audits, conclusions
about how this is appropriate.
Reliance on controls
The auditors carry out tests of controls when:
They are intending to rely on controls
They are unable to derive sufficient evidence from substantive procedures
In summary, BSA 330 says that if auditors want to rely on a control:
They have to test it
They have to obtain evidence that it is effective
They have to obtain evidence that it operated throughout the period under review
They have to flex their approach in accordance with the nature of the control and the risk it is seeking to
mitigate
Principal auditors are the auditors with responsibility for reporting on the financial statements of an entity when
those financial statements include financial information of one or more components audited by other auditors.
Other auditors are auditors, other than the principal auditors, with responsibility for reporting on the financial
information of a component (for example a subsidiary company see below) which is included in the financial
statements audited by the principal auditors. Other auditors include affiliated firms, whether using the same name or
not, and correspondent firms, as well as unrelated auditors.
Correspondent firms are firms which are loosely associated, generally for the purposes of referring work.
Component is a division, branch, subsidiary, joint venture, associated undertaking or other entity whose financial
information is included in financial statements audited by the principal auditors.
Reporting considerations
In terms of reporting, the BSA states: 'when the principal auditor concludes that the work of the other auditor cannot
be used and the principal auditor has not been able to perform sufficient additional procedures regarding the
financial information of the component audited by the other auditor, the principal auditor should express a qualified
opinion or disclaimer of opinion because there is a limitation in the scope of the audit.'
If the other auditors issue a modified report, the principal auditors should consider whether the nature and
significance of the qualification means that the principal auditors' report also needs to be modified.
Practical issues
For every engagement there will be an engagement partner who takes overall responsibility for the engagement and
who has specific responsibility for ensuring the firm and the teams:
Competence
Objectivity
and for:
Approving the audit strategy
Communicating his or her knowledge of the client to the audit team
Ensuring that staff are briefed and supervised appropriately
Ensuring appropriate reviews are carried out of staffs work
Reviewing the financial statements, the key areas and any working papers not otherwise reviewed.
The audit strategy should make clear who is responsible for which aspects of the audit, and should strike the difficult
balance between:
Ensuring each member of the team has sufficient experience for the job in hand
Setting new challenges so that experience can be gained, and
Cost
Location
The location that the audit work takes place at will depend on the nature of the client and the risk assessment.
Nature of evidence
It will be important to address the practical issue of what sources of evidence the audit firm expects to obtain during
the audit. Information generated by the client is never as good quality as information generated by the auditor or
from third parties. The audit strategy should set out where information should be sought from third parties (such as
in respect of receivables or confirmation of a loan).
Some larger companies may be listed on Stock Exchanges so that their shares are available for the public at large to
trade in. Such 'listed' companies are subject to a higher degree of regulation than 'non-listed' ones, as they are
required to conform to SEC rules and regulations. Bangladesh companies that are subsidiaries of companies listed on
the US Stock Exchange are required to conform to the US Sarbanes-Oxley Act.
Specialized entities
Some entities are special in some way, for example:
The entity is subject to extra regulations, such as banks or insurance companies, or NGOs (note that we
shall look in particular at NGOs below)
The entity is subject to professional rules, such as lawyers
Such entities may be subject to special auditing guidance, all of which is outside the scope of your syllabus.
It is important to note that many of these entities require a normal statutory audit as well as any additional
requirements upon them.
In which case, the auditors need to assess the particular risks associated with the specialized entities which
will cause any differences in audit approach.
Objective:
The partner needs to consider:
The financial statements
The work done to support the audit opinion
Interpretation: The person carrying out the analytical procedures, reads through the financial statements and
interprets them, considering the absolute figures themselves and relevant ratios.
Investigation: When analytical procedures are used as risk assessment procedures or as a substantive procedure, the
aim is to identify potential problems. The problems are then investigated during fieldwork by making enquiries and
gathering audit evidence. At the completion stage the reviewer will expect to find the answers to the issues raised by
the review on the audit file
Corroboration: Should those answers not be on the file, further work will need to be done. From a practical point of
view it is worth remembering the following:
For the smaller client the working papers supporting the final analytical procedures may well be simply an
update of the work done at the planning stage.
For the larger client the review becomes a much more specific exercise.
The financial statements used for the analytical procedures need to incorporate any adjustments made as a
result of the audit.
Any problems identified by the procedures, which indicate that the financial statements should to be
amended, need to take necessary action.
Other matters
The auditor needs to:
Evaluate discovered errors
Ensure opening balance and comparatives are correct
Review whenever the going concern basis of the financial statements is appropriate
Review subsequent events
Obtain necessary management representations
See the book for detail (page- 254)
The business
Comments on significant changes in the client's operations during the year, and anticipated in the coming year.
The financial statements
To avoid misunderstandings, the engagement letter should explain that auditors will only communicate matters that
come to their attention as a result of the performance of the audit. It should state that the auditors are not required
to design procedures for the purpose of identifying matters of governance interest.
The letter may also:
Describe the form which any communications on governance matters will take
Identify the relevant persons with whom such communications will be made
Identify any specific matters of governance interest which it has agreed are to be communicated
Relevant matters
The scope of the BSA is limited to matters that come to the auditors' attention as a result of the audit; the auditors
are not required to design procedures to identify matters of governance interest.
Such matters would include:
Relationships that may bear on the firm's independence and the integrity and objectivity of the audit
engagement partner and audit staff
The general approach or overall scope of the audit, including limitations or additional requirements
Selection of, or changes in, significant accounting policies
The potential effect on the financial statements of any significant risks and exposures, for example pending
litigation, that are required to be disclosed in the financial statements
Significant audit adjustments
Material uncertainties affecting the organisation's ability to continue as a going concern
Significant disagreements with management
Expected modifications to the audit report
Other significant matters such as material weaknesses in internal control, questions regarding management
integrity, and fraud involving management
Other matters mentioned in the terms of engagement
Uncorrected misstatements aggregated by the auditor during the audit that were determined by
management to be immaterial, both individually and in the aggregate, to the financial statements taken as a
whole
How?
Matters may be communicated orally or in writing, but they should be recorded in the audit working papers,
however discussed. Auditors should make clear that the audit is not designed to identify all relevant matters
Assurance reports
Proformas for review reports and other assurance reports are given in international standards.
There is less formal requirement in relation to assurance reports generally than there is for audit reports.